[pve-devel] RFC for ACME DNS Challenge

Wolfgang Link w.link at proxmox.com
Mon Oct 14 13:08:13 CEST 2019


This series also includes a new GIT repository on proxdev.
The path is staff/wl/pve-acme.

The acme_sh project is used as DNS API plugin systems.
So we can reuse the already defiend plugins.
I deside to install the complett acme_sh scrips so somwone could use it
for alternative use.

I'm not sure about where we save the information about the dns_plugin.
I deside to load it dynamicly like we do with ceph key for the storage.
Alternative we could save the information in the node config,
as I already specify in patch manger 6 Add dns_api_config.

The dns key file is not standiziert so ervery plugin expect other paramerts.
So I would say the dns key file has to be created from the user manually.

If someone need a OVH key for testing please contact me.

Steps to test.
The api key file must exists on /etc/pve/priv/acme/dns_ovh.cred

1.) pvenode acme account register default <mail at example.invalid>
2.) pvenode config set --acme domains=test.linksystems.li,plugin=acme_sh
3.) pvenode cert order

These patches are only tested against the OVH API because of missing alternative possibilities.

There are two bugs in this Series.
I send it anyway because they are not essential to the genrall functionality
and this is anyway an RFC and not the final version.
Known bugs:
Alias does not work in acme_sh.
Multiples domains will only use one domain in certivicate.






More information about the pve-devel mailing list