python-certbot-dns-rfc2136-doc 0.23.0-1 / usr / share / doc / python3-certbot-dns-rfc2136 / html / index.html

This file is indexed.

/usr/share/doc/python3-certbot-dns-rfc2136/html/index.html is in python-certbot-dns-rfc2136-doc 0.23.0-1.

This file is owned by root:root, with mode 0o644.

The actual contents of the file can be viewed below. 

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
<!DOCTYPE html>
<!--[if IE 8]><html class="no-js lt-ie9" lang="en" > <![endif]-->
<!--[if gt IE 8]><!--> <html class="no-js" lang="en" > <!--<![endif]-->
<head>
  <meta charset="utf-8">
  
  <meta name="viewport" content="width=device-width, initial-scale=1.0">
  
  <title>Welcome to certbot-dns-rfc2136’s documentation! &mdash; certbot-dns-rfc2136 0 documentation</title>
  

  
  
  
  

  

  
  
    

  

  
  
    <link rel="stylesheet" href="_static/css/theme.css" type="text/css" />
  

  

  
        <link rel="index" title="Index"
              href="genindex.html"/>
        <link rel="search" title="Search" href="search.html"/>
    <link rel="top" title="certbot-dns-rfc2136 0 documentation" href="#"/>
        <link rel="next" title="API Documentation" href="api.html"/> 

  
  <script src="_static/js/modernizr.min.js"></script>

</head>

<body class="wy-body-for-nav" role="document">

   
  <div class="wy-grid-for-nav">

    
    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
      <div class="wy-side-scroll">
        <div class="wy-side-nav-search">
          

          
            <a href="#" class="icon icon-home"> certbot-dns-rfc2136
          

          
          </a>

          
            
            
              <div class="version">
                0
              </div>
            
          

          
<div role="search">
  <form id="rtd-search-form" class="wy-form" action="search.html" method="get">
    <input type="text" name="q" placeholder="Search docs" />
    <input type="hidden" name="check_keywords" value="yes" />
    <input type="hidden" name="area" value="default" />
  </form>
</div>

          
        </div>

        <div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="main navigation">
          
            
            
              
            
            
              <ul>
<li class="toctree-l1"><a class="reference internal" href="api.html">API Documentation</a></li>
</ul>

            
          
        </div>
      </div>
    </nav>

    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap">

      
      <nav class="wy-nav-top" role="navigation" aria-label="top navigation">
        
          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
          <a href="#">certbot-dns-rfc2136</a>
        
      </nav>


      
      <div class="wy-nav-content">
        <div class="rst-content">
          















<div role="navigation" aria-label="breadcrumbs navigation">

  <ul class="wy-breadcrumbs">
    
      <li><a href="#">Docs</a> &raquo;</li>
        
      <li>Welcome to certbot-dns-rfc2136’s documentation!</li>
    
    
      <li class="wy-breadcrumbs-aside">
        
            
            <a href="_sources/index.rst.txt" rel="nofollow"> View page source</a>
          
        
      </li>
    
  </ul>

  
  <hr/>
</div>
          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
           <div itemprop="articleBody">
            
  <div class="section" id="welcome-to-certbot-dns-rfc2136-s-documentation">
<h1>Welcome to certbot-dns-rfc2136’s documentation!<a class="headerlink" href="#welcome-to-certbot-dns-rfc2136-s-documentation" title="Permalink to this headline"></a></h1>
<div class="toctree-wrapper compound">
</div>
<span class="target" id="module-certbot_dns_rfc2136"></span><p>The <a class="reference internal" href="api/dns_rfc2136.html#module-certbot_dns_rfc2136.dns_rfc2136" title="certbot_dns_rfc2136.dns_rfc2136"><code class="xref py py-obj docutils literal"><span class="pre">dns_rfc2136</span></code></a> plugin automates the process of
completing a <code class="docutils literal"><span class="pre">dns-01</span></code> challenge (<code class="xref py py-obj docutils literal"><span class="pre">DNS01</span></code>) by creating, and
subsequently removing, TXT records using RFC 2136 Dynamic Updates.</p>
<div class="section" id="named-arguments">
<h2>Named Arguments<a class="headerlink" href="#named-arguments" title="Permalink to this headline"></a></h2>
<table border="1" class="docutils">
<colgroup>
<col width="50%" />
<col width="50%" />
</colgroup>
<tbody valign="top">
<tr class="row-odd"><td><code class="docutils literal"><span class="pre">--dns-rfc2136-credentials</span></code></td>
<td>RFC 2136 <a class="reference internal" href="#credentials">credentials</a> INI file.
(Required)</td>
</tr>
<tr class="row-even"><td><code class="docutils literal"><span class="pre">--dns-rfc2136-propagation-seconds</span></code></td>
<td>The number of seconds to wait for DNS
to propagate before asking the ACME
server to verify the DNS record.
(Default: 60)</td>
</tr>
</tbody>
</table>
</div>
<div class="section" id="credentials">
<h2>Credentials<a class="headerlink" href="#credentials" title="Permalink to this headline"></a></h2>
<p>Use of this plugin requires a configuration file containing the target DNS
server that supports RFC 2136 Dynamic Updates, the name of the TSIG key, the
TSIG key secret itself and the algorithm used if it’s different to HMAC-MD5.</p>
<div class="literal-block-wrapper docutils container" id="credentials-ini">
<div class="code-block-caption"><span class="caption-text">Example credentials file:</span><a class="headerlink" href="#credentials-ini" title="Permalink to this code"></a></div>
<div class="highlight-ini"><div class="highlight"><pre><span></span><span class="c1"># Target DNS server</span>
<span class="na">dns_rfc2136_server</span> <span class="o">=</span> <span class="s">192.0.2.1</span>
<span class="c1"># TSIG key name</span>
<span class="na">dns_rfc2136_name</span> <span class="o">=</span> <span class="s">keyname.</span>
<span class="c1"># TSIG key secret</span>
<span class="na">dns_rfc2136_secret</span> <span class="o">=</span> <span class="s">4q4wM/2I180UXoMyN4INVhJNi8V9BCV+jMw2mXgZw/CSuxUT8C7NKKFs AmKd7ak51vWKgSl12ib86oQRPkpDjg==</span>
<span class="c1"># TSIG key algorithm</span>
<span class="na">dns_rfc2136_algorithm</span> <span class="o">=</span> <span class="s">HMAC-SHA512</span>
</pre></div>
</div>
</div>
<p>The path to this file can be provided interactively or using the
<code class="docutils literal"><span class="pre">--dns-rfc2136-credentials</span></code> command-line argument. Certbot records the
path to this file for use during renewal, but does not store the file’s contents.</p>
<div class="admonition caution">
<p class="first admonition-title">Caution</p>
<p class="last">You should protect this TSIG key material as it can be used to potentially
add, update, or delete any record in the target DNS server. Users who can
read this file can use these credentials to issue arbitrary API calls on
your behalf. Users who can cause Certbot to run using these credentials can
complete a <code class="docutils literal"><span class="pre">dns-01</span></code> challenge to acquire new certificates or revoke
existing certificates for associated domains, even if those domains aren’t
being managed by this server.</p>
</div>
<p>Certbot will emit a warning if it detects that the credentials file can be
accessed by other users on your system. The warning reads “Unsafe permissions
on credentials configuration file”, followed by the path to the credentials
file. This warning will be emitted each time Certbot uses the credentials file,
including for renewal, and cannot be silenced except by addressing the issue
(e.g., by using a command like <code class="docutils literal"><span class="pre">chmod</span> <span class="pre">600</span></code> to restrict access to the file).</p>
<div class="section" id="sample-bind-configuration">
<h3>Sample BIND configuration<a class="headerlink" href="#sample-bind-configuration" title="Permalink to this headline"></a></h3>
<p>Here’s a sample BIND configuration for Certbot to use. You will need to
generate a new TSIG key, include it in the BIND configuration and grant it
permission to issue updates on the target DNS zone.</p>
<div class="literal-block-wrapper docutils container" id="id1">
<div class="code-block-caption"><span class="caption-text">Generate a new SHA512 TSIG key</span><a class="headerlink" href="#id1" title="Permalink to this code"></a></div>
<div class="highlight-bash"><div class="highlight"><pre><span></span>dnssec-keygen -a HMAC-SHA512 -b <span class="m">512</span> -n HOST keyname.
</pre></div>
</div>
</div>
<div class="admonition note">
<p class="first admonition-title">Note</p>
<p class="last">There are a few tools shipped with BIND that can all generate TSIG keys;
<code class="docutils literal"><span class="pre">dnssec-keygen</span></code>, <code class="docutils literal"><span class="pre">rndc-confgen</span></code>, and <code class="docutils literal"><span class="pre">ddns-confgen</span></code>. Try and use the
most secure algorithm supported by your DNS server.</p>
</div>
<div class="literal-block-wrapper docutils container" id="id2">
<div class="code-block-caption"><span class="caption-text">Sample BIND configuration</span><a class="headerlink" href="#id2" title="Permalink to this code"></a></div>
<div class="highlight-none"><div class="highlight"><pre><span></span>key &quot;keyname.&quot; {
  algorithm hmac-sha512;
  secret &quot;4q4wM/2I180UXoMyN4INVhJNi8V9BCV+jMw2mXgZw/CSuxUT8C7NKKFs AmKd7ak51vWKgSl12ib86oQRPkpDjg==&quot;;
};

zone &quot;example.com.&quot; IN {
  type master;
  file &quot;named.example.com&quot;;
  update-policy {
    grant keyname. name _acme-challenge.example.com. txt;
  };
};
</pre></div>
</div>
</div>
<div class="admonition note">
<p class="first admonition-title">Note</p>
<p class="last">This configuration limits the scope of the TSIG key to just be able to
add and remove TXT records for one specific host for the purpose of
completing the <code class="docutils literal"><span class="pre">dns-01</span></code> challenge. If your version of BIND doesn’t
support the
<a class="reference external" href="http://www.zytrax.com/books/dns/ch7/xfer.html#update-policy">update-policy</a>
directive then you can use the less-secure
<a class="reference external" href="http://www.zytrax.com/books/dns/ch7/xfer.html#allow-update">allow-update</a>
directive instead.</p>
</div>
</div>
</div>
<div class="section" id="examples">
<h2>Examples<a class="headerlink" href="#examples" title="Permalink to this headline"></a></h2>
<div class="literal-block-wrapper docutils container" id="id3">
<div class="code-block-caption"><span class="caption-text">To acquire a certificate for <code class="docutils literal"><span class="pre">example.com</span></code></span><a class="headerlink" href="#id3" title="Permalink to this code"></a></div>
<div class="highlight-bash"><div class="highlight"><pre><span></span>certbot certonly <span class="se">\</span>
  --dns-rfc2136 <span class="se">\</span>
  --dns-rfc2136-credentials ~/.secrets/certbot/rfc2136.ini <span class="se">\</span>
  -d example.com
</pre></div>
</div>
</div>
<div class="literal-block-wrapper docutils container" id="id4">
<div class="code-block-caption"><span class="caption-text">To acquire a single certificate for both <code class="docutils literal"><span class="pre">example.com</span></code> and
<code class="docutils literal"><span class="pre">www.example.com</span></code></span><a class="headerlink" href="#id4" title="Permalink to this code"></a></div>
<div class="highlight-bash"><div class="highlight"><pre><span></span>certbot certonly <span class="se">\</span>
  --dns-rfc2136 <span class="se">\</span>
  --dns-rfc2136-credentials ~/.secrets/certbot/rfc2136.ini <span class="se">\</span>
  -d example.com <span class="se">\</span>
  -d www.example.com
</pre></div>
</div>
</div>
<div class="literal-block-wrapper docutils container" id="id5">
<div class="code-block-caption"><span class="caption-text">To acquire a certificate for <code class="docutils literal"><span class="pre">example.com</span></code>, waiting 30 seconds
for DNS propagation</span><a class="headerlink" href="#id5" title="Permalink to this code"></a></div>
<div class="highlight-bash"><div class="highlight"><pre><span></span>certbot certonly <span class="se">\</span>
  --dns-rfc2136 <span class="se">\</span>
  --dns-rfc2136-credentials ~/.secrets/certbot/rfc2136.ini <span class="se">\</span>
  --dns-rfc2136-propagation-seconds <span class="m">30</span> <span class="se">\</span>
  -d example.com
</pre></div>
</div>
</div>
</div>
<div class="toctree-wrapper compound">
<ul>
<li class="toctree-l1"><a class="reference internal" href="api.html">API Documentation</a></li>
</ul>
</div>
</div>
<div class="section" id="indices-and-tables">
<h1>Indices and tables<a class="headerlink" href="#indices-and-tables" title="Permalink to this headline"></a></h1>
<ul class="simple">
<li><a class="reference internal" href="genindex.html"><span class="std std-ref">Index</span></a></li>
<li><a class="reference internal" href="py-modindex.html"><span class="std std-ref">Module Index</span></a></li>
<li><a class="reference internal" href="search.html"><span class="std std-ref">Search Page</span></a></li>
</ul>
</div>


           </div>
           <div class="articleComments">
            
           </div>
          </div>
          <footer>
  
    <div class="rst-footer-buttons" role="navigation" aria-label="footer navigation">
      
        <a href="api.html" class="btn btn-neutral float-right" title="API Documentation" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right"></span></a>
      
      
    </div>
  

  <hr/>

  <div role="contentinfo">
    <p>
        &copy; Copyright 2018, Certbot Project.

    </p>
  </div>
  Built with <a href="http://sphinx-doc.org/">Sphinx</a> using a <a href="https://github.com/snide/sphinx_rtd_theme">theme</a> provided by <a href="https://readthedocs.org">Read the Docs</a>. 

</footer>

        </div>
      </div>

    </section>

  </div>
  


  

    <script type="text/javascript">
        var DOCUMENTATION_OPTIONS = {
            URL_ROOT:'./',
            VERSION:'0',
            COLLAPSE_INDEX:false,
            FILE_SUFFIX:'.html',
            HAS_SOURCE:  true,
            SOURCELINK_SUFFIX: '.txt'
        };
    </script>
      <script type="text/javascript" src="_static/jquery.js"></script>
      <script type="text/javascript" src="_static/underscore.js"></script>
      <script type="text/javascript" src="_static/doctools.js"></script>

  

  
  
    <script type="text/javascript" src="_static/js/theme.js"></script>
  

  
  
  <script type="text/javascript">
      jQuery(function () {
          SphinxRtdTheme.StickyNav.enable();
      });
  </script>
   

</body>
</html>

APT Browse - Built by Thomas Orozco.