letsencrypt wildcard domain support about certbot-route53 HOT 2 OPEN

I can confirm that using

--server "https://acme-v02.api.letsencrypt.org/directory"

does the job at poking the right acme server for initiating the challenge!

from certbot-route53.

I had the same issue. As far as I can tell the problem is when you specify 2 'subdomains' (*.mylinuxguy.org and mylinuxguy.org) the auth hook is invoked twice. That means you need to create 2 TXT records for _acme-challenge.mylinuxguy.org.

However, the script uses the route53 change-resource-record-sets command with an UPSERT (which is correct), but it means the second hook overrides the first.

The way I fixed it is to no-op on the first hook but to write the certbot validation value to a file. Then on the second request I write both values to the TXT record using route53 change-resource-record-sets

That means your JSON change needs to look something like

      {
        "Changes":[
          {
            "Action":"${ACTION}",
            "ResourceRecordSet":{
              "ResourceRecords":[
                {
                  "Value": "\"$PREVIOUS_CERTBOT_VALIDATION\""
                },
                {
                  "Value": "\"$CERTBOT_VALIDATION\""
                }
              ],
              "Name":"_acme-challenge.${CERTBOT_DOMAIN}.",
              "Type":"TXT",
              "TTL":30
            }
          }
        ]
      }

This works for both the auth-hook and the auth-hook cleanup.

from certbot-route53.