Certifying Multiple DNS Names: What Else is Required for Correct Verification?

Introduction

In this article, we will discuss how to create a Let's Encrypt certificate that contains multiple domains, specifically one.example.com and two.example.com. We will cover the key concepts related to DNS names and certificate verification, and provide detailed instructions on how to correctly verify the certificate.

Understanding DNS Names

DNS (Domain Name System) is a system that translates human-readable domain names (such as example.com) into IP addresses (such as 192.0.2.1). A DNS name can consist of multiple parts, separated by dots. For example, one.example.com consists of three parts: one, example, and com.

In the context of Let's Encrypt certificates, it is important to understand that a single certificate can contain multiple DNS names. This is known as a multi-domain certificate, and it allows you to secure multiple domains with a single certificate.

Creating a Let's Encrypt Certificate with Multiple DNS Names

To create a Let's Encrypt certificate with multiple DNS names, you will need to use a tool that supports the ACME (Automatic Certificate Management Environment) protocol. One such tool is certbot, which is a popular and easy-to-use ACME client.

To use certbot to create a certificate with multiple DNS names, you will need to run the following command:

This command will create a certificate for the DNS names one.example.com and two.example.com. The --manual flag tells certbot to use the manual plugin, which allows you to specify your own DNS provider and authentication method. The --preferred-challenges=dns flag tells certbot to use the DNS-01 challenge type, which requires you to prove ownership of the DNS names by adding a TXT record to your DNS configuration.

The --manual-auth-hook and --manual-cleanup-hook options allow you to specify scripts that will be run before and after the certificate is issued. These scripts can be used to automate the process of adding and removing the TXT records from your DNS configuration.

Adding the TXT Record

To add the TXT record to your DNS configuration, you will need to follow the instructions provided by your DNS provider. The exact steps will vary depending on your provider, but generally you will need to:

1. Log in to your DNS provider's website
2. Navigate to the DNS management page for the domain
3. Add a new TXT record with the name and value provided by certbot
4. Save the changes

Once you have added the TXT record, you can use the dig command to verify that it is correctly configured:

This command should return a response that includes the TXT record value provided by certbot.

Removing the TXT Record

Once the certificate has been issued, you can remove the TXT record from your DNS configuration. This can be done using the same steps as above, but instead of adding a new TXT record, you will need to delete the existing one.

To automate this process, you can use the --manual-cleanup-hook option to specify a script that will be run after the certificate is issued. This script can be used to remove the TXT record from your DNS configuration.

• Let's Encrypt certificates can contain multiple DNS names, which allows you to secure multiple domains with a single certificate.

• To create a Let's Encrypt certificate with multiple DNS names, you can use the certbot tool and the manual plugin.

• When using the manual plugin, you will need to add a TXT record to your DNS configuration to prove ownership of the DNS names.

• You can use the --manual-auth-hook and --manual-cleanup-hook options to automate the process of adding and removing the TXT records from your DNS configuration.

References

• Let's Encrypt

• Certbot

• ACME (Automatic Certificate Management Environment) protocol