Solution to the below problem: Use $ddns-confgen
or $tsig-keygen
, the former provides you with the syntax to paste into your named.conf
file
Problem:
I am trying to configure a BIND9 (ver9.161-Ubuntu) to allow me to create TXT records which Letsecrypt can use to validate the domain, ultimately to allow for the generation of SSL certs for internal/private systems.
There is plenty of documentation on the processes, in particular a step by step guide from Home Assistant (Home automation suite on configuring nginx + letsencrypt). HOWEVER, the algorithms and processes appear to have changed since the documentation was originally produced.
Documentation requires that a DNSSEC key is generated to allow for host updates
$dnssec-keygen -a HMAC-SHA512 -b 512 -n HOST letsencrypt
dnssec-keygen: fatal: unknown algorithm HMAC-SHA512
If I run dnssec-keygen --help
, it provides a list of algorithms which are
"RSASHA1 | NSEC3RSASHA1 | RSASHA256 | RSASHA512 | ECDSAP256SHA256 | ECDSAP384SHA384 | ED25519 | ED448 | DH"
If the above command is changed to: RSASHA512
and key size changes to 1024
then the system errors with:
dnssec-keygen: fatal: invalid DNSKEY nametype HOST
After wading through the algorithm's the only one which does not throw an error is DH, by setting the alogorithm to DH a key is generated.
The next issue is that the DH protocol is not recognised when used in the name.conf.local file.
adding a key section into the named.conf.local
file:
key "letsencrypt" {
algorithm DH;
secret "averylongkey==";
};
but when I run:
$ sudo named-checkconf
/etc/bind/named.conf.local:14: unknown algorithm 'DH'
Basically the old documentation is asking you to use an outdated keygen method.
TXT
records for Let's Encrypt are needed to issue certificates, and do not need any specific DNS configuration, while your whole text speaks about DNSSEC and you seem utterly confused. You don't need DNSSEC at all (and probably should not try to use it right now before fully understanding it), just to add oneTXT
record for Let's Encrypt.TXT
records that asks you to set up DNSSEC?