CODEWITHSUNDEEP
ssldnsamazon-route53lets-encryptcertbot
codeinprogress
codeinprogress

Reputation: 3501

Certbot unable to find AWS credentials when issuing certificate via dns for route53

I need to get an certificate for my domain hosted on AWS Route 53 from LetsEncrypt. I do not have any port 80 or 443 exposed since the server is used for VPN and does not have a public access.

So the only way to do this is via DNS validation of route 53.

So far I have installed certbot and dns-route53 plugin

sudo snap install --beta --classic certbot
sudo snap set certbot trust-plugin-with-root=ok
sudo snap install --beta certbot-dns-route53
sudo snap connect certbot:plugin certbot-dns-route53

I have created a special user in my AWS account who has access to Route53 and I have added the access key id and secret access key in the ~/.aws/config and also ~/.aws/credentials which looks something like this

[default]
aws_access_key_id=foo
aws_secret_access_key=bar

Basically followed every step given here: https://certbot-dns-route53.readthedocs.io/en/stable/

Now when I run the following command:

sudo certbot certonly -d mydomain.com --dns-route53

It gives the following output:

Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator dns-route53, Installer None
Requesting a certificate for mydomain.com
Performing the following challenges:
dns-01 challenge for mydomain.com
Cleaning up challenges
Unable to locate credentials
To use certbot-dns-route53, configure credentials as described at https://boto3.readthedocs.io/en/latest/guide/configuration.html#best-practices-for-configuring-credentials and add the necessary permissions for Route53 access.

I went to the documentation given in the error message: https://boto3.amazonaws.com/v1/documentation/api/latest/guide/configuration.html#best-practices-for-configuring-credentials

but I do not think there is anything wrong I am doing

I even went to the root level by doing sudo su and exported the AWS keys as env vars there and even exported the AWS keys in the home as well but it still throws me the same error.

Upvotes: 1

Views: 2291

Answers (2)

89f3a1c
89f3a1c

Reputation: 1488

You can also pass creds as env var in the same command:

sudo AWS_ACCESS_KEY_ID=your_access_key AWS_SECRET_ACCESS_KEY=your_secret_key certbot ...

This should work fine, too.

Upvotes: 2

Kingsley
Kingsley

Reputation: 1051

so I also ran into this same issue, and it's likely because of you running certbot with sudo, when do you do that, whatever user you've used as ~/, is ignored, as instead, it's looking in /root/.

I fixed it by (centos) is my user where I have the .aws/ directory with config and credential files.

sudo -s
ln -s /home/centos/.aws/ ~/.aws

ls -lsa ~/.aws
... /root/.aws -> /home/centos/.aws/

Upvotes: 6

Related Questions