TL;RD

• 在Ubuntu使用 certbot-auto 安裝certbot，PPA或官方repo都太舊不支援token
• 使用 pipenv切進去certbot的目錄，用pip安裝plugin

Step by step

Check the command before you paste it

安裝Certbot-auto

From [1]

wget https://dl.eff.org/certbot-auto 
sudo mv certbot-auto /usr/local/bin/certbot-auto 
sudo chown root /usr/local/bin/certbot-auto 
sudo chmod 0755 /usr/local/bin/certbot-auto 
/usr/local/bin/certbot-auto --help

安裝 certbot-dns-cloudflare Plugin

From [2]

find / -name certbot
# [Output] /opt/eff.org/certbot 
cd /opt/eff.org/certbot/venv 
source bin/activate 
pip install certbot-dns-cloudflare deactivate

設定Cloudflare Token、取得憑證與定時更新

From [3]

sudo mkdir /root/.secrets/ 
sudo chmod 700 /root/.secrets/ 
sudo vim /root/.secrets/cloudflare.ini 
# 輸入: dns_cloudflare_api_token = CHANGEME 
# 在cloudflare上開token，權限 Zone:Zone:Read, Zone:DNS:Edit for all zones 
sudo chmod 600 /root/.secrets/cloudflare.ini 
sudo chmod certbot-auto certonly \\
--dns-cloudflare \\
--dns-cloudflare-credentials ~/.secrets/cloudflare.ini \\
-d example.com 
# -vvv開Debug mode 

From certbot crontab man page (?)

sudo su - 
crontab -e 
# 輸入: 0 0 15 * * /usr/local/bin/certbot-auto renew --post-hook systemctl restart [SERVICE]

事情經過 a.k.a.流水帳

DNS-01只需要txt紀錄，不用外網、不用tcp 80 port 這麼棒的東西一定要用阿
在Ubuntu 18.04直覺的使用sudo apt install certbot python3-certbot-dns-cloudflare安裝套件
找到文件 [3] 直接開工
既然token比較安全，文件又推薦就用tokenㄅ
產生憑證時出現

Missing properties in credentials configuration file /root/.secrets/cloudflare.ini: 
* Property dns_cloudflare_email not found (should be email address associated with Cloudflare account). 
* Property dns_cloudflare_api_key not found (should be API key for Cloudflare account, obtained from https://www.cloudflare.com/a/account/my-account). 

這是Global Key阿
把錯誤訊息在程式碼中搜尋，token有相關的code R

忘記在那看到可能是版本問題

apt-cache policy certbot | grep -i Installed 

Ubuntu Repo: 0.27, GitHub上: 1.2

好ㄅ那就用官方Ubuntu PPA
PPA python-certbot 版本: 0.31
PPA python-certbot-dns-cloudflare 版本: 0.23
WTH

另外發現Token是今年2020/01更新的，1.2開始出現
所以只好用certbot-auto裝了

沒 只是想抱怨而已

Reference

[1] https://certbot.eff.org/docs/install.html#certbot-auto
[2] https://devops.stackexchange.com/questions/3757/how-to-install-certbot-plugins
[3] https://certbot-dns-cloudflare.readthedocs.io/en/stable/