letsencrypt.sh hook for AWS Route53

hook.sh

#!/bin/bash

function deploy_challenge {
    local DOMAIN="${1}" TOKEN_FILENAME="${2}" TOKEN_VALUE="${3}"

    # This hook is called once for every domain that needs to be
    # validated, including any alternative names you may have listed.
    #
    # Parameters:
    # - DOMAIN
    #   The domain name (CN or subject alternative name) being
    #   validated.
    # - TOKEN_FILENAME
    #   The name of the file containing the token to be served for HTTP
    #   validation. Should be served by your web server as
    #   /.well-known/acme-challenge/${TOKEN_FILENAME}.
    # - TOKEN_VALUE
    #   The token value that needs to be served for validation. For DNS
    #   validation, this is what you want to put in the _acme-challenge
    #   TXT record. For HTTP validation it is the value that is expected
    #   be found in the $TOKEN_FILENAME file.

    DOMAIN_ROOT=${DOMAIN}.
    echo "Looking up ${DOMAIN_ROOT}"
    ZONE_NAME=`aws route53 list-hosted-zones-by-name --dns-name ${DOMAIN_ROOT} --query 'HostedZones[*].Name' --output text --max-items=1`
    while [ "$ZONE_NAME" != "$DOMAIN_ROOT" ] && [ -n "$DOMAIN_ROOT" ]
    do
        DOMAIN_ROOT=${DOMAIN_ROOT#*.}
        ZONE_NAME=`aws route53 list-hosted-zones-by-name --dns-name ${DOMAIN_ROOT} --query 'HostedZones[*].Name' --output text --max-items=1`
    done
    if [ -z "$DOMAIN_ROOT" ]
    then
        echo "No matching zone found for ${DOMAIN}"
        exit 1
    fi
    ZONE=`aws route53 list-hosted-zones-by-name --dns-name ${DOMAIN_ROOT} --query 'HostedZones[*].Id' --output text --max-items=1`
    ZONE=${ZONE##*/}

    echo "Creating record _acme-challenge.${DOMAIN} TXT ${TOKEN_VALUE} in ${DOMAIN_ROOT} (${ZONE})"
    CHANGE_BATCH="{\"Changes\":[{\"Action\":\"UPSERT\",\"ResourceRecordSet\":{\"Name\":\"_acme-challenge.${DOMAIN}\",\"Type\":\"TXT\",\"TTL\":60,\"ResourceRecords\":[{\"Value\":\"\\\"${TOKEN_VALUE}\\\"\"}]}}]}"
    RESPONSE=`aws route53 change-resource-record-sets --hosted-zone-id $ZONE --change-batch "$CHANGE_BATCH"`
    CHANGE_ID=`echo "$RESPONSE" | jq -r '.ChangeInfo.Id'`
    CHANGE_STATUS=`aws route53 get-change --id "$CHANGE_ID" --query "ChangeInfo.Status" --output text`
    echo -n "Waiting for change to sync.."
    while [ "$CHANGE_STATUS" != "INSYNC" ]
    do
        sleep 2
        echo -n "."
        CHANGE_STATUS=`aws route53 get-change --id "$CHANGE_ID" --query "ChangeInfo.Status" --output text`
    done
    echo "ok!"
}

function clean_challenge {
    local DOMAIN="${1}" TOKEN_FILENAME="${2}" TOKEN_VALUE="${3}"

    # This hook is called after attempting to validate each domain,
    # whether or not validation was successful. Here you can delete
    # files or DNS records that are no longer needed.
    #
    # The parameters are the same as for deploy_challenge.

    DOMAIN_ROOT=${DOMAIN}.
    echo "Looking up ${DOMAIN_ROOT}"
    ZONE_NAME=`aws route53 list-hosted-zones-by-name --dns-name ${DOMAIN_ROOT} --query 'HostedZones[*].Name' --output text --max-items=1`
    while [ "$ZONE_NAME" != "$DOMAIN_ROOT" ] && [ -n "$DOMAIN_ROOT" ]
    do
        DOMAIN_ROOT=${DOMAIN_ROOT#*.}
        ZONE_NAME=`aws route53 list-hosted-zones-by-name --dns-name ${DOMAIN_ROOT} --query 'HostedZones[*].Name' --output text --max-items=1`
    done
    if [ -z "$DOMAIN_ROOT" ]
    then
        echo "No matching zone found for ${DOMAIN}"
        exit 1
    fi
    ZONE=`aws route53 list-hosted-zones-by-name --dns-name ${DOMAIN_ROOT} --query 'HostedZones[*].Id' --output text --max-items=1`
    ZONE=${ZONE##*/}

    echo "Deleting record _acme-challenge.${DOMAIN} TXT ${TOKEN_VALUE} in ${DOMAIN_ROOT} (${ZONE})"
    CHANGE_BATCH="{\"Changes\":[{\"Action\":\"DELETE\",\"ResourceRecordSet\":{\"Name\":\"_acme-challenge.${DOMAIN}\",\"Type\":\"TXT\",\"TTL\":60,\"ResourceRecords\":[{\"Value\":\"\\\"${TOKEN_VALUE}\\\"\"}]}}]}"
    RESPONSE=`aws route53 change-resource-record-sets --hosted-zone-id $ZONE --change-batch "$CHANGE_BATCH"`
}

function deploy_cert {
    local DOMAIN="${1}" KEYFILE="${2}" CERTFILE="${3}" FULLCHAINFILE="${4}" CHAINFILE="${5}" TIMESTAMP="${6}"

    # This hook is called once for each certificate that has been
    # produced. Here you might, for instance, copy your new certificates
    # to service-specific locations and reload the service.
    #
    # Parameters:
    # - DOMAIN
    #   The primary domain name, i.e. the certificate common
    #   name (CN).
    # - KEYFILE
    #   The path of the file containing the private key.
    # - CERTFILE
    #   The path of the file containing the signed certificate.
    # - FULLCHAINFILE
    #   The path of the file containing the full certificate chain.
    # - CHAINFILE
    #   The path of the file containing the intermediate certificate(s).
    # - TIMESTAMP
    #   Timestamp when the specified certificate was created.

    echo "Manually Deploy Cert: $DOMAIN, $KEYFILE, $CERTFILE, $CHAINFILE"
}

function unchanged_cert {
    local DOMAIN="${1}" KEYFILE="${2}" CERTFILE="${3}" FULLCHAINFILE="${4}" CHAINFILE="${5}"

    # This hook is called once for each certificate that is still
    # valid and therefore wasn't reissued.
    #
    # Parameters:
    # - DOMAIN
    #   The primary domain name, i.e. the certificate common
    #   name (CN).
    # - KEYFILE
    #   The path of the file containing the private key.
    # - CERTFILE
    #   The path of the file containing the signed certificate.
    # - FULLCHAINFILE
    #   The path of the file containing the full certificate chain.
    # - CHAINFILE
    #   The path of the file containing the intermediate certificate(s).
}

HANDLER=$1; shift; $HANDLER $@

Features:

• Supports multiple zones
• Checks zone is synced before validating records to minimise delay