API data for Let's Encrypt dns-01 challenge using Azure

[yobyot]

Hello,

I can't seem to find any doc or description of the format for supplying "API data" to an ACME dns-01 challenge using the Azure plugin. I'm asking about the expected format of the parameters that need to be passed to the plugin via this dialog:



I tried using the CLI but it returns an empty object for the Azure plugin, as seen below. IOW, I have no idea how to format a JSON object to put into the API data field.



Note that I am not asking for what Azure info what needs to be in the object (service principal, etc). I am asking where to find how to format that object for use in the web UI.

I'm a newbie, so excuse the dumb questions.

 

[talos]

Normaly acme likes environment variables like:

AZUREDNS_SUBSCRIPTIONID="..."
AZUREDNS_TENANTID="..."
AZUREDNS_APPID="..."
AZUREDNS_CLIENTSECRET="..."

But i never used the acme Azure Plugin in Proxmox so give it a try, maybe line by line or delimited with ; or ,

 

[yobyot]

Thanks for the clue.

Normaly acme likes environment variables like:

AZUREDNS_SUBSCRIPTIONID="..."
AZUREDNS_TENANTID="..."
AZUREDNS_APPID="..."
AZUREDNS_CLIENTSECRET="..."

But i never used the acme Azure Plugin in Proxmox so give it a try, maybe line by line or delimited with ; or ,

Thanks.

Finally (after a couple of days of hacking at this, I finally got it to work. Some notes for future victims:

• Be sure not to use quotes when specifying Azure DNS properties for acme.sh.
• You must make sure to give the Azure AD app proper permissions to add a TXT record. DNS TXT Contributor RBAC permission on the DNS Zone resource (or, if you insist at the subscription or resource group level) should do it.
• Give up on using the web UI. Instead, try this sequence:
  pvenode acme account register default person@example.com pvenode acme plugin remove azurePlugin pvenode acme plugin add dns azurePlugin --api azure --data /home/user/azureDnsCredentials pvenode acme plugin config azurePlugin pvenode config set -acmedomain0 domain=pve.example.com,alias=alias.example.com,plugin=azurePlugin pvenode acme cert order
• I needed to use the alias capability of dns-01 because the base domain is registered at Google Domains (big mistake on my part!). Google Domains doesn't offer API access, so creating zone in Azure DNS and CNAMEing to it is my solution for Let's Encrypt dns-01 challenges. That complicates this a bit but doesn't matter to pvenode.

Finally, I couldn't find any of the logs from pvenode or the ACME output. That left me stumped for a while. But looking at acme.sh itself should help you if you get stuck.

 

[liviu]

Hi @yobyot, @talos

Thanks, I had the same problem. But on proxmox mail gateway

I used the GUI after all and it worked - it looks like this - and yes - with no quotes:



Also for the azure setup, I used this doc - https://github.com/acmesh-official/acme.sh/wiki/How-to-use-Azure-DNS

Thanks
Liviu

 

[encryptedserver]

Google Domains doesn't offer API access

Google does offer API access, I am getting my letsencrypt cert for my proxmox directly from Google Domains API.

https://forum.proxmox.com/threads/please-add-support-for-google-domains-dns-api.124434/