Download LEGO binary
https://github.com/go-acme/lego/releases/

LEGO_VERSION=$(curl -s https://api.github.com/repos/go-acme/lego/releases/latest | grep '"tag_name"' | cut -d'"' -f4)
curl -L "https://github.com/go-acme/lego/releases/download/${LEGO_VERSION}/lego_${LEGO_VERSION}_linux_amd64.tar.gz" | tar -xz

Request certificate

DOMAIN=example.com
export OS_CLOUD=os-project1
export DESIGNATE_ZONE_NAME="${DOMAIN}."
export OS_REGION_NAME=de-de1

./lego run \
  --email foo@${DOMAIN} \
  --accept-tos \
  --dns designate \
  --domains "*.${DOMAIN}" \
  --domains ${DOMAIN}

List certificates

ls -l .lego/certificates

Convert to p12 file

openssl pkcs12 -passout "pass:" -export -in _.${DOMAIN}.crt -inkey _.${DOMAIN}.key -out _.${DOMAIN}.p12

Debug

export GODEBUG=http2debug=2 
export LEGO_LOG_LEVEL=debug 

# letsencrypt staging server
--server https://acme-staging-v02.api.letsencrypt.org/directory

Links
https://github.com/go-acme/lego/

Prerequisites
Install OpenStack CLI client (OSC)
http://www.panticz.de/osc

OpenStack Application credentials
~/.config/openstack/clouds.yaml

Generate Lets Encrypt certificate

sudo apt install -y certbot

pyenv activate osc
pip install python-designateclient certbot-dns-openstack zope

# list available zones
openstack zone list

# Create letsencrypt directory
mkdir ~/letsencrypt

# Request wildcard certificate
DOMAIN=example.com
certbot -a dns-openstack certonly \
    --agree-tos \
    --register-unsafely-without-email \
    --work-dir ~/letsencrypt/work \
    --config-dir ~/letsencrypt/etc \
    --logs-dir ~/letsencrypt/log \
    --dns-openstack-propagation-seconds 60 \
    -d *.${DOMAIN}
#    -d *.example.com,example.com

# List certificates
ls -l ~/letsencrypt/etc/archive/*/*

DEBUG (second terminal)

watch -n1 openstack recordset list example.com

Links
https://docs.binero.com/guides/designate-as-authenticator-for-lets-encrypt.html
https://letsencrypt.org/docs/challenge-types/

Create VM

openstack server create foo-certbot \
    --image "Ubuntu 18.04" \
    --flavor m1.small \
    --key-name foo-key \
    --network foo-net \
    --security-group foo-sec

Add floating IP

FLOATING_IP=$(openstack floating ip create public -c floating_ip_address -f value)
echo ${FLOATING_IP}
openstack server add floating ip foo-certbot ${FLOATING_IP}

Install certbot

ssh ubuntu@${FLOATING_IP} sudo apt update && sudo apt install -y certbot

Create wildcard certificates

export DOMAINS="
dev.example.com
www.example.com
"

for DOMAIN in ${DOMAINS}; do
    sudo certbot certonly \
    --manual \
    --manual-public-ip-logging-ok \
    --register-unsafely-without-email \
    --agree-tos \
    --preferred-challenges dns-01 \
    --server https://acme-v02.api.letsencrypt.org/directory \
    -d \*.${DOMAIN}
done

Debug

watch dig TXT _acme-challenge.dev.example.com

for DOMAIN in ${DOMAINS}; do
    dig TXT _acme-challenge.${DOMAIN}
done | egrep '^_acme-challenge'

Get LEGO binary
https://github.com/go-acme/lego/releases/

wget  https://github.com/go-acme/lego/releases/download/v5.2.2/lego_v5.2.2_linux_amd64.tar.gz
tar xzf lego_v5.2.2_linux_amd64.tar.gz

Show certificates

ll ~/.lego/certificates/

OpenStack Designate

# test with designage
/tmp/lego --accept-tos --email="foo@bar.com" --domains="*.bar.com" --dns designate run
... designate: some credentials information are missing: OS_AUTH_URL,OS_USERNAME,OS_PASSWORD,OS_TENANT_NAME,OS_REGION_NAME

# stop service on port 80 / 443
service nginx stop
service apache2 stop

# Request certificate
/tmp/lego --accept-tos --email="foo@bar.com" --domains="bar.com" --http run

# Request wildcard certificate
/tmp/lego --accept-tos --email="foo@bar.com" --domains="bar.com" --domains="*.bar.com" --dns manual run

# restart service on port 80 / 443
service nginx start
service apache2 start

Request wildcart certificate

./lego \
    --server https://acme-v02.api.letsencrypt.org/directory \
    --accept-tos=true \
    --dns.resolvers="ns1.example.com:53" \
    --dns.resolvers="ns2.example.com:53" \
    --email="info@example.com" \
    --dns=nictool \
    --key-type=rsa2048 \
    --pem \
    --domains="*.${DOMAIN}" \
    run

Renew certificates
https://go-acme.github.io/lego/usage/cli/examples/