Generating a Let's Encrypt certificate is a small operation. Repeated across many requests, with poorly checked DNS records, it becomes a source of errors and wasted time. I start from that practical need to write a Bash script that prepares and checks the request before launching Certbot.
I keep a list of domains as input, retrieve DNS responses and check that they match the server concerned, including when there are multiple addresses or IPv6. If something does not match, the script must refuse generation and display useful information to correct the DNS records.
The tests also expose a case I had forgotten: a domain with no usable response was incorrectly accepted. I fix that behaviour live. Finally, I explain the limits of the Apache configuration used here, which suits my internal environment and must not be copied as it stands into shared hosting where clients control their certificates.
All my links, projects and social media: https://all.bo