Background

This article describes the procedure for obtaining a wildcard certificate from Let's Encrypt using the Certify The Web application. Before proceeding, review the article Obtaining a Server Certificate from Let's Encrypt Using Certify The Web. The prerequisites described in that article are the same in this scenario.

This scenario is for those cases when an MSP would like multiple fully qualified domain names to resolve to the same CentreStack host (or cluster). For example, suppose an MSP wanted to have three different URLs, one for each tenant:

• https://tenant1.acmedrive.com
• https://tenant2.acmedrive.com
• https://tenant3.acmedrive.com

This could be accomplished using the wildcard certificate *.acmedrive.com. 

This article describes the configuration of AWS Route 53 for the purposes of Let's Encrypt "dns-01 challenge" automation. Certify The Web supports other DNS providers and is not limited to AWS Route 53 only.

Procedure

Update IIS Bindings with Server Name Indication

Unlike the simple single server name setup documented in  Obtaining a Server Certificate from Let's Encrypt Using Certify The Web, this scenario is complicated by having the same CentreStack IIS web server respond to multiple FQDNs. This is accomplished by leveraging the Server Name Indication (SNI) feature available in Windows Server 2012 and later. The host names and SNI settings must be enabled prior to configuring Certify The Web in order for Certify to be able to automatically update the bindings when a new certificate is installed.

1. In IIS Manager navigate to the Default Web Site and click Bindings in the Actions pane:
   
2. For each host name that this IIS server will respond to, in the Site Bindings dialog click the Add button.
3. In the Add Site Binding dialog:
   1. In the Type drop-down, select https
   2. In the IP address leave it as All Unassigned
   3. In the Port leave it as 443
   4. Add a Host name applicable to your DNS deployment
   5. Enable Require Server Name Indication
   6. Leave SSL certificate as localhost (the self-signed certificate that is installed by IIS):
      
      Click the OK button
4. Repeat the Add binding process for each host name.
5. The test system used for this test looks like this:
   
6. There is one binding entry without a host name that is created by the IIS installation that can be left "as-is":
   
   This can be thought of as the "default" binding and is used when the client browser does not set the SNI. 

Configure AWS Route 53

This procedure will create an AWS IAM account with limited access to update DNS records in a single DNS zone (domain) only. 

1. In the AWS Route 53 console, click on Hosted Zones on the left pane, then click on the radio button of the domain that will host the DNS record for the Let's Encrypt "dns-01 challenge". The Hosted Zone Details pane will be displayed.
2. Select the text in the Hosted Zone ID field and copy it to the clipboard
3. Save the attached Route53Policy.json file and open it in a text editor like Visual Studio Code.
4. Replace the text <your_zone_id> with the Hosted Zone ID in the clipboard.
5. Select all of the text in the editor and copy it to the clipboard.
6. In the AWS IAM portal create a custom IAM policy.
7. Click on the JSON tab and paste the text from the editor into the browser. 
8. Make sure the policy in the browser matches the text in your text editor. It will look similar to this:
   
9. Click the Review Policy button.
10. Give the policy a Name and Description:
    
11. Click the Create Policy button.
12. Click the Users option in the left pane of the AWS IAM console then click the Add user button.
13. Give the user a descriptive name and ensure that only Programmatic access is allowed, then click the Next: Permissions button:
    
14. Click the Attach existing policies directly button and select the IAM policy that was created earlier in this process, then click the Next: Review button:
    
15. Click the Create user button:
    
16. Click the Download .csv button:
    
17. The downloaded .csv file will contain the Access Key ID and Secret access key that may be used to sign in programmatically as this IAM user. Best practice would be to store these credentials in a password vault such as LastPass and delete the .csv. 

Install and Configure Certify The Web

1. For each FQDN, create a DNS CNAME record that resolves to the actual FQDN host record (DNS A record) of the CentreStack server. Test that each CNAME FQDN resolves to the CentreStack server.
2. Install Certify the Web (see Obtaining a Server Certificate from Let's Encrypt Using Certify The Web for step-by-step instructions).
3.  In the Certify The Web (Certify) application, click the New Certificate:
   
4. In the Certificate Domains property sheet:
   1. Click the Show Advanced Options check box.
   2. Change the Select Website drop down to Default Web Site
   3. Type the name of your wildcard domain in the Add domains to certificate text box
   4. Click the ADD DOMAINS button:
      
   5. Click OK:
      
   6. Click Yes:
      
5. Click the Authorization button to proceed to the next property sheet:
   
6. In the Domain Authorization sheet:
   1. In the Domain Match text box enter your wildcard domain name.
   2. Change the Challenge Type drop-down to dns-01
   3. Change the DNS Update Method to Amazon Router 53 DNS API (for this example - your DNS provider may be different).
   4. Click the NEW button to the right of the Credentials drop-down:
      
7. In the ADD/UPDATE STORED CREDENTIAL dialog:
   
   1. Change the API Provider Type drop-down to Amazon Route 53 DNS API
   2. In the Credential Name text box enter the IAM user name (although it is arbitrary and doesn't need to match the actual name)
   3. In the Access Key text box enter the Access Key ID for the IAM user created earlier in this procedure.
   4. In the Secret Access Key text box enter the Secret Access Key of the IAM user that was created earlier:
      
      Click the SAVE button.
8. Back in the Domain Authorization sheet, click the ellipses button then click the Select Zone drop-down. Select the zone that matches the zone where the Let's Encrypt record will be created and updated:
   
9. Verify that the Zone Id in the DNS Zone Id text box matches the Zone Id in the IAM policy that was created earlier in this process:
   
10. Click the Deployment button to proceed to the next sheet
11. In the Certificate Deployment sheet:
    1. Set the Deployment Mode drop-down to Single Site (selected in Domains tab). This translates to "update the Default Web Site".
    2. Leave the Binding Add/Update drop-down as Add or Update https binding as required.
    3. In the Matching any of options enable both:
       Existing binding hostname matches certificate domains
       Binding hostname not specified (IP only or All Unassigned)
    4. Leave the Auto create/update IIS binding (uses SNI) enabled:
       
12. Click the Preview button and review the actions that will be taken:
    
13. Click the Save button
14. Click the Test button:
    
15. The Test may take some time as DNS records take some time to propagate.
16. The Test should be successful, if it is click the right arrow to collapse the Test pane:
    
17. If the test was successful click the Request Certificate button.
18. Click the Settings tab:
    
19. Click the Configure Auto Renew button
20. Configure Auto Renewal to run as a background service:
    

Verify Configuration

1. Back in the IIS Manager bindings, verify that each binding for TCP 443 shows the new certificate. For example:
   1. "Default" (when no SNI is set by the browser):
      
   2. When the SNI "myfiles.acmedrive.com" is set (for this example):
      
   3. When the SNI is set to "unifiles.acmedrive.com":
      
2. In a client browser navigate to all three server names (the A record and the two CNAME records). Each should show a valid certificate issued by Let's Encrypt.