通过 dns 为 route53 颁发证书时，Certbot 无法找到 AWS 凭证

Question

I need to get an certificate for my domain hosted on AWS Route 53 from LetsEncrypt. I do not have any port 80 or 443 exposed since the server is used for VPN and does not have a public access.

So the only way to do this is via DNS validation of route 53.

So far I have installed certbot and dns-route53 plugin

sudo snap install --beta --classic certbot
sudo snap set certbot trust-plugin-with-root=ok
sudo snap install --beta certbot-dns-route53
sudo snap connect certbot:plugin certbot-dns-route53

I have created a special user in my AWS account who has access to Route53 and I have added the access key id and secret access key in the ~/.aws/config and also ~/.aws/credentials which looks something like this

[default]
aws_access_key_id=foo
aws_secret_access_key=bar

Basically followed every step given here: https://certbot-dns-route53.readthedocs.io/en/stable/

Now when I run the following command:

sudo certbot certonly -d mydomain.com --dns-route53

It gives the following output:

Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator dns-route53, Installer None
Requesting a certificate for mydomain.com
Performing the following challenges:
dns-01 challenge for mydomain.com
Cleaning up challenges
Unable to locate credentials
To use certbot-dns-route53, configure credentials as described at https://boto3.readthedocs.io/en/latest/guide/configuration.html#best-practices-for-configuring-credentials and add the necessary permissions for Route53 access.

I went to the documentation given in the error message: https://boto3.amazonaws.com/v1/documentation/api/latest/guide/configuration.html#best-practices-for-configuring-credentials

but I do not think there is anything wrong I am doing

I even went to the root level by doing sudo su and exported the AWS keys as env vars there and even exported the AWS keys in the home as well but it still throws me the same error.

Answer 1

so I also ran into this same issue, and it's likely because of you running certbot with sudo , when do you do that, whatever user you've used as ~/ , is ignored, as instead, it's looking in /root/ .

I fixed it by (centos) is my user where I have the .aws/ directory with config and credential files.

sudo -s
ln -s /home/centos/.aws/ ~/.aws

ls -lsa ~/.aws
... /root/.aws -> /home/centos/.aws/