Strato ACME webhook

This inofficial repository contains a cert-manager webhook implementation for the DNS provider STRATO. It enables cert-manager to solve DNS01 ACME challenges by managing DNS records for domains hosted by STRATO. Since STRATO does not provide a formal API, this webhook implements integration through interaction with STRATO's web interface.

The webhook is designed to be deployed as a Kubernetes API service, ensuring secure and restricted access through Kubernetes RBAC. It adheres to cert-manager's webhook interface, making it easy to integrate with existing cert-manager installations.

This implementation includes conformance tests to validate its functionality and ensure compatibility with cert-manager's DNS01 challenge requirements.

Quickstart Guide

Follow these steps to quickly set up and use the STRATO cert-manager webhook:

Prerequisites

1. A Kubernetes cluster with cert-manager installed.
2. A Strato account and a domain.
3. It is recommended to keep a backup of your DNS configuration as a precaution.
4. Note: Two-factor authentication is not supported for this integration. If this is a feature you would like to see, please open a issue
5. Note: STRATO may require CAPTCHAs for certain clients. Due to the nature of this integration approach, authentication failures may occasionally occur during certificate operations.
6. kubectl or helm installed and configured to access your cluster.

Installation

Using Helm

1. Add the Helm repository:

   helm plugin install https://github.com/aslafy-z/helm-git --version 1.3.0
   helm repo add strato-webhook git+https://github.com/fl0eb/cert-manager-webhook-strato@deploy/strato-webhook
   helm repo update

2. Create a values.yaml file to customize the installation:

   certManager:
     namespace: <cert-manager namespace>
     serviceAccountName: <cert-manager serviceAccountName>

   If cert-manager is installed with default values seen below you do not need to provide a values.yaml

   certManager:
     namespace: cert-manager
     serviceAccountName: cert-manager

3. Install the webhook using Helm:

   helm install strato-webhook strato-webhook/cert-manager-webhook-strato --namespace cert-manager -f values.yaml

4. Verify the webhook is running:

   kubectl get pods -n cert-manager

Using kubectl

1. Deploy the webhook to your Kubernetes cluster:

   kubectl apply -f https://github.com/fl0eb/cert-manager-webhook-strato/releases/download/v0.0.1/rendered-manifest.yaml

2. Verify the webhook is running:

   kubectl get pods -n cert-manager

Configuration

1. Create a Kubernetes Secret with your STRATO API credentials:

   apiVersion: v1
   kind: Secret
   metadata:
     name: strato-dns-credentials
     namespace: cert-manager
   type: Opaque
   data:
     identity: <base64-encoded-identity>
     password: <base64-encoded-password>

   Apply the secret:

   kubectl apply -f strato-dns-credentials.yaml

   Alternatively, you can create the secret directly from literals using kubectl:

   kubectl create secret generic strato-dns-credentials \
     --namespace cert-manager \
     --from-literal=identity=<your-identity> \
     --from-literal=password=<your-password>

2. Configure an Issuer or ClusterIssuer to use the webhook:

   apiVersion: cert-manager.io/v1
   kind: ClusterIssuer
   metadata:
     name: strato-issuer
   spec:
     acme:
       server: https://acme-v02.api.letsencrypt.org/directory
       email: your-email@example.com
       privateKeySecretRef:
         name: strato-issuer-account-key
       solvers:
       - dns01:
           webhook:
             groupName: fl0eb.github.com
             solverName: strato
             config:
               secretName: strato-dns-credentials
               # You should be able to change this to other regions if required (.nl .fr .es ...)
               api: "https://www.strato.de/apps/CustomerService" 
               # For the following values you can check:
               # Strato Service Portal > Ihre Pakete > Paketübersicht
               domain: "example.com"   # The root domain (Kennung) this issuer will modify
               order: "1234567"      # The package order id (Auftragsnummer) the domain belongs to

   Apply the issuer:

   kubectl apply -f strato-issuer.yaml

Requesting a Certificate

1. Create a Certificate resource:

   apiVersion: cert-manager.io/v1
   kind: Certificate
   metadata:
     name: example-com-tls
     namespace: default
   spec:
     secretName: example-com-tls
     issuerRef:
       name: strato-issuer
       kind: ClusterIssuer
     commonName: example.com
     dnsNames:
     - "*.example.com"

   Apply the certificate:

   kubectl apply -f certificate.yaml

2. Verify the certificate is issued:

   kubectl describe certificate example-com-tls

Special Thanks

This project was inspired by the following repositories:

• strato-certbot
• cert-manager-webhook-infomaniak