FreeDNS (afraid.org) Cerbot/Let's Encrypt Manual Automation Script

automatedManualCertbotRenewal.sh

#!/bin/bash
# Copyright 2018, Anthony Wharton
# Single script that can be called that generates certificates using the 
# certbotFreeDNSAuthHook.sh and certbotFreeDNSCleanupHook.sh scripts.

# This should be used as guidence of my usage, and changed to your needs. Note 
# the generic `/path/to/...` and `DOMAIN.COM`, which should be replaced with 
# your script location and domain respectively. In addition, for this to be
# used on a live system, one must remove the `--dry-run` flag.

certbot certonly                                                    \
	--dry-run                                                   \
	--agree-tos                                                 \
	--manual-public-ip-logging-ok                               \
	--renew-by-default                                          \
	--manual                                                    \
	--preferred-challenges=dns                                  \
	--manual-auth-hook /path/to/certbotFreeDNSAuthHook.sh       \
	--manual-cleanup-hook /path/to/certbotFreeDNSCleanupHook.sh \
	-d "DOMAIN.COM"                                           \
	-d "*.DOMAIN.COM"                                           \
	--server https://acme-v02.api.letsencrypt.org/directory

certbotFreeDNSAuthHook.sh

#!/bin/bash
# Copyright 2018, Anthony Wharton
# Script that logs into FreeDNS.afraid.org and puts in the _acme-challenge TXT
# record as required by certbot for let's encrypt certificates.
# This was made for my need to automate wildcard renewals which cannot work
# automatically.

# TODO: Update to your FreeDNS.afraid.org username and password.
USERNAME='user%40domain.com'  # Username for FreeDNS
PASSWORD='verysecurepassword' # Password for FreeDNS

WORKINGDIR="/tmp/CERTBOT_$CERTBOT_DOMAIN"
COOKIEFILE="$WORKINGDIR/cookies.tmp"
TXTID_FILE="$WORKINGDIR/TXT_ID"

REGEX_DOMAINID="s/.*$CERTBOT_DOMAIN.*domain_id=\\([0-9]*\\).*/\\1/;t;d"
REGEX_TXTID="s/.*data_id=\\([0-9]*\\)>_acme-challenge.*/\\1/;t;d"

echo "==============================================="
if [ ! -d $WORKINGDIR ]; then
	echo "Creating working director for temporary files ($WORKINGDIR)"
	mkdir -m 0700 $WORKINGDIR
fi

echo "Logging in..."
curl -s "https://freedns.afraid.org/zc.php?step=2 " \
     -c $COOKIEFILE                                 \
     -d "action=auth"                               \
     -d "submit=Login"                              \
     -d "username=$USERNAME"                        \
     -d "password=$PASSWORD"

echo "Getting domain ID..."
DOM_ID=$(curl -s "https://freedns.afraid.org/subdomain/" \
              -b $COOKIEFILE                             \
	      | sed --posix $REGEX_DOMAINID)
echo "Domain ID: $DOM_ID"

echo "Getting current TXT record ID (if existent)..."
TXT_ID=$(curl -s "https://freedns.afraid.org/subdomain/" \
              -b $COOKIEFILE                             \
	      | sed --posix $REGEX_TXTID)

echo "Creating/Updaing TXT record..."
curl -s "https://freedns.afraid.org/subdomain/save.php?step=2" \
     -b $COOKIEFILE                                            \
     -d "type=TXT"                                             \
     -d "subdomain=_acme-challenge"                            \
     -d "domain_id=$DOM_ID"                                    \
     -d "address=%22$CERTBOT_VALIDATION%22"                    \
     -d "data_id=$TXT_ID"                                      \
     -d "send=Save%21"

TXT_ID=$(curl -s "https://freedns.afraid.org/subdomain/" \
              -b $COOKIEFILE                             \
	      | sed --posix $REGEX_TXTID)
echo "TXT record ID: $TXT_ID"
echo Saving ID for cleanup...
echo $TXT_ID > $TXTID_FILE

echo "Auth Step DONE, Sleeping to allow for DNS records to propagate"
sleep 15
echo "==============================================="

certbotFreeDNSCleanupHook.sh

#!/bin/bash
# Copyright 2018, Anthony Wharton
# Script that logs into FreeDNS.afraid.org and cleans up the _acme-challenge
# TXT record as created by the certbotFreeDNSAuthHook.sh script.
# This was made for my need to automate wildcard renewals which cannot work
# automatically.

# TODO: Update to your FreeDNS.afraid.org username and password.
USERNAME='user%40domain.com'  # Username for FreeDNS
PASSWORD='verysecurepassword' # Password for FreeDNS

WORKINGDIR="/tmp/CERTBOT_$CERTBOT_DOMAIN"
COOKIEFILE="$WORKINGDIR/cookies.tmp"
TXTID_FILE="$WORKINGDIR/TXT_ID"

echo "==============================================="
echo "Cleaning up..."
if [ ! -f $COOKIESFILE ]; then
	echo "No saved cookies found... Logging in..."
	curl -s "https://freedns.afraid.org/zc.php?step=2 " \
	     -c $COOKIEFILE                                 \
	     -d "action=auth"                               \
	     -d "submit=Login"                              \
	     -d "username=$USERNAME"                        \
	     -d "password=$PASSWORD"
fi

if [ -f $TXTID_FILE ]; then
	TXT_ID=$(cat $TXTID_FILE)
	echo "Deleting TXT record ID ($TXT_ID)..."
	QUERY="https://freedns.afraid.org/subdomain/delete2.php?"
	QUERY+="data_id%5B%5D=$TXT_ID&"
	QUERY+="submit=delete+selected"
	curl -s $QUERY -b $COOKIEFILE
fi

rm -vrf $WORKINGDIR
echo "DONE"
echo "==============================================="

So I finally sort it our. Solution was to use Dynu free dns, where I was able to use acme.sh and generate certificate for subdomains. freedns.afraid.org is not supporting subdomains.