Using certbot to create certificate when certmagic fails

[godoppl]

Hi
I tried setting up my own interactsh server today, and ran into issues generating the TLS cert. This seems to be a common issue, so I jotted down the commands I used to create the cert manually with certbot so that they are recognized by certmagic.
Feel free to use this, or include it in the documentation if you wish.

# Presumes Ubuntu logged in as root user and that go/interactsh-server is already installed by root

apt update
apt install certbot

export DOMAIN=yourdomain.com

certbot certonly --manual -d $DOMAIN --agree-tos --no-bootstrap --manual-public-ip-logging-ok --preferred-challenges dns-01 -m abuse@$DOMAIN --server https://acme-v02.api.letsencrypt.org/directory
# and
certbot certonly --manual -d *.$DOMAIN --agree-tos --no-bootstrap --manual-public-ip-logging-ok --preferred-challenges dns-01 -m abuse@$DOMAIN --server https://acme-v02.api.letsencrypt.org/directory

# !!!!! IMPORTANT: Add both challenges to your TXT record with the name _acme-challenge and wait for the records to get pushed before continuing

# To check if records are live
dig _acme-challenge.$DOMAIN TXT

# When certs have been created successfully

mkdir -p /root/.local/share/certmagic/certificates/acme-v02.api.letsencrypt.org-directory/$DOMAIN
# and
mkdir -p /root/.local/share/certmagic/certificates/acme-v02.api.letsencrypt.org-directory/wildcard_.$DOMAIN

# Symlink the files created from certbot to these locations with filename $DOMAIN.[crt|key]
# !!!!! Disclaimer: Please make sure the paths of the certbot output match if you run the following 4 lines unaltered

ln -s /etc/letsencrypt/live/$DOMAIN/fullchain.pem /root/.local/share/certmagic/certificates/acme-v02.api.letsencrypt.org-directory/$DOMAIN/$DOMAIN.crt
ln -s /etc/letsencrypt/live/$DOMAIN/privkey.pem /root/.local/share/certmagic/certificates/acme-v02.api.letsencrypt.org-directory/$DOMAIN/$DOMAIN.key
ln -s /etc/letsencrypt/live/$DOMAIN-0001/fullchain.pem /root/.local/share/certmagic/certificates/acme-v02.api.letsencrypt.org-directory/wildcard_.$DOMAIN/wildcard_.$DOMAIN.crt
ln -s /etc/letsencrypt/live/$DOMAIN-0001/privkey.pem /root/.local/share/certmagic/certificates/acme-v02.api.letsencrypt.org-directory/wildcard_.$DOMAIN/wildcard_.$DOMAIN.key

# Finally we need to create a json file with the metadata for each cert (certmagic requires this)
# I am not sure if anything special is supposed to be in these files so I put an empty object in it

echo "{}" > /root/.local/share/certmagic/certificates/acme-v02.api.letsencrypt.org-directory/$DOMAIN/$DOMAIN.json
echo "{}" > /root/.local/share/certmagic/certificates/acme-v02.api.letsencrypt.org-directory/wildcard_.$DOMAIN/wildcard_.$DOMAIN.json

[carlmon]

Thanks, this helped me!

One question: Why not create one cert for the domain and wildcard at the same time using -d $DOMAIN -d *.$DOMAIN? Does interactsh require separate certs certs?

[godoppl]

interactsh is setup to use separate files, but you could potentially symlink both wildcard_.$DOMAIN and $DOMAIN to one cert and key combo.
Let me know if anyone tries it.

[cyb3r7hr347]

Hi, how do you add the TXT records to the internal dns server if the service is already started? Or is my understanding of who is responsible for resolving the TXT records failing here?

If my interactsh service is accessible under a subdomain (e.g. interact.yourdomain.com) and ns1 and ns2 records have been created for the interactsh service as described in the projectdiscovery documentation. Should the TXT record for interact.yourdomain.com also be configured at the DNS provider?

[godoppl]

When you run the certbot command, it spits out a challenge string. You need to log in to your domains controlpanel to add the TXT record to the _acme-challenge subdomain straight under your selected DOMAIN. It can take up to several hours before the DNS records is propagated out to the nameservers. It should not matter if you are going to use a subdomain as the certificate is for a wildcard subdomain.

[cyb3r7hr347]

What confuses me is that I cannot resolve interact.yourdomain.com, for example, if the interactsh service is not running.

But if I understand correctly, I don't want to issue a certificate for interact.yourdomain.com but a certificate for yourdomain.com and a wildcard certificate for *.yourdomain.com?

[godoppl]

Correct the certificate created by certbot will be for the domain and a separate for any and all subdomains. When the TXT records have been propagated and the certificates have been copied into the right locations, you should have secure HTTP in place. You will need to set up correct DNS configuration to point to the server IP, but I believe that is covered in the standard documentation for interactsh.
This post is only for a workaround to create and link certificates if interactsh is not able to do so automatically. Off the top of my head, I do not remember what the procedure for DNS configuration was.

[cyb3r7hr347]

Thank you for your help!