How to generate TSIG key for certbot plugin 'certbot-dns-rfc2136'

Question

I'm configuring BIND9 to obtain a wildcard certificate from Let's Encrypt. When I try to generate TSIG key according to instruction here, I got the following error:

# dnssec-keygen -a HMAC-SHA512 -b 512 -n HOST keyname.
dnssec-keygen: fatal: unknown algorithm HMAC-SHA512

Then I read help and document about dnssec-keygen, there is no algorithm called HMAC-SHA512 indeed:

# dnssec-keygen -h
Usage:
    dnssec-keygen [options] name

Version: 9.14.2
    name: owner of the key
Options:
    -K <directory>: write keys into directory
    -a <algorithm>:
        RSASHA1 | NSEC3RSASHA1 |
        RSASHA256 | RSASHA512 |
        ECDSAP256SHA256 | ECDSAP384SHA384 |
        ED25519 | ED448 | DH
    -3: use NSEC3-capable algorithm
    -b <key size in bits>:
        RSASHA1:        [1024..4096]
        NSEC3RSASHA1:   [1024..4096]
        RSASHA256:      [1024..4096]
        RSASHA512:      [1024..4096]
        DH:             [128..4096]
        ECDSAP256SHA256:        ignored
        ECDSAP384SHA384:        ignored
        ED25519:        ignored
        ED448:  ignored
        (key size defaults are set according to
        algorithm and usage (ZSK or KSK)
    -n <nametype>: ZONE | HOST | ENTITY | USER | OTHER
        (DNSKEY generation defaults to ZONE)
    -c <class>: (default: IN)
    -d <digest bits> (0 => max, default)
    -E <engine>:
        name of an OpenSSL engine to use
    -f <keyflag>: KSK | REVOKE
    -g <generator>: use specified generator (DH only)
    -L <ttl>: default key TTL
    -p <protocol>: (default: 3 [dnssec])
    -s <strength>: strength value this key signs DNS records with (default: 0)
    -T <rrtype>: DNSKEY | KEY (default: DNSKEY; use KEY for SIG(0))
    -t <type>: AUTHCONF | NOAUTHCONF | NOAUTH | NOCONF (default: AUTHCONF)
    -h: print usage and exit
    -m <memory debugging mode>:
       usage | trace | record | size | mctx
    -v <level>: set verbosity level (0 - 10)
    -V: print version information
Timing options:
    -P date/[+-]offset/none: set key publication date (default: now)
    -P sync date/[+-]offset/none: set CDS and CDNSKEY publication date
    -A date/[+-]offset/none: set key activation date (default: now)
    -R date/[+-]offset/none: set key revocation date
    -I date/[+-]offset/none: set key inactivation date
    -D date/[+-]offset/none: set key deletion date
    -D sync date/[+-]offset/none: set CDS and CDNSKEY deletion date
    -G: generate key only; do not set -P or -A
    -C: generate a backward-compatible key, omitting all dates
    -S <key>: generate a successor to an existing key
    -i <interval>: prepublication interval for successor key (default: 30 days)
Output:
     K<name>+<alg>+<id>.key, K<name>+<alg>+<id>.private

I dug into another question: can't generate key via dnssec-keygen, but my problem remains unsolved.

What should I do?

Mobile here, can't verify much this for a few hours. What relation has got let's encript with DNSSEC? Up voted both the question and answer. — Rui F Ribeiro, Jun 07 '19 at 15:56
@RuiFRibeiro Let's Encrypt implemented a feature allow user to obtain wildcard certificate, to do that you need a Certbot plugin called 'certbot-dns-rfc2136'. Hence DNSSEC is involved. The document of plugin [here](https://certbot-dns-rfc2136.readthedocs.io/en/stable/) demonstrates a sample BIND9 configuration, to *limits the scope of the TSIG key to just be able to add and remove TXT records for one specific host for the purpose of completing the dns-01 challenge*. — KaiserKatze, Jun 07 '19 at 16:23
However it doesn't work for the newest version of BIND9 which I built in Docker. I guess the writer of this document only has BIND 9.10.3-P4-Debian (installed with `apt-get`) around. :) — KaiserKatze, Jun 07 '19 at 16:24

score 9 · Accepted Answer · answered Jun 07 '19 at 15:04

After a bit searching, I found the document of plugin certbot-dns-rfc2136 is obsolete!

In BIND9's official git repository, I found the following commit message:

[func] The use of dnssec-keygen to generate HMAC keys is deprecated in favor of tsig-keygen. dnssec-keygen will print a warning when used for this purpose. All HMAC algorithms will be removed from dnssec-keygen in a future release. [RT #42272]

So, the final solution is:

tsig-keygen -a hmac-sha512 tsig-key > /etc/bind/tsig.key

How to generate TSIG key for certbot plugin 'certbot-dns-rfc2136'

1 Answers1

Linked