DNS and Certificate Automation: Managing Domain and TLS at Scale

# Terraform - Route53 hosted zone and records
resource "aws_route53_zone" "main" {
  name = "example.com"

  tags = {
    Environment = "production"
    ManagedBy   = "terraform"
  }
}

resource "aws_route53_record" "api" {
  zone_id = aws_route53_zone.main.zone_id
  name    = "api.example.com"
  type    = "A"

  alias {
    name                   = "alb-example-123456789.us-east-1.elb.amazonaws.com"
    zone_id                = "Z35SXDOWRQ4VI"
    evaluate_target_health = true
  }
}

resource "aws_route53_record" "www" {
  zone_id = aws_route53_zone.main.zone_id
  name    = "www.example.com"
  type    = "CNAME"
  ttl     = 300
  records = ["example.com"]
}

resource "aws_route53_record" "mx" {
  zone_id = aws_route53_zone.main.zone_id
  name    = "example.com"
  type    = "MX"
  ttl     = 3600
  records = [
    "10 mail1.example.com",
    "20 mail2.example.com"
  ]
}

resource "aws_route53_record" "spf" {
  zone_id = aws_route53_zone.main.zone_id
  name    = "example.com"
  type    = "TXT"
  ttl     = 3600
  records = ["v=spf1 include:_spf.example.com ~all"]
}

# Cloudflare Terraform provider
provider "cloudflare" {
  api_token = var.cloudflare_api_token
}

resource "cloudflare_record" "api" {
  zone_id = cloudflare_zone.example.id
  name    = "api"
  value   = "1.2.3.4"
  type    = "A"
  proxied = true
}

resource "cloudflare_record" "cdn" {
  zone_id = cloudflare_zone.example.id
  name    = "cdn"
  value   = "cdn.example.com"
  type    = "CNAME"
  proxied = true
}

# Install cert-manager v1.20.2 (latest stable)
kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.20.2/cert-manager.yaml

# Verify installation
kubectl get pods -n cert-manager

spec:
  privateKey:
    rotationPolicy: Never

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: [email protected]

    solvers:
      - dns01:
          route53:
            region: us-east-1
            hostedZoneID: Z1234567890ABC

apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: example-com
  namespace: production
spec:
  secretName: example-com-tls
  issuerRef:
    name: letsencrypt-prod
    kind: ClusterIssuer

  dnsNames:
    - example.com
    - www.example.com
    - api.example.com

  # ACME certificate profile
  privateKey:
    rotationPolicy: Always

  # Use short-lived profile for rapid rotation
  # omit for default tlsserver profile
  #  extraConfig:
  #    acme:
  #      profile: shortlived

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: production-ingress
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
spec:
  ingressClassName: nginx
  tls:
    - hosts:
        - example.com
        - www.example.com
      secretName: example-com-tls
  rules:
    - host: example.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: web-service
                port:
                  number: 80

# Manual DNS-01 challenge with Cloudflare
import cloudflare

def create_dns_challenge(domain, token):
    """Create DNS TXT record for Let's Encrypt challenge"""
    client = cloudflare.Cloudflare(api_token=token)

    zone_id = client.zones.get(params={'name': domain})[0]['id']

    client.zones.dns_records.post(
        zone_id,
        data={
            'type': 'TXT',
            'name': f'_acme-challenge.{domain}',
            'content': token,
            'ttl': 60
        }
    )

    import time
    time.sleep(30)

    return True

def cleanup_dns_challenge(domain, token, record_id):
    """Clean up DNS TXT record"""
    client = cloudflare.Cloudflare(api_token=token)
    zone_id = client.zones.get(params={'name': domain})[0]['id']
    client.zones.dns_records.delete(zone_id, record_id)

# Primary zone CNAME delegation
_acme-challenge.example.com IN CNAME _acme-challenge.less-privileged.example.org.

# cert-manager ClusterIssuer with CNAME delegation
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-delegated
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: [email protected]
    solvers:
      - selector:
          dnsZones:
            - "example.com"
        dns01:
          cnameStrategy: Follow
          route53:
            region: us-east-1
            hostedZoneID: ZDELEGATEDZONEID

# Helm values for cert-manager
extraArgs:
  - --dns01-recursive-nameservers-only
  - --dns01-recursive-nameservers=8.8.8.8:53,1.1.1.1:53

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: multi-dns-issuer
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: [email protected]
    solvers:
      - dns01:
          route53:
            region: us-east-1
            hostedZoneID: Z1234567890ABC
        selector:
          dnsZones:
            - "example.com"

      - dns01:
          cloudflare:
            apiTokenSecretRef:
              name: cloudflare-api-token
              key: api-token
        selector:
          dnsZones:
            - "*.example.com"

_validation-persist.example.com. IN TXT (
  "letsencrypt.org;"
  "accounturi=https://acme-v02.api.letsencrypt.org/acme/acct/1234567890"
)

_validation-persist.example.com. IN TXT (
  "letsencrypt.org;"
  "accounturi=https://acme-v02.api.letsencrypt.org/acme/acct/1234567890;"
  "policy=wildcard"
)

_validation-persist.example.com. IN TXT (
  "letsencrypt.org;"
  "accounturi=https://acme-v02.api.letsencrypt.org/acme/acct/1234567890;"
  "persistUntil=1767225600"
)

# Terraform - IRSA for cert-manager
module "cert_manager_irsa" {
  source  = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks"
  version = "~> 5.0"

  role_name = "cert-manager"

  oidc_providers = {
    main = {
      provider_arn             = var.oidc_provider_arn
      namespace_service_accounts = ["cert-manager:cert-manager"]
    }
  }
}

resource "aws_iam_policy" "cert_manager" {
  name = "cert-manager-route53"

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect = "Allow"
        Action = [
          "route53:GetChange",
          "route53:ListHostedZonesByName",
          "route53:ChangeResourceRecordSets"
        ]
        Resource = ["*"]
      }
    ]
  })
}

resource "aws_iam_role_policy_attachment" "cert_manager" {
  role       = module.cert_manager_irsa.iam_role_name
  policy_arn = aws_iam_policy.cert_manager.arn
}

apiVersion: v1
kind: ServiceAccount
metadata:
  name: cert-manager
  namespace: cert-manager
  annotations:
    eks.amazonaws.com/role-arn: arn:aws:iam::123456789012:role/cert-manager

# Terraform - ACM certificate
resource "aws_acm_certificate" "main" {
  domain_name       = "example.com"
  subject_alternative_names = ["*.example.com"]

  validation_method = "DNS"

  lifecycle {
    create_before_destroy = true
  }
}

resource "aws_route53_record" "cert_validation" {
  for_each = {
    for val in aws_acm_certificate.main.domain_validation_options :
      val.domain_name => val
  }

  zone_id = aws_route53_zone.main.zone_id
  name    = each.value.resource_record_name
  type    = each.value.resource_record_type
  ttl     = 60
  records = [each.value.resource_record_value]
}

# Terraform - ALB with HTTPS
resource "aws_lb" "main" {
  name               = "main-alb"
  internal           = false
  load_balancer_type = "application"
  security_groups    = [aws_security_group.alb.id]
  subnets            = aws_subnet.public[*].id
}

resource "aws_lb_listener" "https" {
  load_balancer_arn = aws_lb.main.arn
  port              = "443"
  protocol          = "HTTPS"
  ssl_policy        = "ELBSecurityPolicy-2016-08"
  certificate_arn   = aws_acm_certificate.main.arn

  default_action {
    type             = "forward"
    target_group_arn = aws_lb_target_group.main.arn
  }
}

#!/usr/bin/env python3
"""Certificate renewal monitoring and automation."""

import boto3
import datetime
import logging
from dataclasses import dataclass

logging.basicConfig(level=logging.INFO)
logger = logging.getLogger(__name__)


@dataclass
class Certificate:
    arn: str
    domain: str
    expires: datetime.datetime


def get_expiring_certificates(days=30):
    """Find certificates expiring within specified days"""
    client = boto3.client('acm')

    certs = client.list_certificates()['CertificateSummaryList']
    expiring = []

    for cert in certs:
        detail = client.describe_certificate(CertificateArn=cert['CertificateArn'])

        if detail['Certificate']['Status'] != 'ISSUED':
            continue

        not_after = detail['Certificate']['NotAfter']
        days_until_expiry = (not_after - datetime.datetime.now(not_after.tzinfo)).days

        if days_until_expiry <= days:
            expiring.append(Certificate(
                arn=cert['CertificateArn'],
                domain=cert['DomainName'],
                expires=not_after
            ))

    return expiring


def send_alert(certs):
    """Send alert about expiring certificates"""
    if not certs:
        return

    message = "Expiring certificates:\n"
    for cert in certs:
        message += f"- {cert.domain} expires {cert.expires}\n"

    sns = boto3.client('sns')
    sns.publish(
        TopicArn='arn:aws:sns:us-east-1:123456789:alerts',
        Subject='Certificate Expiry Alert',
        Message=message
    )


def main():
    expiring = get_expiring_certificates(days=30)

    if expiring:
        logger.warning(f"Found {len(expiring)} expiring certificates")
        send_alert(expiring)
    else:
        logger.info("No certificates expiring soon")


if __name__ == "__main__":
    main()

# Prometheus alerts for cert-manager
- name: certificate-expiry
  rules:
    - alert: CertManagerCertificateExpiry
      expr: |
        certmanager_certificate_expiration_timestamp_seconds - time() < 604800
      for: 1h
      labels:
        severity: warning
      annotations:
        summary: "Certificate expiring in less than 7 days"

    - alert: CertManagerCertificateExpired
      expr: |
        certmanager_certificate_expiration_timestamp_seconds - time() < 0
      for: 1m
      labels:
        severity: critical
      annotations:
        summary: "Certificate has expired"

# Terraform - DNSSEC configuration
resource "aws_route53_key_signing_key" "main" {
  name                = "example-com-key"
  zone_id             = aws_route53_zone.main.zone_id
  key_management_service_arn = aws_kms_key.dnssec.arn
}

resource "aws_route53_dnssec" "main" {
  hosted_zone_id = aws_route53_zone.main.zone_id
}

# Enable DNSSEC via Cloudflare API
import cloudflare

def enable_dnssec(zone_id, zone_name):
    client = cloudflare.Cloudflare()

    dnssec = client.zones.dnssec.post(zone_id, data={
        'type': 'DS'
    })

    print(f"DS Record: {dnssec['ds']}")

# Terraform - Weighted routing for canary deployments
resource "aws_route53_record" "api-v1" {
  zone_id = aws_route53_zone.main.zone_id
  name    = "api.example.com"
  type    = "A"

  set_identifier  = "v1"
  health_check_id = aws_route53_health_check.v1.id

  alias {
    name                   = "v1-alb.example.com"
    zone_id                = "ZONE_ID"
    evaluate_target_health = true
  }

  weight = 90
}

resource "aws_route53_record" "api-v2" {
  zone_id = aws_route53_zone.main.zone_id
  name    = "api.example.com"
  type    = "A"

  set_identifier  = "v2"
  health_check_id = aws_route53_health_check.v2.id

  alias {
    name                   = "v2-alb.example.com"
    zone_id                = "ZONE_ID"
    evaluate_target_health = true
  }

  weight = 10
}

resource "aws_route53_record" "us-east" {
  zone_id = aws_route53_zone.main.zone_id
  name    = "api.example.com"
  type    = "A"

  set_identifier = "us-east"
  region         = "us-east-1"

  alias {
    name                   = "alb-us-east.example.com"
    zone_id                = "ZONE_ID"
    evaluate_target_health = true
  }
}

resource "aws_route53_record" "eu-west" {
  zone_id = aws_route53_zone.main.zone_id
  name    = "api.example.com"
  type    = "A"

  set_identifier = "eu-west"
  region          = "eu-west-1"

  alias {
    name                   = "alb-eu-west.example.com"
    zone_id                = "ZONE_ID"
    evaluate_target_health = true
  }
}

# CAA record - restrict certificate authorities
resource "aws_route53_record" "caa" {
  zone_id = aws_route53_zone.main.zone_id
  name    = "example.com"
  type    = "CAA"
  ttl     = 3600
  records = [
    "0 issue \"letsencrypt.org\"",
    "0 issuewild \";\"",
    "0 iodef \"mailto:[email protected]\""
  ]
}

# DNSSEC signing and DMARC
resource "cloudflare_record" "dmarc" {
  zone_id = cloudflare_zone.example.id
  name    = "_dmarc"
  value   = "v=DMARC1; p=quarantine; rua=mailto:[email protected]"
  type    = "TXT"
}

# DNS monitoring
- name: dns
  rules:
    - alert: HighDNSLatency
      expr: histogram_quantile(0.95, rate(dns_query_duration_seconds_bucket[5m])) > 0.5
      for: 5m
      labels:
        severity: warning
      annotations:
        summary: "High DNS latency"

    - alert: DNSErrors
      expr: rate(dns_query_errors_total[5m]) > 10
      for: 5m
      labels:
        severity: critical
      annotations:
        summary: "High DNS error rate"