Configure an IBM Cloud Code Engine application to use custom domains

certbot certonly --manual --preferred-challenges dns --email contact@instance.org --server https://acme-v02.api.letsencrypt.org/listing --agree-tos --domain codeengine.instance.org

certbot certonly --manual --preferred-challenges dns --email contact@instance.org --server https://acme-v02.api.letsencrypt.org/listing --agree-tos --domain instance.org

Then, it ought to ask you for the area possession verification step:

root@jumpbox:~# certbot certonly --manual --preferred-challenges dns --email contact@instance.org --server https://acme-v02.api.letsencrypt.org/listing --agree-tos --domain codeengine.instance.org
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Requesting a certificates for codeengine.instance.org

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Please deploy a DNS TXT file underneath the title:

_acme-challenge.codeengine.instance.org

with the next worth:

Fq2wbN9mUSfnWZkGXyaEgVaOm-_9RB4cv4zJEp44Sbg

Earlier than persevering with, confirm the TXT file has been deployed. Relying on the DNS
supplier, this will likely take a while, from a number of seconds to a number of minutes. You'll be able to
verify if it has completed deploying with help of on-line instruments, such because the Google
Admin Toolbox: https://toolbox.googleapps.com/apps/dig/#TXT/_acme-challenge.codeengine.instance.org.
Search for a number of bolded line(s) beneath the road ';ANSWER'. It ought to present the
worth(s) you have simply added.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Press Enter to Proceed

Let’s add the verification TXT information for each domains within the DNS as per the beneath:

codeengine.instance.org	TXT	Fq2wbN9mUSfnWZkGXyaEgVaOm-_9RB4cv4zJEp44Sbg

instance.org		TXT	DfjSDFFDbN9vccdSDnjnkSNSNKx-_9vccdSDnZvccdSDn

Now, it’s essential to create a TXT file with the above worth in your area’s DNS servers. The DNS servers to your area might need been supplied by your area registrar or these may be hosted elsewhere. After you add this DNS file, you possibly can confirm it utilizing dig or nslookup:

% dig txt _acme-challenge.codeengine.instance.org. +quick
"Fq2wbN9mUSfnWZkGXyaEgVaOm-_9RB4cv4zJEp44Sbg"

After you press Enter or Return, it is best to see one thing like the next:

Efficiently acquired certificates.
Certificates is saved at: /and many others/letsencrypt/dwell/codeengine.instance.org/fullchain.pem
Secret's saved at:        /and many others/letsencrypt/dwell/codeengine.instance.org/privkey.pem
This certificates expires on 2023-07-20.
These information will likely be up to date when the certificates renews.

NEXT STEPS:
- This certificates won't be renewed robotically. Autorenewal of --manual certificates requires using an authentication hook script (--manual-auth-hook) however one was not supplied. To resume this certificates, repeat this identical certbot command earlier than the certificates's expiry date.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
In the event you like Certbot, please contemplate supporting our work by:
 * Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
 * Donating to EFF:                    https://eff.org/donate-le
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

You bought two information:

/and many others/letsencrypt/dwell/codeengine.instance.org/fullchain.pem

• That is your TLS certificates with full root-ca chain certificates. The contents must be one thing like this:

-----BEGIN CERTIFICATE-----
MIIFNDCCBBygAwIBAgISBOLyU
------
------
------
cRQJMEhg76fsO3txE+FiYruq9RUWhiF1myv4Q6W+CyBFC
Dfvp7OOGAN6dEOM4+qR9sdjoSYKEBpsr6GtPAQw4dy753ec5
-----END CERTIFICATE-----

/and many others/letsencrypt/dwell/codeengine.instance.org/privkey.pem

• That is the personal key to your TLS certificates. The content material of the personal key file must be one thing like the next:

-----BEGIN PRIVATE KEY-----
MIIEvwIBADANBgkqhkiG9w0BAQEF
------
------
------
BAZQ4dZS/TXFRMQcgNL3nWGk42YSOYAjqJNceX6rQMSoxDiCdb6e+
+pT6jcKsENz88M3dpNQNi1OSUQ==
-----END PRIVATE KEY-----

2. Add your area to Code Engine software UI

Since you’ve got TLS certificates and key out there, now you can proceed so as to add the {custom} area to the IBM Cloud Code Engine software from the IBM Cloud console.

• Go here and observe Initiatives > Your mission title > Functions > Utility title > Area mappings tab
• Choose the appliance for which you wish to use a {custom} area.
• Choose Area mappings from the highest bar menu.
• Right here, it’s essential to click on on the blue button named Create underneath the part titled Customized area mappings.
• A brand new setup wizard ought to open just like the screenshot above. You want to paste the contents from the file fullchain.pem within the textual content field titled Certificates chain and file privkey.pem to the textual content field titled Personal key.
• Beneath the part titled Area title and goal software, sort the precise {custom} area hostname:
  • Area title: Kind “instance.org” on this editable textual content discipline.
  • CNAME Goal: Pref-filled textual content must be there, which we have to create a CNAME file for this area title.

instance.org			CNAME	{custom}.zx67dfvbl7l.us-south.codeengine.appdomain.cloud

codeengine.instance.org	CNAME	{custom}. zx67dfvbl7l.us-south.codeengine.appdomain.cloud

3. Create a CNAME file in DNS to your area title