Configure an IBM Cloud Code Engine application to use custom domains

certbot certonly --manual --preferred-challenges dns --email contact@instance.org --server https://acme-v02.api.letsencrypt.org/listing --agree-tos --domain codeengine.instance.org

certbot certonly --manual --preferred-challenges dns --email contact@instance.org --server https://acme-v02.api.letsencrypt.org/listing --agree-tos --domain instance.org

Then, it ought to ask you for the area possession verification step:

root@jumpbox:~# certbot certonly --manual --preferred-challenges dns --email contact@instance.org --server https://acme-v02.api.letsencrypt.org/listing --agree-tos --domain codeengine.instance.org
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Requesting a certificates for codeengine.instance.org

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Please deploy a DNS TXT document below the identify:

_acme-challenge.codeengine.instance.org

with the next worth:

Fq2wbN9mUSfnWZkGXyaEgVaOm-_9RB4cv4zJEp44Sbg

Earlier than persevering with, confirm the TXT document has been deployed. Relying on the DNS
supplier, this will take a while, from a couple of seconds to a number of minutes. You'll be able to
verify if it has completed deploying with assist of on-line instruments, such because the Google
Admin Toolbox: https://toolbox.googleapps.com/apps/dig/#TXT/_acme-challenge.codeengine.instance.org.
Search for a number of bolded line(s) under the road ';ANSWER'. It ought to present the
worth(s) you've got simply added.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Press Enter to Proceed

Let’s add the verification TXT data for each domains within the DNS as per the under:

codeengine.instance.org	TXT	Fq2wbN9mUSfnWZkGXyaEgVaOm-_9RB4cv4zJEp44Sbg

instance.org		TXT	DfjSDFFDbN9vccdSDnjnkSNSNKx-_9vccdSDnZvccdSDn

Now, that you must create a TXT document with the above worth in your area’s DNS servers. The DNS servers to your area may need been supplied by your area registrar or these will be hosted elsewhere. After you add this DNS document, you’ll be able to confirm it utilizing dig or nslookup:

% dig txt _acme-challenge.codeengine.instance.org. +brief
"Fq2wbN9mUSfnWZkGXyaEgVaOm-_9RB4cv4zJEp44Sbg"

After you press Enter or Return, it is best to see one thing like the next:

Efficiently acquired certificates.
Certificates is saved at: /and so on/letsencrypt/stay/codeengine.instance.org/fullchain.pem
Key's saved at:        /and so on/letsencrypt/stay/codeengine.instance.org/privkey.pem
This certificates expires on 2023-07-20.
These recordsdata might be up to date when the certificates renews.

NEXT STEPS:
- This certificates is not going to be renewed robotically. Autorenewal of --manual certificates requires using an authentication hook script (--manual-auth-hook) however one was not supplied. To resume this certificates, repeat this identical certbot command earlier than the certificates's expiry date.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
In the event you like Certbot, please take into account supporting our work by:
 * Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
 * Donating to EFF:                    https://eff.org/donate-le
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

You bought two recordsdata:

/and so on/letsencrypt/stay/codeengine.instance.org/fullchain.pem

• That is your TLS certificates with full root-ca chain certificates. The contents ought to be one thing like this:

-----BEGIN CERTIFICATE-----
MIIFNDCCBBygAwIBAgISBOLyU
------
------
------
cRQJMEhg76fsO3txE+FiYruq9RUWhiF1myv4Q6W+CyBFC
Dfvp7OOGAN6dEOM4+qR9sdjoSYKEBpsr6GtPAQw4dy753ec5
-----END CERTIFICATE-----

/and so on/letsencrypt/stay/codeengine.instance.org/privkey.pem

• That is the non-public key to your TLS certificates. The content material of the non-public key file ought to be one thing like the next:

-----BEGIN PRIVATE KEY-----
MIIEvwIBADANBgkqhkiG9w0BAQEF
------
------
------
BAZQ4dZS/TXFRMQcgNL3nWGk42YSOYAjqJNceX6rQMSoxDiCdb6e+
+pT6jcKsENz88M3dpNQNi1OSUQ==
-----END PRIVATE KEY-----

2. Add your area to Code Engine utility UI

Since you may have TLS certificates and key obtainable, now you can proceed so as to add the {custom} area to the IBM Cloud Code Engine utility from the IBM Cloud console.

• Go here and comply with Tasks > Your challenge identify > Functions > Utility identify > Area mappings tab
• Choose the applying for which you need to use a {custom} area.
• Choose Area mappings from the highest bar menu.
• Right here, that you must click on on the blue button named Create below the part titled Customized area mappings.
• A brand new setup wizard ought to open just like the screenshot above. It is advisable paste the contents from the file fullchain.pem within the textual content field titled Certificates chain and file privkey.pem to the textual content field titled Personal key.
• Below the part titled Area identify and goal utility, sort the precise {custom} area hostname:
  • Area identify: Sort “instance.org” on this editable textual content discipline.
  • CNAME Goal: Pref-filled textual content ought to be there, which we have to create a CNAME document for this area identify.

instance.org			CNAME	{custom}.zx67dfvbl7l.us-south.codeengine.appdomain.cloud

codeengine.instance.org	CNAME	{custom}. zx67dfvbl7l.us-south.codeengine.appdomain.cloud

3. Create a CNAME document in DNS to your area identify