Configure an IBM Cloud Code Engine application to use custom domains

certbot certonly --manual --preferred-challenges dns --email contact@instance.org --server https://acme-v02.api.letsencrypt.org/listing --agree-tos --domain codeengine.instance.org

certbot certonly --manual --preferred-challenges dns --email contact@instance.org --server https://acme-v02.api.letsencrypt.org/listing --agree-tos --domain instance.org

Then, it ought to ask you for the area possession verification step:

root@jumpbox:~# certbot certonly --manual --preferred-challenges dns --email contact@instance.org --server https://acme-v02.api.letsencrypt.org/listing --agree-tos --domain codeengine.instance.org
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Requesting a certificates for codeengine.instance.org

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Please deploy a DNS TXT document underneath the identify:

_acme-challenge.codeengine.instance.org

with the next worth:

Fq2wbN9mUSfnWZkGXyaEgVaOm-_9RB4cv4zJEp44Sbg

Earlier than persevering with, confirm the TXT document has been deployed. Relying on the DNS
supplier, this will likely take a while, from a number of seconds to a number of minutes. You'll be able to
examine if it has completed deploying with help of on-line instruments, such because the Google
Admin Toolbox: https://toolbox.googleapps.com/apps/dig/#TXT/_acme-challenge.codeengine.instance.org.
Search for a number of bolded line(s) under the road ';ANSWER'. It ought to present the
worth(s) you've got simply added.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Press Enter to Proceed

Let’s add the verification TXT information for each domains within the DNS as per the under:

codeengine.instance.org	TXT	Fq2wbN9mUSfnWZkGXyaEgVaOm-_9RB4cv4zJEp44Sbg

instance.org		TXT	DfjSDFFDbN9vccdSDnjnkSNSNKx-_9vccdSDnZvccdSDn

Now, it’s good to create a TXT document with the above worth in your area’s DNS servers. The DNS servers to your area may need been supplied by your area registrar or these will be hosted some place else. After you add this DNS document, you possibly can confirm it utilizing dig or nslookup:

% dig txt _acme-challenge.codeengine.instance.org. +brief
"Fq2wbN9mUSfnWZkGXyaEgVaOm-_9RB4cv4zJEp44Sbg"

After you press Enter or Return, it is best to see one thing like the next:

Efficiently acquired certificates.
Certificates is saved at: /and many others/letsencrypt/dwell/codeengine.instance.org/fullchain.pem
Secret's saved at:        /and many others/letsencrypt/dwell/codeengine.instance.org/privkey.pem
This certificates expires on 2023-07-20.
These recordsdata shall be up to date when the certificates renews.

NEXT STEPS:
- This certificates is not going to be renewed robotically. Autorenewal of --manual certificates requires the usage of an authentication hook script (--manual-auth-hook) however one was not supplied. To resume this certificates, repeat this similar certbot command earlier than the certificates's expiry date.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Should you like Certbot, please think about supporting our work by:
 * Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
 * Donating to EFF:                    https://eff.org/donate-le
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

You bought two recordsdata:

/and many others/letsencrypt/dwell/codeengine.instance.org/fullchain.pem

• That is your TLS certificates with full root-ca chain certificates. The contents needs to be one thing like this:

-----BEGIN CERTIFICATE-----
MIIFNDCCBBygAwIBAgISBOLyU
------
------
------
cRQJMEhg76fsO3txE+FiYruq9RUWhiF1myv4Q6W+CyBFC
Dfvp7OOGAN6dEOM4+qR9sdjoSYKEBpsr6GtPAQw4dy753ec5
-----END CERTIFICATE-----

/and many others/letsencrypt/dwell/codeengine.instance.org/privkey.pem

• That is the non-public key to your TLS certificates. The content material of the non-public key file needs to be one thing like the next:

-----BEGIN PRIVATE KEY-----
MIIEvwIBADANBgkqhkiG9w0BAQEF
------
------
------
BAZQ4dZS/TXFRMQcgNL3nWGk42YSOYAjqJNceX6rQMSoxDiCdb6e+
+pT6jcKsENz88M3dpNQNi1OSUQ==
-----END PRIVATE KEY-----

2. Add your area to Code Engine software UI

Since you may have TLS certificates and key out there, now you can proceed so as to add the {custom} area to the IBM Cloud Code Engine software from the IBM Cloud console.

• Go here and comply with Initiatives > Your challenge identify > Purposes > Software identify > Area mappings tab
• Choose the applying for which you need to use a {custom} area.
• Choose Area mappings from the highest bar menu.
• Right here, it’s good to click on on the blue button named Create underneath the part titled Customized area mappings.
• A brand new setup wizard ought to open just like the screenshot above. It’s worthwhile to paste the contents from the file fullchain.pem within the textual content field titled Certificates chain and file privkey.pem to the textual content field titled Non-public key.
• Beneath the part titled Area identify and goal software, sort the precise {custom} area hostname:
  • Area identify: Kind “instance.org” on this editable textual content subject.
  • CNAME Goal: Pref-filled textual content needs to be there, which we have to create a CNAME document for this area identify.

instance.org			CNAME	{custom}.zx67dfvbl7l.us-south.codeengine.appdomain.cloud

codeengine.instance.org	CNAME	{custom}. zx67dfvbl7l.us-south.codeengine.appdomain.cloud

3. Create a CNAME document in DNS to your area identify