Using certbot to create certificate when certmagic fails

[godoppl]

Hi
I tried setting up my own interactsh server today, and ran into issues generating the TLS cert. This seems to be a common issue, so I jotted down the commands I used to create the cert manually with certbot so that they are recognized by certmagic.
Feel free to use this, or include it in the documentation if you wish.

# Presumes Ubuntu logged in as root user and that go/interactsh-server is already installed by root

apt update
apt install certbot

export DOMAIN=yourdomain.com

certbot certonly --manual -d $DOMAIN --agree-tos --no-bootstrap --manual-public-ip-logging-ok --preferred-challenges dns-01 -m abuse@$DOMAIN --server https://acme-v02.api.letsencrypt.org/directory
# and
certbot certonly --manual -d *.$DOMAIN --agree-tos --no-bootstrap --manual-public-ip-logging-ok --preferred-challenges dns-01 -m abuse@$DOMAIN --server https://acme-v02.api.letsencrypt.org/directory

# !!!!! IMPORTANT: Add both challenges to your TXT record with the name _acme-challenge and wait for the records to get pushed before continuing

# To check if records are live
dig _acme-challenge.$DOMAIN TXT

# When certs have been created successfully

mkdir -p /root/.local/share/certmagic/certificates/acme-v02.api.letsencrypt.org-directory/$DOMAIN
# and
mkdir -p /root/.local/share/certmagic/certificates/acme-v02.api.letsencrypt.org-directory/wildcard_.$DOMAIN

# Symlink the files created from certbot to these locations with filename $DOMAIN.[crt|key]
# !!!!! Disclaimer: Please make sure the paths of the certbot output match if you run the following 4 lines unaltered

ln -s /etc/letsencrypt/live/$DOMAIN/fullchain.pem /root/.local/share/certmagic/certificates/acme-v02.api.letsencrypt.org-directory/$DOMAIN/$DOMAIN.crt
ln -s /etc/letsencrypt/live/$DOMAIN/privkey.pem /root/.local/share/certmagic/certificates/acme-v02.api.letsencrypt.org-directory/$DOMAIN/$DOMAIN.key
ln -s /etc/letsencrypt/live/$DOMAIN-0001/fullchain.pem /root/.local/share/certmagic/certificates/acme-v02.api.letsencrypt.org-directory/wildcard_.$DOMAIN/wildcard_.$DOMAIN.crt
ln -s /etc/letsencrypt/live/$DOMAIN-0001/privkey.pem /root/.local/share/certmagic/certificates/acme-v02.api.letsencrypt.org-directory/wildcard_.$DOMAIN/wildcard_.$DOMAIN.key

# Finally we need to create a json file with the metadata for each cert (certmagic requires this)
# I am not sure if anything special is supposed to be in these files so I put an empty object in it

echo "{}" > /root/.local/share/certmagic/certificates/acme-v02.api.letsencrypt.org-directory/$DOMAIN/$DOMAIN.json
echo "{}" > /root/.local/share/certmagic/certificates/acme-v02.api.letsencrypt.org-directory/wildcard_.$DOMAIN/wildcard_.$DOMAIN.json

[carlmon]

Thanks, this helped me!

One question: Why not create one cert for the domain and wildcard at the same time using -d $DOMAIN -d *.$DOMAIN? Does interactsh require separate certs certs?

[godoppl]

interactsh is setup to use separate files, but you could potentially symlink both wildcard_.$DOMAIN and $DOMAIN to one cert and key combo.
Let me know if anyone tries it.