Configure an IBM Cloud Code Engine application to use custom domains

Then, it should ask you for the domain ownership verification step:

[email protected]:~# certbot certonly –manual –preferred-challenges dns –email [email protected] –server https://acme-v02.api.letsencrypt.org/directory –agree-tos –domain codeengine.example.org
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Requesting a certificate for codeengine.example.org

– – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – –
Please deploy a DNS TXT record under the name:

_acme-challenge.codeengine.example.org

with the following value:

Fq2wbN9mUSfnWZkGXyaEgVaOm-_9RB4cv4zJEp44Sbg

Before continuing, verify the TXT record has been deployed. Depending on the DNS
provider, this may take some time, from a few seconds to multiple minutes. You can
check if it has finished deploying with aid of online tools, such as the Google
Admin Toolbox: https://toolbox.googleapps.com/apps/dig/#TXT/_acme-challenge.codeengine.example.org.
Look for one or more bolded line(s) below the line ‘;ANSWER’. It should show the
value(s) you’ve just added.

– – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – –
Press Enter to Continue

Let’s add the verification TXT records for both domains in the DNS as per the below:

codeengine.example.org TXT Fq2wbN9mUSfnWZkGXyaEgVaOm-_9RB4cv4zJEp44Sbg

example.org TXT DfjSDFFDbN9vccdSDnjnkSNSNKx-_9vccdSDnZvccdSDn

Now, you need to create a TXT record with the above value in your domain’s DNS servers. The DNS servers for your domain might have been provided by your domain registrar or these can be hosted somewhere else. After you add this DNS record, you can verify it using dig or nslookup:

% dig txt _acme-challenge.codeengine.example.org. +short
“Fq2wbN9mUSfnWZkGXyaEgVaOm-_9RB4cv4zJEp44Sbg”

After you press Enter or Return, you should see something like the following:

Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/codeengine.example.org/fullchain.pem
Key is saved at: /etc/letsencrypt/live/codeengine.example.org/privkey.pem
This certificate expires on 2023-07-20.
These files will be updated when the certificate renews.

NEXT STEPS:
– This certificate will not be renewed automatically. Autorenewal of –manual certificates requires the use of an authentication hook script (–manual-auth-hook) but one was not provided. To renew this certificate, repeat this same certbot command before the certificate’s expiry date.

– – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – –
If you like Certbot, please consider supporting our work by:
* Donating to ISRG / Let’s Encrypt: https://letsencrypt.org/donate
* Donating to EFF: https://eff.org/donate-le
– – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – –

You got two files:

/etc/letsencrypt/live/codeengine.example.org/fullchain.pem

This is your TLS certificate with full root-ca chain certificates. The contents should be something like this:

—–BEGIN CERTIFICATE—–
MIIFNDCCBBygAwIBAgISBOLyU
——
——
——
cRQJMEhg76fsO3txE+FiYruq9RUWhiF1myv4Q6W+CyBFC
Dfvp7OOGAN6dEOM4+qR9sdjoSYKEBpsr6GtPAQw4dy753ec5
—–END CERTIFICATE—–

/etc/letsencrypt/live/codeengine.example.org/privkey.pem

This is the private key for your TLS certificate. The content of the private key file should be something like the following:

—–BEGIN PRIVATE KEY—–
MIIEvwIBADANBgkqhkiG9w0BAQEF
——
——
——
BAZQ4dZS/TXFRMQcgNL3nWGk42YSOYAjqJNceX6rQMSoxDiCdb6e+
+pT6jcKsENz88M3dpNQNi1OSUQ==
—–END PRIVATE KEY—–

2. Add your domain to Code Engine application UI

Since you have TLS certificate and key available, you can now proceed to add the custom domain to the IBM Cloud Code Engine application from the IBM Cloud console.

Go here and follow Projects > Your project name > Applications > Application name > Domain mappings tab

Select the application for which you want to use a custom domain.

Select Domain mappings from the top bar menu.

Here, you need to click on the blue button named Create under the section titled Custom domain mappings.

A new setup wizard should open like the screenshot above. You need to paste the contents from the file fullchain.pem in the text box titled Certificate chain and file privkey.pem to the text box titled Private key.

Under the section titled Domain name and target application, type the actual custom domain hostname:

Domain name: Type “example.org” in this editable text field.

CNAME Target: Pref-filled text should be there, which we need to create a CNAME record for this domain name.

example.org CNAME custom.zx67dfvbl7l.us-south.codeengine.appdomain.cloud

codeengine.example.org CNAME custom. zx67dfvbl7l.us-south.codeengine.appdomain.cloud

3. Create a CNAME record in DNS for your domain name