-
Notifications
You must be signed in to change notification settings - Fork 1
dnsapi
If your DNS provider doesn't provide API access, you can use our DNS alias mode:
https://github.com/acmesh-official/acme.sh/wiki/DNS-alias-mode
Cloudflare Domain API offers two methods to automatically issue certs.
First you need to login to your Cloudflare account to get your API key. Each token generated is not stored on cloudflare account and will have expiry if not set correctly. You will get this in API keys section.
export CF_Key="sdfsdfsdfljlbjkljlkjsdfoiwje"
export CF_Email="[email protected]"Using the new cloudflare api token, you will get this after normal login and scroll down on dashboard and copy credentials.
export CF_Token="sdfsdfsdfljlbjkljlkjsdfoiwje"
export CF_Account_ID="xxxxxxxxxxxxx"In order to use the new token, the token currently needs access read access to Zone.Zone, and write access to Zone.DNS, across all Zones. See Issue #2398 for more info.
Alternatively, if the certificate only covers a single zone, you can restrict the API Token only for write access to Zone.DNS for a single domain, and then specify the CF_Zone_ID directly:
export CF_Token="sdfsdfsdfljlbjkljlkjsdfoiwje"
export CF_Account_ID="xxxxxxxxxxxxx"
export CF_Zone_ID="xxxxxxxxxxxxx"Ok, let's issue a cert now:
./acme.sh --issue --dns dns_cf -d example.com -d www.example.comThe CF_Key and CF_Email or CF_Tokenand CF_Account_IDwill be saved in ~/.acme.sh/account.conf and will be reused when needed.
The DNSPod.cn Domain API option requires that you first login to your account to get a DNSPod API Key and ID.
export DP_Id="1234"
export DP_Key="sADDsdasdgdsf"Ok, let's issue a cert now:
./acme.sh --issue --dns dns_dp -d example.com -d www.example.comThe DP_Id and DP_Key will be saved in ~/.acme.sh/account.conf and will be reused when needed.
Removed
First you need to login to your GoDaddy account to get your API Key and Secret.
https://developer.godaddy.com/keys/
Please create a Production key, instead of a Test key.
export GD_Key="sdfsdfsdfljlbjkljlkjsdfoiwje"
export GD_Secret="asdfsdafdsfdsfdsfdsfdsafd"Ok, let's issue a cert now:
./acme.sh --issue --dns dns_gd -d example.com -d www.example.comThe GD_Key and GD_Secret will be saved in ~/.acme.sh/account.conf and will be reused when needed.
First you need to login to your PowerDNS account to enable the API and set your API-Token in the configuration.
https://doc.powerdns.com/md/httpapi/README/
export PDNS_Url="http://ns.example.com:8081"
export PDNS_ServerId="localhost"
export PDNS_Token="0123456789ABCDEF"
export PDNS_Ttl=60Ok, let's issue a cert now:
./acme.sh --issue --dns dns_pdns -d example.com -d www.example.comThe PDNS_Url, PDNS_ServerId, PDNS_Token and PDNS_Ttl will be saved in ~/.acme.sh/account.conf and will be reused when needed.
https://github.com/Neilpang/acme.sh/wiki/How-to-use-OVH-domain-api
First, generate a key for updating the zone
b=$(dnssec-keygen -a hmac-sha512 -b 512 -n USER -K /tmp foo)
cat > /etc/named/keys/update.key <<EOF
key "update" {
algorithm hmac-sha512;
secret "$(awk '/^Key/{print $2}' /tmp/$b.private)";
};
EOF
rm -f /tmp/$b.{private,key}Include this key in your named configuration
include "/etc/named/keys/update.key";Next, configure your zone to allow dynamic updates.
Depending on your named version, use either
zone "example.com" {
type master;
allow-update { key "update"; };
};or
zone "example.com" {
type master;
update-policy {
grant update subdomain example.com.;
};
}Notes on BIND 9.16.1-Ubuntu 20.04.3 LTS
# dnssec-keygen no longer do tsig algorithm, so tsig-keygen (came with bind9)
tsig-keygen -a hmac-sha512 acme | sudo tee /etc/bind/acme.key
# as nsupdate need creation of *.jnl where zone file resides, read /var/log/syslog for error details
sudo chmod g+w /etc/bind
# similar to above steps: include key, allow-update with key on target zone
# echo 'include "/etc/bind/acme.key";' | sudo tee --append /etc/bind/named.conf.localFinally, make the DNS server and update Key available to acme.sh
export NSUPDATE_SERVER="dns.example.com"
export NSUPDATE_KEY="/path/to/your/nsupdate.key"and optionally (depending on DNS server)
export NSUPDATE_ZONE="example.com"Ok, let's issue a cert now:
./acme.sh --issue --dns dns_nsupdate -d example.com -d www.example.comThe NSUPDATE_SERVER, NSUPDATE_KEY, and NSUPDATE_ZONE settings will be saved in ~/.acme.sh/account.conf and will be reused when needed.
Get your API token at https://api.luadns.com/settings
export LUA_Key="sdfsdfsdfljlbjkljlkjsdfoiwje"
export LUA_Email="[email protected]"To issue a cert:
./acme.sh --issue --dns dns_lua -d example.com -d www.example.comThe LUA_Key and LUA_Email will be saved in ~/.acme.sh/account.conf and will be reused when needed.
Get your API credentials at https://cp.dnsmadeeasy.com/account/info
export ME_Key="sdfsdfsdfljlbjkljlkjsdfoiwje"
export ME_Secret="qdfqsdfkjdskfj"To issue a cert:
./acme.sh --issue --dns dns_me -d example.com -d www.example.comThe ME_Key and ME_Secret will be saved in ~/.acme.sh/account.conf and will be reused when needed.
https://github.com/Neilpang/acme.sh/wiki/How-to-use-Amazon-Route53-API
export AWS_ACCESS_KEY_ID=XXXXXXXXXX
export AWS_SECRET_ACCESS_KEY=XXXXXXXXXXXXXXXTo issue a cert:
./acme.sh --issue --dns dns_aws -d example.com -d www.example.comIf you get an AWS Route53 rate exceeded error, you can add a sleep time between api requests:
export AWS_DNS_SLOWRATE=1 (sleep between API requests in seconds)The AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY and AWS_DNS_SLOWRATE will be saved in ~/.acme.sh/account.conf and will be reused when needed. The AWS_DNS_SLOWRATE will enable the sleep between API requests to AWS servers. It will help to mitigate the AWS rate limit
First you need to login to your Aliyun account to get your RAM API key. https://ram.console.aliyun.com/users
export Ali_Key="sdfsdfsdfljlbjkljlkjsdfoiwje"
export Ali_Secret="jlsdflanljkljlfdsaklkjflsa"Ok, let's issue a cert now:
./acme.sh --issue --dns dns_ali -d example.com -d www.example.comThe Ali_Key and Ali_Secret will be saved in ~/.acme.sh/account.conf and will be reused when needed.
This only works for ISPConfig 3.1 (and newer).
Create a Remote User in the ISPConfig Control Panel. The Remote User must have access to at least DNS zone functions, DNS txt functions and Client functions.
export ISPC_User="xxx"
export ISPC_Password="xxx"
export ISPC_Api="https://ispc.domain.tld:8080/remote/json.php"
export ISPC_Api_Insecure=1If you have installed ISPConfig on a different port, then alter the 8080 accordingly. Leave ISPC_Api_Insecure set to 1 if you have no valid ssl cert for your installation. Change it to 0 if you have a valid ssl cert.
To issue a cert:
./acme.sh --issue --dns dns_ispconfig -d example.com -d www.example.comThe ISPC_User, ISPC_Password, ISPC_Apiand ISPC_Api_Insecure will be saved in ~/.acme.sh/account.conf and will be reused when needed.
First you need to login to your Alwaysdata account to get your API Key.
export AD_API_KEY="myalwaysdataapikey"Ok, let's issue a cert now:
./acme.sh --issue --dns dns_ad -d example.com -d www.example.comThe AD_API_KEY will be saved in ~/.acme.sh/account.conf and will be reused
when needed.
Cloud Manager: https://cloud.linode.com/profile/tokens
First you need to login to your Linode account to get your API Key.
- Click on "Add a Personal Access Token".
- Give the new key a "Label" (we recommend ACME)
- Give it Read/Write access to "Domains"
- "Submit" and copy the new key into the
LINODE_V4_API_KEYcommand below.
export LINODE_V4_API_KEY="..."Due to the reload time of any changes in the DNS records, we have to use the
dnssleep option to wait at least 15 minutes for the changes to take effect.
Ok, let's issue a cert now:
./acme.sh --issue --dns dns_linode_v4 --dnssleep 900 -d example.com -d www.example.comThe LINODE_V4_API_KEY will be saved in ~/.acme.sh/account.conf and will be
reused when needed.
FreeDNS (https://freedns.afraid.org/) does not provide an API to update DNS records (other than IPv4 and IPv6 dynamic DNS addresses). The acme.sh plugin therefore retrieves and updates domain TXT records by logging into the FreeDNS website to read the HTML and posting updates as HTTP. The plugin needs to know your userid and password for the FreeDNS website.
export FREEDNS_User="..."
export FREEDNS_Password="..."You need only provide this the first time you run the acme.sh client with FreeDNS validation and then again
whenever you change your password at the FreeDNS site. The acme.sh FreeDNS plugin does not store your userid
or password but rather saves an authentication token returned by FreeDNS in ~/.acme.sh/account.conf and
reuses that when needed.
Now you can issue a certificate.
./acme.sh --issue --dns dns_freedns -d example.com -d www.example.comNote that you cannot use acme.sh automatic DNS validation for FreeDNS public domains or for a subdomain that you create under a FreeDNS public domain. You must own the top level domain in order to automatically validate with acme.sh at FreeDNS.
If you have any issues with FreeDNS API please report them here... https://github.com/Neilpang/acme.sh/issues/2305
You only need to set your cyon.ch login credentials.
If you also have 2 Factor Authentication (OTP) enabled, you need to set your secret token too and have oathtool installed.
export CY_Username="your_cyon_username"
export CY_Password="your_cyon_password"
export CY_OTP_Secret="your_otp_secret" # Only required if using 2FATo issue a cert:
./acme.sh --issue --dns dns_cyon -d example.com -d www.example.comThe CY_Username, CY_Password and CY_OTP_Secret will be saved in ~/.acme.sh/account.conf and will be reused when needed.
Removed
You must enable the new Gandi LiveDNS API first and the create your api key, See: https://api.gandi.net/docs/livedns/
export GANDI_LIVEDNS_KEY="fdmlfsdklmfdkmqsdfk"Ok, let's issue a cert now:
./acme.sh --issue --dns dns_gandi_livedns -d example.com -d www.example.comFirst, generate a TSIG key for updating the zone.
keymgr tsig generate -t acme_key hmac-sha512 > /etc/knot/acme.keyInclude this key in your knot configuration file.
include: /etc/knot/acme.keyNext, configure your zone to allow dynamic updates.
Dynamic updates for the zone are allowed via proper ACL rule with the update action. For in-depth instructions, please see Knot DNS's documentation.
acl:
- id: acme_acl
address: 192.168.1.0/24
key: acme_key
action: update
zone:
- domain: example.com
file: example.com.zone
acl: acme_aclFinally, make the DNS server and TSIG Key available to acme.sh
export KNOT_SERVER="dns.example.com"
export KNOT_KEY=`grep \# /etc/knot/acme.key | cut -d' ' -f2`and optionally (if you use challenge alias zone)
export KNOT_ZONE="le.example.com"Ok, let's issue a cert now:
./acme.sh --issue --dns dns_knot -d example.com -d www.example.comThe KNOT_SERVER and KNOT_KEY and KNOT_ZONE settings will be saved in ~/.acme.sh/account.conf and will be reused when needed.
You need to obtain a read and write capable API key from your DigitalOcean account. See: https://www.digitalocean.com/help/api/
export DO_API_KEY="75310dc4ca779ac39a19f6355db573b49ce92ae126553ebd61ac3a3ae34834cc"Ok, let's issue a cert now:
./acme.sh --issue --dns dns_dgon -d example.com -d www.example.comYou need to set the HTTP API user ID and password credentials. See: https://www.cloudns.net/wiki/article/42/. For security reasons, it's recommended to use a sub user ID that only has access to the necessary zones, as a regular API user has access to your entire account.
# Use this for a sub auth ID
export CLOUDNS_SUB_AUTH_ID=XXXXX
# Use this for a regular auth ID
#export CLOUDNS_AUTH_ID=XXXXX
export CLOUDNS_AUTH_PASSWORD="YYYYYYYYY"Ok, let's issue a cert now:
./acme.sh --issue --dns dns_cloudns -d example.com -d www.example.comThe CLOUDNS_AUTH_ID and CLOUDNS_AUTH_PASSWORD will be saved in ~/.acme.sh/account.conf and will be reused when needed.
First you need to create/obtain API credentials on your Infoblox appliance.
export Infoblox_Creds="username:password"
export Infoblox_Server="ip or fqdn of infoblox appliance"Ok, let's issue a cert now:
./acme.sh --issue --dns dns_infoblox -d example.com -d www.example.comNote: This script will automatically create and delete the ephemeral txt record.
The Infoblox_Creds and Infoblox_Server will be saved in ~/.acme.sh/account.conf and will be reused when needed.
First you need to create/obtain API tokens on your settings panel.
export VSCALE_API_KEY="sdfsdfsdfljlbjkljlkjsdfoiwje"Ok, let's issue a cert now:
./acme.sh --issue --dns dns_vscale -d example.com -d www.example.comFirst you need to create/obtain API credentials from your Dynu account. See: https://www.dynu.com/resources/api/documentation
export Dynu_ClientId=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
export Dynu_Secret=yyyyyyyyyyyyyyyyyyyyyyyyyOk, let's issue a cert now:
./acme.sh --issue --dns dns_dynu -d example.com -d www.example.comThe Dynu_ClientId and Dynu_Secret will be saved in ~/.acme.sh/account.conf and will be reused when needed.
First you need to login to your DNSimple account and generate a new oauth token.
https://dnsimple.com/a/{your account id}/account/automation
Note that this is an account token and not a user token. The account token is
needed to infer the account_id used in requests. A user token will not be able
to determine the correct account to use.
export DNSimple_OAUTH_TOKEN="sdfsdfsdfljlbjkljlkjsdfoiwje"To issue the cert just specify the dns_dnsimple API.
./acme.sh --issue --dns dns_dnsimple -d example.comThe DNSimple_OAUTH_TOKEN will be saved in ~/.acme.sh/account.conf and will
be reused when needed.
If you have any issues with this integration please report them to https://github.com/pho3nixf1re/acme.sh/issues.
export NS1_Key="fdmlfsdklmfdkmqsdfk"Ok, let's issue a cert now:
./acme.sh --issue --dns dns_nsone -d example.com -d www.example.comexport DuckDNS_Token="aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee"Please note that since DuckDNS uses StartSSL as their cert provider, thus --insecure may need to be used when issuing certs:
acme.sh --insecure --issue --dns dns_duckdns -d mydomain.duckdns.org
Create your API token here: https://www.name.com/account/settings/api
Note: Namecom_Username should be your Name.com username and not the token name. If you accidentally run the script with the token name as the username see ~/.acme.sh/account.conf to fix the issue
export Namecom_Username="testuser"
export Namecom_Token="xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"And now you can issue certs with:
./acme.sh --issue --dns dns_namecom -d example.com -d www.example.comIf you had Two-step Authentication enabled, make sure to change your security setting, read this guide for help: Using API with Two-step Authentication
For issues, please report to https://github.com/raidenii/acme.sh/issues.
First, login to your Dyn Managed DNS account: https://portal.dynect.net/login/
It is recommended to add a new user specific for API access.
The minimum "Zones & Records Permissions" required are:
RecordAdd
RecordUpdate
RecordDelete
RecordGet
ZoneGet
ZoneAddNode
ZoneRemoveNode
ZonePublish
Pass the API user credentials to the environment:
export DYN_Customer="customer"
export DYN_Username="apiuser"
export DYN_Password="secret"Ok, let's issue a cert now:
./acme.sh --issue --dns dns_dyn -d example.com -d www.example.comThe DYN_Customer, DYN_Username and DYN_Password will be saved in ~/.acme.sh/account.conf and will be reused when needed.
export PDD_Token="xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"Follow these instructions to get the token for your domain https://tech.yandex.com/domain/doc/concepts/access-docpage/
./acme.sh --issue --dns dns_yandex -d mydomain.example.orgSometimes cloudflare / google doesn't pick new dns records fast enough. You can add --dnssleep XXX to params as workaround.
For issues, please report to https://github.com/non7top/acme.sh/issues.
Hurricane Electric (https://dns.he.net/) doesn't have an API so just set your login credentials like so:
export HE_Username="yourusername"
export HE_Password="password"Then you can issue your certificate:
./acme.sh --issue --dns dns_he -d example.com -d www.example.comThe HE_Username and HE_Password settings will be saved in ~/.acme.sh/account.conf and will be reused when needed.
Please report any issues to https://github.com/angel333/acme.sh or to [email protected].
First you need to login to your UnoEuro account to get your API key.
export UNO_Key="sdfsdfsdfljlbjkljlkjsdfoiwje"
export UNO_User="UExxxxxx"Ok, let's issue a cert now:
./acme.sh --issue --dns dns_unoeuro -d example.com -d www.example.comThe UNO_Key and UNO_User will be saved in ~/.acme.sh/account.conf and will be reused when needed.
INWX offers an xmlrpc api with your standard login credentials, set them like so:
export INWX_User="yourusername"
export INWX_Password="password"Then you can issue your certificates with:
./acme.sh --issue --dns dns_inwx -d example.com -d www.example.comThe INWX_User and INWX_Password settings will be saved in ~/.acme.sh/account.conf and will be reused when needed.
If your account is secured by mobile tan you have also defined the shared secret.
export INWX_Shared_Secret="shared secret"You may need to re-enable the mobile tan to gain the shared secret.
Create a new user from the servercow control center. Don't forget to activate DNS API for this user.
export SERVERCOW_API_Username=username
export SERVERCOW_API_Password=passwordNow you cann issue a cert:
./acme.sh --issue --dns dns_servercow -d example.com -d www.example.comBoth, SERVERCOW_API_Username and SERVERCOW_API_Password will be saved in ~/.acme.sh/account.conf and will be reused when needed.
You'll need to generate an API key at https://www.namesilo.com/account/api-manager Optionally you may restrict the access to an IP range there.
export Namesilo_Key="xxxxxxxxxxxxxxxxxxxxxxxx"And now you can issue certs with:
./acme.sh --issue --dns dns_namesilo --dnssleep 900 -d example.com -d www.example.comInternetX offers an xml api with your standard login credentials, set them like so:
export AUTODNS_USER="yourusername"
export AUTODNS_PASSWORD="password"
export AUTODNS_CONTEXT="context"Then you can issue your certificates with:
./acme.sh --issue --dns dns_autodns -d example.com -d www.example.comThe AUTODNS_USER, AUTODNS_PASSWORD and AUTODNS_CONTEXT settings will be saved in ~/.acme.sh/account.conf and will be reused when needed.
You have to create a service principal first. See:How to use Azure DNS
export AZUREDNS_SUBSCRIPTIONID="12345678-9abc-def0-1234-567890abcdef"
export AZUREDNS_TENANTID="11111111-2222-3333-4444-555555555555"
export AZUREDNS_APPID="3b5033b5-7a66-43a5-b3b9-a36b9e7c25ed"
export AZUREDNS_CLIENTSECRET="1b0224ef-34d4-5af9-110f-77f527d561bd"Then you can issue your certificates with:
./acme.sh --issue --dns dns_azure -d example.com -d www.example.comAZUREDNS_SUBSCRIPTIONID, AZUREDNS_TENANTID,AZUREDNS_APPID and AZUREDNS_CLIENTSECRET settings will be saved in ~/.acme.sh/account.conf and will be reused when needed.
Alternatively, you can use Managed Identity assigned to a resource instead of a service prinvcipal.
You have to assign a managed identity to your resource, usually a VM, as described here. This identity requires DNS Zone Contributor role.
Before running acme.sh following variables need to bo set:
export AZUREDNS_SUBSCRIPTIONID="12345678-9abc-def0-1234-567890abcdef"
export AZUREDNS_MANAGEDIDENTITY=true
Issuing certificates using managed identity clears previously set settings: AZUREDNS_TENANTID, AZUREDNS_APPID, AZUREDNS_CLIENTSECRET.
AZUREDNS_SUBSCRIPTIONID and AZUREDNS_MANAGEDIDENTITY will be saved in ~/.acme.sh/account.conf for future use.
First you need to login to your account to get your API key from: https://my.selectel.ru/profile/apikeys.
export SL_Key="sdfsdfsdfljlbjkljlkjsdfoiwje"
Ok, let's issue a cert now:
./acme.sh --issue --dns dns_selectel -d example.com -d www.example.comThe SL_Key will be saved in ~/.acme.sh/account.conf and will be reused when needed.
First you need to login to your account to find your API key from: http://zonomi.com/app/dns/dyndns.jsp
Your will find your api key in the example urls:
https://zonomi.com/app/dns/dyndns.jsp?host=example.com&api_key=1063364558943540954358668888888888export ZM_Key="1063364558943540954358668888888888"
Ok, let's issue a cert now:
./acme.sh --issue --dns dns_zonomi -d example.com -d www.example.comThe ZM_Key will be saved in ~/.acme.sh/account.conf and will be reused when needed.
DNS API keys may be created at https://panel.dreamhost.com/?tree=home.api. Ensure the created key has add and remove privelages.
export DH_API_KEY="<api key>"
./acme.sh --issue --dns dns_dreamhost -d example.com -d www.example.comThe 'DH_API_KEY' will be saved in ~/.acme.sh/account.conf and will
be reused when needed.
The DirectAdmin interface has it's own Let's encrypt functionality, but this script can be used to generate certificates for names which are not hosted on DirectAdmin
User must provide login data and URL to the DirectAdmin incl. port. You can create an user which only has access to
- CMD_API_DNS_CONTROL
- CMD_API_SHOW_DOMAINS
By using the Login Keys function. See also https://www.directadmin.com/api.php and https://www.directadmin.com/features.php?id=1298
export DA_Api="https://remoteUser:[email protected]:8443"
export DA_Api_Insecure=1Set DA_Api_Insecure to 1 for insecure and 0 for secure -> difference is whether ssl cert is checked for validity (0) or whether it is just accepted (1)
Ok, let's issue a cert now:
./acme.sh --issue --dns dns_da -d example.com -d www.example.comThe DA_Api and DA_Api_Insecure will be saved in ~/.acme.sh/account.conf and will be reused when needed.
API access must be enabled at https://painel.kinghost.com.br/painel.api.php
export KINGHOST_Username="yourusername"
export KINGHOST_Password="yourpassword"
./acme.sh --issue --dns dns_kinghost -d example.com -d *.example.comThe KINGHOST_username and KINGHOST_Password will be saved in ~/.acme.sh/account.conf and will be reused when needed.
First, get your API key at https://my.zilore.com/account/api
export Zilore_Key="5dcad3a2-36cb-50e8-cb92-000002f9"Ok, let's issue a cert now:
./acme.sh --issue --dns dns_zilore -d example.com -d *.example.comThe Zilore_Key will be saved in ~/.acme.sh/account.conf and will be reused when needed.
User must provide login credentials to the Loopia API. The user needs the following permissions:
- getDomains
- getSubdomains
- addSubdomain
- removeSubdomain
- getZoneRecords
- addZoneRecord
Set the API endpoint:
export LOOPIA_Api="https://api.loopia.<TLD>/RPCSERV"Depending on your hosting location, <TLD> is one of: com, no,
rs, se. The default endpoint is se TLD.
Set the login credentials:
export LOOPIA_User="user@loopiaapi"
export LOOPIA_Password="password"And to issue a cert run:
./acme.sh --issue --dns dns_loopia -d example.com -d *.example.comThe exported variables will be saved in ~/.acme.sh/account.conf and
will be reused when needed.
ACME DNS is a limited DNS server with RESTful HTTP API to handle ACME DNS challenges easily and securely. https://github.com/joohoi/acme-dns
# Usage:
# export ACMEDNS_BASE_URL="https://auth.acme-dns.io"
#
# You can optionally define an already existing account:
#
# export ACMEDNS_USERNAME="<username>"
# export ACMEDNS_PASSWORD="<password>"
# export ACMEDNS_SUBDOMAIN="<subdomain>"
./acme.sh --issue --dns dns_acmedns -d example.com -d www.example.com
The credentials will be saved in ~/.acme.sh/account.conf and will
be reused when needed.
First you need to login to your TELE3 account to set your API-KEY. https://www.tele3.cz/system-acme-api.html
export TELE3_Key="MS2I4uPPaI..."
export TELE3_Secret="kjhOIHGJKHg"
./acme.sh --issue --dns dns_tele3 -d example.com -d *.example.comThe TELE3_Key and TELE3_Secret will be saved in ~/.acme.sh/account.conf and will be reused when needed.
First you need to login to your euserv.eu account and activate your API Administration (API Verwaltung). https://support.euserv.com
Once you've activate, login to your API Admin Interface and create an API account. Please specify the scope (active groups: domain) and assign the allowed IPs.
export EUSERV_Username="99999.user123"
export EUSERV_Password="Asbe54gHde"Ok, let's issue a cert now: (Be aware to use the --insecure flag, cause euserv.eu is still using self-signed certificates!)
./acme.sh --issue --dns dns_euserv -d example.com -d *.example.com --insecureThe EUSERV_Username and EUSERV_Password will be saved in ~/.acme.sh/account.conf and will be reused when needed.
Please report any issues to https://github.com/initit/acme.sh or to [email protected]
First you need to get your API Key and ID by this get-the-user-token.
export DPI_Id="1234"
export DPI_Key="sADDsdasdgdsf"Ok, let's issue a cert now:
./acme.sh --issue --dns dns_dpi -d example.com -d www.example.comThe DPI_Id and DPI_Key will be saved in ~/.acme.sh/account.conf and will be reused when needed.
First you need to authenticate to gcloud.
gcloud init
The dns_gcloud script uses the active gcloud configuration and credentials.
There is no logic inside dns_gcloud to override the project and other settings.
If needed, create additional gcloud configurations.
You can change the configuration being used without activating it; simply set the CLOUDSDK_ACTIVE_CONFIG_NAME environment variable.
To issue a certificate you can:
export CLOUDSDK_ACTIVE_CONFIG_NAME=default # see the note above
./acme.sh --issue --dns dns_gcloud -d example.com -d '*.example.com'dns_gcloud also supports DNS alias mode.
First you need to login to your ConoHa account to get your API credentials.
export CONOHA_Username="xxxxxx"
export CONOHA_Password="xxxxxx"
export CONOHA_TenantId="xxxxxx"
export CONOHA_IdentityServiceApi="https://identity.xxxx.conoha.io/v2.0"To issue a cert:
./acme.sh --issue --dns dns_conoha -d example.com -d www.example.comThe CONOHA_Username, CONOHA_Password, CONOHA_TenantId and CONOHA_IdentityServiceApi will be saved in ~/.acme.sh/account.conf and will be reused when needed.
First you need to login in your CCP account to get your API Key and API Password.
export NC_Apikey="<Apikey>"
export NC_Apipw="<Apipassword>"
export NC_CID="<Customernumber>"Now, let's issue a cert:
./acme.sh --issue --dns dns_netcup -d example.com -d www.example.comThe NC_Apikey,NC_Apipw and NC_CID will be saved in ~/.acme.sh/account.conf and will be reused when needed.
Removed
https://github.com/acmesh-official/acme.sh/pull/4049
You will need your namecheap username, API KEY (https://www.namecheap.com/support/api/intro.aspx) and your external IP address (or an URL to get it), this IP will need to be whitelisted at Namecheap. Due to Namecheap's API limitation all the records of your domain will be read and re applied, make sure to have a backup of your records you could apply if any issue would arise.
export NAMECHEAP_USERNAME="..."
export NAMECHEAP_API_KEY="..."
export NAMECHEAP_SOURCEIP="..."NAMECHEAP_SOURCEIP can either be an IP address or an URL to provide it (e.g. https://ifconfig.co/ip).
The username and password will be saved in ~/.acme.sh/account.conf and will be reused when needed.
Now you can issue a certificate.
./acme.sh --issue --dns dns_namecheap -d example.com -d *.example.comIf you find any bugs of namecheap dns API, please report here: https://github.com/Neilpang/acme.sh/issues/2107
First, register to MyDNS.JP and get MasterID and Password.
export MYDNSJP_MasterID=MasterID
export MYDNSJP_Password=PasswordTo issue a certificate:
./acme.sh --issue --dns dns_mydnsjp -d example.com -d *.example.comThe MYDNSJP_MasterID and MYDNSJP_Password will be saved in ~/.acme.sh/account.conf and will be reused when needed.
Create an API key in your hosting.de account here: https://secure.hosting.de
The key needs the following rights:
- DNS_ZONES_EDIT
- DNS_ZONES_LIST
Set your API Key and endpoint:
export HOSTINGDE_APIKEY='xxx'
export HOSTINGDE_ENDPOINT='https://secure.hosting.de'The plugin can also be used for the http.net API. http.net customers have to set endpoint to https://partner.http.net.
Ok, let's issue a cert now:
./acme.sh --issue --dns dns_hostingde -d example.com -d *.example.comThe hosting.de API key and endpoint will be saved in ~/.acme.sh/account.conf and will be reused when needed.
export NEODIGIT_API_TOKEN="eXJxTkdUVUZmcHQ3QWJackQ4ZGlMejRDSklRYmo5VG5zcFFKK2thYnE0WnVnNnMy"Ok, let's issue a cert now:
./acme.sh --issue --dns dns_neodigit -d example.com -d www.example.comNeodigit API Token will be saved in ~/.acme.sh/account.conf and will be used when needed.
Create an API key and secret key in the Exoscale account section
Set your API and secret key:
export EXOSCALE_API_KEY='xxx'
export EXOSCALE_SECRET_KEY='xxx'Now, let's issue a cert:
./acme.sh --issue --dns dns_exoscale -d example.com -d www.example.comThe EXOSCALE_API_KEY and EXOSCALE_SECRET_KEY will be saved in ~/.acme.sh/account.conf and will be reused when needed.
Log into PointHQ account management and copy the API key from the page there.
exportPointHQ_Email="[email protected]"
You can then issue certs by using:
Create an API token in the Active24 account section, documentation on https://faq.active24.com/cz/790131-REST-API-rozhran%C3%AD.
Set your API token:
export ACTIVE24_Token='xxx'Now, let's issue a cert, set dnssleep for propagation new DNS record:
./acme.sh --issue --dns dns_active24 -d example.com -d www.example.com --dnssleep 1000The ACTIVE24_Token will be saved in ~/.acme.sh/account.conf and will be reused when needed.
Create an API token in your do.de account (Create token here | Documentation).
Set your API token:
export DO_LETOKEN='FmD408PdqT1E269gUK57'To issue a certificate run:
./acme.sh --issue --dns dns_doapi -d example.com -d *.example.comThe API token will be saved in ~/.acme.sh/account.conf and will be reused when needed.
First, you'll need to login to the Nexcess.net Client Portal and generate a new API token.
Once you have a token, set it in your systems environment:
export NW_API_TOKEN="YOUR_TOKEN_HERE"
export NW_API_ENDPOINT="https://portal.nexcess.net"Finally, we'll issue the certificate: (Nexcess DNS publishes at max every 15 minutes, we recommend setting a 900 second --dnssleep)
./acme.sh --issue --dns dns_nw -d example.com --dnssleep 900The NW_API_TOKEN and NW_API_ENDPOINT will be saved in ~/.acme.sh/account.conf and will be reused when needed.
If you find any bugs of Nexcess dns API, please report here: https://github.com/Neilpang/acme.sh/issues/2088
First, you'll need to login to the Thermo.io Client Portal and generate a new API token.
Once you have a token, set it in your systems environment:
export NW_API_TOKEN="YOUR_TOKEN_HERE"
export NW_API_ENDPOINT="https://core.thermo.io"Finally, we'll issue the certificate: (Thermo DNS publishes at max every 15 minutes, we recommend setting a 900 second --dnssleep)
./acme.sh --issue --dns dns_nw -d example.com --dnssleep 900The NW_API_TOKEN and NW_API_ENDPOINT will be saved in ~/.acme.sh/account.conf and will be reused when needed.
First, you'll need to login to the Futurehosting Client Portal and generate a new API token.
Once you have a token, set it in your systems environment:
export NW_API_TOKEN="YOUR_TOKEN_HERE"
export NW_API_ENDPOINT="https://my.futurehosting.com"Finally, we'll issue the certificate: (Futurehosting DNS publishes at max every 15 minutes, we recommend setting a 900 second --dnssleep)
./acme.sh --issue --dns dns_nw -d example.com --dnssleep 900The NW_API_TOKEN and NW_API_ENDPOINT will be saved in ~/.acme.sh/account.conf and will be reused when needed.
Set username and API key, which is available under "My Profile & Settings"
export RACKSPACE_Username='username'
export RACKSPACE_Apikey='xxx'Now, let's issue a cert:
./acme.sh --issue --dns dns_rackspace -d example.com -d www.example.comIf you find any bugs of Rackspace dns API, please report here: https://github.com/Neilpang/acme.sh/issues/2091
First, you'll need to retrive your API key, which is available under https://console.online.net/en/api/access
export ONLINE_API_KEY='xxx'To issue a cert run:
./acme.sh --issue --dns dns_online -d example.com -d www.example.comONLINE_API_KEY will be saved in ~/.acme.sh/account.conf and will be reused when needed.
If you find any bugs of online.net dns API, please report here: https://github.com/Neilpang/acme.sh/issues/2093
Make sure that you can execute own binaries:
devil binexec onInstall acme.sh, or simply git clone it into some directory on your MyDevil host account (in which case you should link to it from your ~/bin directory).
If you're not using private IP and depend on default IP provided by host, you may want to edit crontab too, and make sure that acme.sh --cron is run also after reboot (you can find out how to do that on their wiki pages).
To issue a new certificate, run:
./acme.sh --issue --dns dns_mydevil -d example.com -d *.example.comAfter certificate is ready, you can install it with deploy command.
First you need to login to your Core-Networks account to to set up an API-User. Then export username and password to use these credentials.
export CN_User="user"
export CN_Password="passowrd"Ok, let's issue a cert now:
./acme.sh --issue --dns dns_cn -d example.com -d www.example.comThe CN_User and CN_Password will be saved in ~/.acme.sh/account.conf and will be reused when needed.
If you find any bugs of core-networks.de dns API, please report here: https://github.com/Neilpang/acme.sh/issues/2142
Create an API token in Mijn NederHost.
Set your API key:
export NederHost_Key='xxx'To issue a certificate run:
./acme.sh --issue --dns dns_nederhost -d example.com -d *.example.comIf you find any bugs of NederHost dns API, please report here: https://github.com/Neilpang/acme.sh/issues/2089
First, you'll need to retrive your API key. Estonian insructions https://help.zone.eu/kb/zoneid-api-v2/
export ZONE_Username=yourusername
export ZONE_Key=keygoeshereTo issue a cert run:
./acme.sh --issue -d example.com -d www.example.com --dns dns_zoneZONE_Username and ZONE_Key will be saved in ~/.acme.sh/account.conf and will be reused when needed.
If you find any bugs of zone.eu (zone.ee) dns API, please report here: https://github.com/Neilpang/acme.sh/issues/2146
UltraDNS is a paid for service that provides DNS, as well as Web and Mail forwarding (as well as reporting, auditing, and advanced tools).
More information can be found here: https://www.security.neustar/lp/ultra20/index.html
The REST API documentation for this service is found here: https://portal.ultradns.com/static/docs/REST-API_User_Guide.pdf
Set your UltraDNS User name, and password; these would be the same you would use here:
https://portal.ultradns.com/ - or if you create an API only user, that username and password would be better utilized.
export ULTRA_USR="abcd"
export ULTRA_PWD="efgh"
To issue a cert run:
./acme.sh --issue --dns dns_ultra -d example.com -d www.example.comULTRA_USR and ULTRA_PWD will be saved in ~/.acme.sh/account.conf and will be resued when needed.
Sign up for dynDNS at https://desec.io first.
Set your API token (password) by generating one from your account on desec.io (it's also a good idea to restrict the IPv4 / IPv6 address(es) it can be used from).
export DEDYN_TOKEN=d41d8cd98f00b204e9800998ecf8427eTo issue a certificate run:
./acme.sh --issue --dns dns_desec -d foobar.dedyn.io -d *.foobar.dedyn.ioIf you find any bugs of deSEC.io API, please report here: https://github.com/Neilpang/acme.sh/issues/2180
First, you need to enable API access and retrieve your password hash on https://rcp.openprovider.eu/account/dashboard.php
export OPENPROVIDER_USER='username'
export OPENPROVIDER_PASSWORDHASH='xxx'
./acme.sh --issue --dns dns_openprovider -d example.com -d www.example.comOPENPROVIDER_USER and OPENPROVIDER_PASSWORDHASH will be saved in ~/.acme.sh/account.conf and will be reused when needed.
If you find any bugs of OpenProvider dns API, please report here: https://github.com/Neilpang/acme.sh/issues/2104
Make sure you've configured MaraDNS properly and setup a zone file for your domain. See csv2(5).
Set the path to your zone file, and path to duende's pid file (see, duende(8) or ps -C duende o pid,cmd).
The pid file is used to ask duende to reload the configuration automatically after DNS records are added.
export MARA_ZONE_FILE="/etc/maradns/db.domain.com"
export MARA_DUENDE_PID_PATH="/run/maradns/etc_maradns_mararc.pid"Ensure that the acme.sh process has write access to the zone file and read access to the pid file.
Issuing a certificate:
./acme.sh --issue --dns dns_maradns -d example.com -d '*.example.com'MARA_ZONE_FILE and MARA_DUENDE_PID_PATH will be saved in ~/.acme.sh/account.conf and will be reused when needed.
If you find any bugs of MaraDNS DNS API, please report here: https://github.com/Neilpang/acme.sh/issues/2072
First create an account at https://ddnss.de. After that create a new host record. In the defenition for the host make sure to set the checkbox for "Wildcard" and for "TXT".
Note your Api Key (aka "Update Key") displayed at ddnss.de and export in DDNSS_Token variable
export DDNSS_Token="e4155767few8erwf59353633tz342ce85werddc99432"**Note: Every Cert needs it own Update Key, if you already use the Update Key please generate a new one and export to DDNSS_Token before issue a new Cert. **
After that you can issue a new certificate:
./acme.sh --issue --dns dns_ddnss -d example.comIf you find any bugs of ddnss.de API, please report here: https://github.com/Neilpang/acme.sh/issues/2230
You need to export two variables. Your zonefile which the script will automatically edit:
export Nsd_ZoneFile="/etc/nsd/zones/example.com.zone"And something that calls the nsd-control reload command, either via a script:
export Nsd_Command="/usr/local/bin/sign-and-update.sh example.com"or directly:
export Nsd_Command="sudo nsd-control reload example.com"The variables are saved per-domain, not per-account.
To issue a new certificate, run:
./acme.sh --issue --dns dns_nsd -d example.com -d *.example.comIf you find any bugs of NLnetLabs NSD dns API, please report here: https://github.com/Neilpang/acme.sh/issues/2245