You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

625 lines
16 KiB

9 years ago
8 years ago
8 years ago
8 years ago
8 years ago
8 years ago
8 years ago
7 years ago
7 years ago
8 years ago
8 years ago
8 years ago
8 years ago
8 years ago
8 years ago
7 years ago
8 years ago
  1. # How to use DNS API
  2. ## 1. Use CloudFlare domain API to automatically issue cert
  3. First you need to login to your CloudFlare account to get your API key.
  4. ```
  5. export CF_Key="sdfsdfsdfljlbjkljlkjsdfoiwje"
  6. export CF_Email="xxxx@sss.com"
  7. ```
  8. Ok, let's issue a cert now:
  9. ```
  10. acme.sh --issue --dns dns_cf -d example.com -d www.example.com
  11. ```
  12. The `CF_Key` and `CF_Email` will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
  13. ## 2. Use DNSPod.cn domain API to automatically issue cert
  14. First you need to login to your DNSPod account to get your API Key and ID.
  15. ```
  16. export DP_Id="1234"
  17. export DP_Key="sADDsdasdgdsf"
  18. ```
  19. Ok, let's issue a cert now:
  20. ```
  21. acme.sh --issue --dns dns_dp -d example.com -d www.example.com
  22. ```
  23. The `DP_Id` and `DP_Key` will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
  24. ## 3. Use CloudXNS.com domain API to automatically issue cert
  25. First you need to login to your CloudXNS account to get your API Key and Secret.
  26. ```
  27. export CX_Key="1234"
  28. export CX_Secret="sADDsdasdgdsf"
  29. ```
  30. Ok, let's issue a cert now:
  31. ```
  32. acme.sh --issue --dns dns_cx -d example.com -d www.example.com
  33. ```
  34. The `CX_Key` and `CX_Secret` will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
  35. ## 4. Use GoDaddy.com domain API to automatically issue cert
  36. First you need to login to your GoDaddy account to get your API Key and Secret.
  37. https://developer.godaddy.com/keys/
  38. Please create a Production key, instead of a Test key.
  39. ```
  40. export GD_Key="sdfsdfsdfljlbjkljlkjsdfoiwje"
  41. export GD_Secret="asdfsdafdsfdsfdsfdsfdsafd"
  42. ```
  43. Ok, let's issue a cert now:
  44. ```
  45. acme.sh --issue --dns dns_gd -d example.com -d www.example.com
  46. ```
  47. The `GD_Key` and `GD_Secret` will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
  48. ## 5. Use PowerDNS embedded API to automatically issue cert
  49. First you need to login to your PowerDNS account to enable the API and set your API-Token in the configuration.
  50. https://doc.powerdns.com/md/httpapi/README/
  51. ```
  52. export PDNS_Url="http://ns.example.com:8081"
  53. export PDNS_ServerId="localhost"
  54. export PDNS_Token="0123456789ABCDEF"
  55. export PDNS_Ttl=60
  56. ```
  57. Ok, let's issue a cert now:
  58. ```
  59. acme.sh --issue --dns dns_pdns -d example.com -d www.example.com
  60. ```
  61. The `PDNS_Url`, `PDNS_ServerId`, `PDNS_Token` and `PDNS_Ttl` will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
  62. ## 6. Use OVH/kimsufi/soyoustart/runabove API to automatically issue cert
  63. https://github.com/Neilpang/acme.sh/wiki/How-to-use-OVH-domain-api
  64. ## 7. Use nsupdate to automatically issue cert
  65. First, generate a key for updating the zone
  66. ```
  67. b=$(dnssec-keygen -a hmac-sha512 -b 512 -n USER -K /tmp foo)
  68. cat > /etc/named/keys/update.key <<EOF
  69. key "update" {
  70. algorithm hmac-sha512;
  71. secret "$(awk '/^Key/{print $2}' /tmp/$b.private)";
  72. };
  73. EOF
  74. rm -f /tmp/$b.{private,key}
  75. ```
  76. Include this key in your named configuration
  77. ```
  78. include "/etc/named/keys/update.key";
  79. ```
  80. Next, configure your zone to allow dynamic updates.
  81. Depending on your named version, use either
  82. ```
  83. zone "example.com" {
  84. type master;
  85. allow-update { key "update"; };
  86. };
  87. ```
  88. or
  89. ```
  90. zone "example.com" {
  91. type master;
  92. update-policy {
  93. grant update subdomain example.com.;
  94. };
  95. }
  96. ```
  97. Finally, make the DNS server and update Key available to `acme.sh`
  98. ```
  99. export NSUPDATE_SERVER="dns.example.com"
  100. export NSUPDATE_KEY="/path/to/your/nsupdate.key"
  101. ```
  102. Ok, let's issue a cert now:
  103. ```
  104. acme.sh --issue --dns dns_nsupdate -d example.com -d www.example.com
  105. ```
  106. The `NSUPDATE_SERVER` and `NSUPDATE_KEY` settings will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
  107. ## 8. Use LuaDNS domain API
  108. Get your API token at https://api.luadns.com/settings
  109. ```
  110. export LUA_Key="sdfsdfsdfljlbjkljlkjsdfoiwje"
  111. export LUA_Email="xxxx@sss.com"
  112. ```
  113. To issue a cert:
  114. ```
  115. acme.sh --issue --dns dns_lua -d example.com -d www.example.com
  116. ```
  117. The `LUA_Key` and `LUA_Email` will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
  118. ## 9. Use DNSMadeEasy domain API
  119. Get your API credentials at https://cp.dnsmadeeasy.com/account/info
  120. ```
  121. export ME_Key="sdfsdfsdfljlbjkljlkjsdfoiwje"
  122. export ME_Secret="qdfqsdfkjdskfj"
  123. ```
  124. To issue a cert:
  125. ```
  126. acme.sh --issue --dns dns_me -d example.com -d www.example.com
  127. ```
  128. The `ME_Key` and `ME_Secret` will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
  129. ## 10. Use Amazon Route53 domain API
  130. https://github.com/Neilpang/acme.sh/wiki/How-to-use-Amazon-Route53-API
  131. ```
  132. export AWS_ACCESS_KEY_ID=XXXXXXXXXX
  133. export AWS_SECRET_ACCESS_KEY=XXXXXXXXXXXXXXX
  134. ```
  135. To issue a cert:
  136. ```
  137. acme.sh --issue --dns dns_aws -d example.com -d www.example.com
  138. ```
  139. The `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
  140. ## 11. Use Aliyun domain API to automatically issue cert
  141. First you need to login to your Aliyun account to get your API key.
  142. [https://ak-console.aliyun.com/#/accesskey](https://ak-console.aliyun.com/#/accesskey)
  143. ```
  144. export Ali_Key="sdfsdfsdfljlbjkljlkjsdfoiwje"
  145. export Ali_Secret="jlsdflanljkljlfdsaklkjflsa"
  146. ```
  147. Ok, let's issue a cert now:
  148. ```
  149. acme.sh --issue --dns dns_ali -d example.com -d www.example.com
  150. ```
  151. The `Ali_Key` and `Ali_Secret` will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
  152. ## 12. Use ISPConfig 3.1 API
  153. This only works for ISPConfig 3.1 (and newer).
  154. Create a Remote User in the ISPConfig Control Panel. The Remote User must have access to at least `DNS zone functions` and `DNS txt functions`.
  155. ```
  156. export ISPC_User="xxx"
  157. export ISPC_Password="xxx"
  158. export ISPC_Api="https://ispc.domain.tld:8080/remote/json.php"
  159. export ISPC_Api_Insecure=1
  160. ```
  161. If you have installed ISPConfig on a different port, then alter the 8080 accordingly.
  162. Leaver ISPC_Api_Insecure set to 1 if you have not a valid ssl cert for your installation. Change it to 0 if you have a valid ssl cert.
  163. To issue a cert:
  164. ```
  165. acme.sh --issue --dns dns_ispconfig -d example.com -d www.example.com
  166. ```
  167. The `ISPC_User`, `ISPC_Password`, `ISPC_Api`and `ISPC_Api_Insecure` will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
  168. ## 13. Use Alwaysdata domain API
  169. First you need to login to your Alwaysdata account to get your API Key.
  170. ```sh
  171. export AD_API_KEY="myalwaysdataapikey"
  172. ```
  173. Ok, let's issue a cert now:
  174. ```sh
  175. acme.sh --issue --dns dns_ad -d example.com -d www.example.com
  176. ```
  177. The `AD_API_KEY` will be saved in `~/.acme.sh/account.conf` and will be reused
  178. when needed.
  179. ## 14. Use Linode domain API
  180. First you need to login to your Linode account to get your API Key.
  181. [https://manager.linode.com/profile/api](https://manager.linode.com/profile/api)
  182. Then add an API key with label *ACME* and copy the new key.
  183. ```sh
  184. export LINODE_API_KEY="..."
  185. ```
  186. Due to the reload time of any changes in the DNS records, we have to use the `dnssleep` option to wait at least 15 minutes for the changes to take effect.
  187. Ok, let's issue a cert now:
  188. ```sh
  189. acme.sh --issue --dns dns_linode --dnssleep 900 -d example.com -d www.example.com
  190. ```
  191. The `LINODE_API_KEY` will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
  192. ## 15. Use FreeDNS
  193. FreeDNS (https://freedns.afraid.org/) does not provide an API to update DNS records (other than IPv4 and IPv6
  194. dynamic DNS addresses). The acme.sh plugin therefore retrieves and updates domain TXT records by logging
  195. into the FreeDNS website to read the HTML and posting updates as HTTP. The plugin needs to know your
  196. userid and password for the FreeDNS website.
  197. ```sh
  198. export FREEDNS_User="..."
  199. export FREEDNS_Password="..."
  200. ```
  201. You need only provide this the first time you run the acme.sh client with FreeDNS validation and then again
  202. whenever you change your password at the FreeDNS site. The acme.sh FreeDNS plugin does not store your userid
  203. or password but rather saves an authentication token returned by FreeDNS in `~/.acme.sh/account.conf` and
  204. reuses that when needed.
  205. Now you can issue a certificate.
  206. ```sh
  207. acme.sh --issue --dns dns_freedns -d example.com -d www.example.com
  208. ```
  209. Note that you cannot use acme.sh automatic DNS validation for FreeDNS public domains or for a subdomain that
  210. you create under a FreeDNS public domain. You must own the top level domain in order to automatically
  211. validate with acme.sh at FreeDNS.
  212. ## 16. Use cyon.ch
  213. You only need to set your cyon.ch login credentials.
  214. If you also have 2 Factor Authentication (OTP) enabled, you need to set your secret token too and have `oathtool` installed.
  215. ```
  216. export CY_Username="your_cyon_username"
  217. export CY_Password="your_cyon_password"
  218. export CY_OTP_Secret="your_otp_secret" # Only required if using 2FA
  219. ```
  220. To issue a cert:
  221. ```
  222. acme.sh --issue --dns dns_cyon -d example.com -d www.example.com
  223. ```
  224. The `CY_Username`, `CY_Password` and `CY_OTP_Secret` will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
  225. ## 17. Use Domain-Offensive/Resellerinterface/Domainrobot API
  226. You will need your login credentials (Partner ID+Password) to the Resellerinterface, and export them before you run `acme.sh`:
  227. ```
  228. export DO_PID="KD-1234567"
  229. export DO_PW="cdfkjl3n2"
  230. ```
  231. Ok, let's issue a cert now:
  232. ```
  233. acme.sh --issue --dns dns_do -d example.com -d www.example.com
  234. ```
  235. ## 18. Use Gandi LiveDNS API
  236. You must enable the new Gandi LiveDNS API first and the create your api key, See: http://doc.livedns.gandi.net/
  237. ```
  238. export GANDI_LIVEDNS_KEY="fdmlfsdklmfdkmqsdfk"
  239. ```
  240. Ok, let's issue a cert now:
  241. ```
  242. acme.sh --issue --dns dns_gandi_livedns -d example.com -d www.example.com
  243. ```
  244. ## 19. Use Knot (knsupdate) DNS API to automatically issue cert
  245. First, generate a TSIG key for updating the zone.
  246. ```
  247. keymgr tsig generate acme_key algorithm hmac-sha512 > /etc/knot/acme.key
  248. ```
  249. Include this key in your knot configuration file.
  250. ```
  251. include: /etc/knot/acme.key
  252. ```
  253. Next, configure your zone to allow dynamic updates.
  254. Dynamic updates for the zone are allowed via proper ACL rule with the `update` action. For in-depth instructions, please see [Knot DNS's documentation](https://www.knot-dns.cz/documentation/).
  255. ```
  256. acl:
  257. - id: acme_acl
  258. address: 192.168.1.0/24
  259. key: acme_key
  260. action: update
  261. zone:
  262. - domain: example.com
  263. file: example.com.zone
  264. acl: acme_acl
  265. ```
  266. Finally, make the DNS server and TSIG Key available to `acme.sh`
  267. ```
  268. export KNOT_SERVER="dns.example.com"
  269. export KNOT_KEY=`grep \# /etc/knot/acme.key | cut -d' ' -f2`
  270. ```
  271. Ok, let's issue a cert now:
  272. ```
  273. acme.sh --issue --dns dns_knot -d example.com -d www.example.com
  274. ```
  275. The `KNOT_SERVER` and `KNOT_KEY` settings will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
  276. ## 20. Use DigitalOcean API (native)
  277. You need to obtain a read and write capable API key from your DigitalOcean account. See: https://www.digitalocean.com/help/api/
  278. ```
  279. export DO_API_KEY="75310dc4ca779ac39a19f6355db573b49ce92ae126553ebd61ac3a3ae34834cc"
  280. ```
  281. Ok, let's issue a cert now:
  282. ```
  283. acme.sh --issue --dns dns_dgon -d example.com -d www.example.com
  284. ```
  285. ## 21. Use ClouDNS.net API
  286. You need to set the HTTP API user ID and password credentials. See: https://www.cloudns.net/wiki/article/42/
  287. ```
  288. export CLOUDNS_AUTH_ID=XXXXX
  289. export CLOUDNS_AUTH_PASSWORD="YYYYYYYYY"
  290. ```
  291. Ok, let's issue a cert now:
  292. ```
  293. acme.sh --issue --dns dns_cloudns -d example.com -d www.example.com
  294. ```
  295. The `CLOUDNS_AUTH_ID` and `CLOUDNS_AUTH_PASSWORD` will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
  296. ## 22. Use Infoblox API
  297. First you need to create/obtain API credentials on your Infoblox appliance.
  298. ```
  299. export Infoblox_Creds="username:password"
  300. export Infoblox_Server="ip or fqdn of infoblox appliance"
  301. ```
  302. Ok, let's issue a cert now:
  303. ```
  304. acme.sh --issue --dns dns_infoblox -d example.com -d www.example.com
  305. ```
  306. Note: This script will automatically create and delete the ephemeral txt record.
  307. The `Infoblox_Creds` and `Infoblox_Server` will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
  308. ## 23. Use VSCALE API
  309. First you need to create/obtain API tokens on your [settings panel](https://vscale.io/panel/settings/tokens/).
  310. ```
  311. VSCALE_API_KEY="sdfsdfsdfljlbjkljlkjsdfoiwje"
  312. ```
  313. Ok, let's issue a cert now:
  314. ```
  315. acme.sh --issue --dns dns_vscale -d example.com -d www.example.com
  316. ```
  317. ## 24. Use Dynu API
  318. First you need to create/obtain API credentials from your Dynu account. See: https://www.dynu.com/resources/api/documentation
  319. ```
  320. export Dynu_ClientId="xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
  321. export Dynu_Secret="yyyyyyyyyyyyyyyyyyyyyyyyy"
  322. ```
  323. Ok, let's issue a cert now:
  324. ```
  325. acme.sh --issue --dns dns_dynu -d example.com -d www.example.com
  326. ```
  327. The `Dynu_ClientId` and `Dynu_Secret` will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
  328. ## 25. Use DNSimple API
  329. First you need to login to your DNSimple account and generate a new oauth token.
  330. https://dnsimple.com/a/{your account id}/account/access_tokens
  331. Note that this is an _account_ token and not a user token. The account token is
  332. needed to infer the `account_id` used in requests. A user token will not be able
  333. to determine the correct account to use.
  334. ```
  335. export DNSimple_OAUTH_TOKEN="sdfsdfsdfljlbjkljlkjsdfoiwje"
  336. ```
  337. To issue the cert just specify the `dns_dnsimple` API.
  338. ```
  339. acme.sh --issue --dns dns_dnsimple -d example.com
  340. ```
  341. The `DNSimple_OAUTH_TOKEN` will be saved in `~/.acme.sh/account.conf` and will
  342. be reused when needed.
  343. If you have any issues with this integration please report them to
  344. https://github.com/pho3nixf1re/acme.sh/issues.
  345. ## 26. Use NS1.com API
  346. ```
  347. export NS1_Key="fdmlfsdklmfdkmqsdfk"
  348. ```
  349. Ok, let's issue a cert now:
  350. ```
  351. acme.sh --issue --dns dns_nsone -d example.com -d www.example.com
  352. ```
  353. ## 27. Use DuckDNS.org API
  354. ```
  355. export DuckDNS_Token="aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee"
  356. ```
  357. Please note that since DuckDNS uses StartSSL as their cert provider, thus
  358. --insecure may need to be used when issuing certs:
  359. ```
  360. acme.sh --insecure --issue --dns dns_duckdns -d mydomain.duckdns.org
  361. ```
  362. For issues, please report to https://github.com/raidenii/acme.sh/issues.
  363. ## 28. Use Name.com API
  364. You'll need to fill out the form at https://www.name.com/reseller/apply to apply
  365. for API username and token.
  366. ```
  367. export Namecom_Username="testuser"
  368. export Namecom_Token="xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
  369. ```
  370. And now you can issue certs with:
  371. ```
  372. acme.sh --issue --dns dns_namecom -d example.com -d www.example.com
  373. ```
  374. For issues, please report to https://github.com/raidenii/acme.sh/issues.
  375. ## 29. Use Dyn Managed DNS API to automatically issue cert
  376. First, login to your Dyn Managed DNS account: https://portal.dynect.net/login/
  377. It is recommended to add a new user specific for API access.
  378. The minimum "Zones & Records Permissions" required are:
  379. ```
  380. RecordAdd
  381. RecordUpdate
  382. RecordDelete
  383. RecordGet
  384. ZoneGet
  385. ZoneAddNode
  386. ZoneRemoveNode
  387. ZonePublish
  388. ```
  389. Pass the API user credentials to the environment:
  390. ```
  391. export DYN_Customer="customer"
  392. export DYN_Username="apiuser"
  393. export DYN_Password="secret"
  394. ```
  395. Ok, let's issue a cert now:
  396. ```
  397. acme.sh --issue --dns dns_dyn -d example.com -d www.example.com
  398. ```
  399. The `DYN_Customer`, `DYN_Username` and `DYN_Password` will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
  400. ## 30. Use pdd.yandex.ru API
  401. ```
  402. export PDD_Token="xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
  403. ```
  404. Follow these instructions to get the token for your domain https://tech.yandex.com/domain/doc/concepts/access-docpage/
  405. ```
  406. acme.sh --issue --dns dns_yandex -d mydomain.example.org
  407. ```
  408. For issues, please report to https://github.com/non7top/acme.sh/issues.
  409. ## 31. Use Hurricane Electric
  410. Hurricane Electric doesn't have an API so just set your login credentials like so:
  411. ```
  412. export HE_Username="yourusername"
  413. export HE_Password="password"
  414. ```
  415. Then you can issue your certificate:
  416. ```
  417. acme.sh --issue --dns dns_he -d example.com -d www.example.com
  418. ```
  419. The `HE_Username` and `HE_Password` settings will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
  420. Please report any issues to https://github.com/angel333/acme.sh or to <me@ondrejsimek.com>.
  421. # Use custom API
  422. If your API is not supported yet, you can write your own DNS API.
  423. Let's assume you want to name it 'myapi':
  424. 1. Create a bash script named `~/.acme.sh/dns_myapi.sh`,
  425. 2. In the script you must have a function named `dns_myapi_add()` which will be called by acme.sh to add the DNS records.
  426. 3. Then you can use your API to issue cert like this:
  427. ```
  428. acme.sh --issue --dns dns_myapi -d example.com -d www.example.com
  429. ```
  430. For more details, please check our sample script: [dns_myapi.sh](dns_myapi.sh)
  431. See: https://github.com/Neilpang/acme.sh/wiki/DNS-API-Dev-Guide
  432. # Use lexicon DNS API
  433. https://github.com/Neilpang/acme.sh/wiki/How-to-use-lexicon-dns-api