diff --git a/deploy/README.md b/deploy/README.md index 0b820dff..5d34f671 100644 --- a/deploy/README.md +++ b/deploy/README.md @@ -1,257 +1,267 @@ -# Using deploy api +Using the deploy API +==================== -Before you can deploy your cert, you must [issue the cert first](https://github.com/Neilpang/acme.sh/wiki/How-to-issue-a-cert). +Before you can deploy your cert, you must [issue the cert first]. -Here are the scripts to deploy the certs/key to the server/services. +[issue the cert first]: https://github.com/Neilpang/acme.sh/wiki/How-to-issue-a-cert -## 1. Deploy the certs to your cpanel host +Here are the scripts to deploy the certs/key to the server/services: -If you want to deploy using cpanel UAPI see 7. +1. [Deploy the certs to your cpanel host](#deploy-the-certs-to-your-cpanel-host) +2. [Deploy ssl cert on kong proxy engine based on API](#deploy-ssl-cert-on-kong-proxy-engine-based-on-api) +3. [Deploy the cert to remote server through SSH access](#deploy-the-cert-to-remote-server-through-ssh-access) +4. [Deploy the cert to local vsftpd server](#deploy-the-cert-to-local-vsftpd-server) +5. [Deploy the cert to local exim4 server](#deploy-the-cert-to-local-exim4-server) +6. [Deploy the cert to OSX Keychain](#deploy-the-cert-to-osx-keychain) +7. [Deploy to cpanel host using UAPI](#deploy-to-cpanel-host-using-uapi) +8. [Deploy the cert to your FRITZ!Box router](#deploy-the-cert-to-your-fritzbox-router) +9. [Deploy the cert to strongSwan](#deploy-the-cert-to-strongswan) -(cpanel deploy hook is not finished yet, this is just an example.) +------------------------------------------------------------------------ + +Deploy the certs to your cpanel host +------------------------------------ +If you want to deploy using cpanel UAPI see +[Deploy to cpanel host using UAPI]. +(cpanel deploy hook is not finished yet, this is just an example.) -Then you can deploy now: +Then you can deploy: -```sh -export DEPLOY_CPANEL_USER=myusername -export DEPLOY_CPANEL_PASSWORD=PASSWORD -acme.sh --deploy -d example.com --deploy-hook cpanel -``` + export DEPLOY_CPANEL_USER=myusername + export DEPLOY_CPANEL_PASSWORD=PASSWORD + acme.sh --deploy -d example.com --deploy-hook cpanel -## 2. Deploy ssl cert on kong proxy engine based on api +Deploy ssl cert on kong proxy engine based on API +------------------------------------------------- -Before you can deploy your cert, you must [issue the cert first](https://github.com/Neilpang/acme.sh/wiki/How-to-issue-a-cert). +Before you can deploy your cert, you must [issue the cert first]. Currently supports Kong-v0.10.x. -```sh -acme.sh --deploy -d ftp.example.com --deploy-hook kong -``` -## 3. Deploy the cert to remote server through SSH access + acme.sh --deploy -d ftp.example.com --deploy-hook kong + +Deploy the cert to remote server through SSH access +--------------------------------------------------- The ssh deploy plugin allows you to deploy certificates to a remote host -using SSH command to connect to the remote server. The ssh plugin is invoked -with the following command... +using SSH command to connect to the remote server. The ssh plugin is +invoked with the following command: + + acme.sh --deploy -d example.com --deploy-hook ssh -```sh -acme.sh --deploy -d example.com --deploy-hook ssh -``` Prior to running this for the first time you must tell the plugin where -and how to deploy the certificates. This is done by exporting the following -environment variables. This is not required for subsequent runs as the -values are stored by acme.sh in the domain configuration files. - -Required... -``` -export DEPLOY_SSH_USER=username -``` -Optional... -``` -export DEPLOY_SSH_CMD=custom ssh command -export DEPLOY_SSH_SERVER=url or ip address of remote host -export DEPLOY_SSH_KEYFILE=filename for private key -export DEPLOY_SSH_CERTFILE=filename for certificate file -export DEPLOY_SSH_CAFILE=filename for intermediate CA file -export DEPLOY_SSH_FULLCHAIN=filename for fullchain file -export DEPLOY_SSH_REMOTE_CMD=command to execute on remote host -export DEPLOY_SSH_BACKUP=yes or no -``` - -**DEPLOY_SSH_USER** -Username at the remote host that SSH will login with. Note that -SSH must be able to login to remote host without a password... SSH Keys -must have been exchanged with the remote host. Validate and test that you -can login to USER@URL from the host running acme.sh before using this script. - -The USER@URL at the remote server must also have has permissions to write to -the target location of the certificate files and to execute any commands -(e.g. to stop/start services). - -**DEPLOY_SSH_CMD** -You can customize the ssh command used to connect to the remote host. For example -if you need to connect to a specific port at the remote server you can set this -to, for example, "ssh -p 22" or to use `sshpass` to provide password inline -instead of exchanging ssh keys (this is not recommended, using keys is -more secure). - -**DEPLOY_SSH_SERVER** +and how to deploy the certificates. This is done by exporting the +following environment variables. This is not required for subsequent +runs as the values are stored by acme.sh in the domain configuration +files. + +Required: + + export DEPLOY_SSH_USER=username + +Optional: + + export DEPLOY_SSH_CMD=custom ssh command + export DEPLOY_SSH_SERVER=url or ip address of remote host + export DEPLOY_SSH_KEYFILE=filename for private key + export DEPLOY_SSH_CERTFILE=filename for certificate file + export DEPLOY_SSH_CAFILE=filename for intermediate CA file + export DEPLOY_SSH_FULLCHAIN=filename for fullchain file + export DEPLOY_SSH_REMOTE_CMD=command to execute on remote host + export DEPLOY_SSH_BACKUP=yes or no + +`DEPLOY_SSH_USER` +Username at the remote host that SSH will login with. Note that SSH +must be able to login to remote host without a password. SSH Keys must +have been exchanged with the remote host. Validate and test that you +can login to `USER@URL` from the host running acme.sh before using this +script. + +The `USER@URL` at the remote server must also have has permissions to +write to the target location of the certificate files and to execute any +commands (e.g. to stop/start services). + +`DEPLOY_SSH_CMD` +You can customize the ssh command used to connect to the remote host. +For example if you need to connect to a specific port at the remote +server you can set this to, for example, "ssh -p 22" or to use `sshpass` +to provide password inline instead of exchanging ssh keys (this is not +recommended, using keys is more secure). + +`DEPLOY_SSH_SERVER` URL or IP Address of the remote server. If not provided then the domain name provided on the acme.sh --deploy command line is used. -**DEPLOY_SSH_KEYFILE** -Target filename for the private key issued by LetsEncrypt. +`DEPLOY_SSH_KEYFILE` +Target filename for the private key issued by Let's Encrypt. -**DEPLOY_SSH_CERTFILE** -Target filename for the certificate issued by LetsEncrypt. -If this is the same as the previous filename (for keyfile) then it is -appended to the same file. +`DEPLOY_SSH_CERTFILE` +Target filename for the certificate issued by Let's Encrypt. If this is +the same as the previous filename (for keyfile) then it is appended to +the same file. -**DEPLOY_SSH_CAFILE** -Target filename for the CA intermediate certificate issued by LetsEncrypt. -If this is the same as a previous filename (for keyfile or certfile) then -it is appended to the same file. +`DEPLOY_SSH_CAFILE` +Target filename for the CA intermediate certificate issued by Let's +Encrypt. If this is the same as a previous filename (for keyfile or +certfile) then it is appended to the same file. -**DEPLOY_SSH_FULLCHAIN** -Target filename for the fullchain certificate issued by LetsEncrypt. +`DEPLOY_SSH_FULLCHAIN` +Target filename for the fullchain certificate issued by Let's Encrypt. If this is the same as a previous filename (for keyfile, certfile or cafile) then it is appended to the same file. -**DEPLOY_SSH_REMOTE_CMD** -Command to execute on the remote server after copying any certificates. This -could be any additional command required for example to stop and restart -the service. +`DEPLOY_SSH_REMOTE_CMD` +Command to execute on the remote server after copying any certificates. +This could be any additional command required for example to stop and +restart the service. -**DEPLOY_SSH_BACKUP** +`DEPLOY_SSH_BACKUP` Before writing a certificate file to the remote server the existing certificate will be copied to a backup directory on the remote server. These are placed in a hidden directory in the home directory of the SSH user -```sh -~/.acme_ssh_deploy/[domain name]-backup-[timestamp] -``` + + ~/.acme_ssh_deploy/[domain name]-backup-[timestamp] + Any backups older than 180 days will be deleted when new certificates are deployed. This defaults to "yes" set to "no" to disable backup. -###Examples using SSH deploy +### Examples using SSH deploy + The following example illustrates deploying certificates to a QNAP NAS (tested with QTS version 4.2.3) -```sh -export DEPLOY_SSH_USER="admin" -export DEPLOY_SSH_KEYFILE="/etc/stunnel/stunnel.pem" -export DEPLOY_SSH_CERTFILE="/etc/stunnel/stunnel.pem" -export DEPLOY_SSH_CAFILE="/etc/stunnel/uca.pem" -export DEPLOY_SSH_REMOTE_CMD="/etc/init.d/stunnel.sh restart" + export DEPLOY_SSH_USER="admin" + export DEPLOY_SSH_KEYFILE="/etc/stunnel/stunnel.pem" + export DEPLOY_SSH_CERTFILE="/etc/stunnel/stunnel.pem" + export DEPLOY_SSH_CAFILE="/etc/stunnel/uca.pem" + export DEPLOY_SSH_REMOTE_CMD="/etc/init.d/stunnel.sh restart" + + acme.sh --deploy -d qnap.example.com --deploy-hook ssh -acme.sh --deploy -d qnap.example.com --deploy-hook ssh -``` Note how in this example both the private key and certificate point to -the same file. This will result in the certificate being appended -to the same file as the private key... a common requirement of several +the same file. This will result in the certificate being appended to +the same file as the private key, a common requirement of several services. -The next example illustrates deploying certificates to a Unifi +The next example illustrates deploying certificates to a UniFi Controller (tested with version 5.4.11). -```sh -export DEPLOY_SSH_USER="root" -export DEPLOY_SSH_KEYFILE="/var/lib/unifi/unifi.example.com.key" -export DEPLOY_SSH_FULLCHAIN="/var/lib/unifi/unifi.example.com.cer" -export DEPLOY_SSH_REMOTE_CMD="openssl pkcs12 -export \ - -inkey /var/lib/unifi/unifi.example.com.key \ - -in /var/lib/unifi/unifi.example.com.cer \ - -out /var/lib/unifi/unifi.example.com.p12 \ - -name ubnt -password pass:temppass \ - && keytool -importkeystore -deststorepass aircontrolenterprise \ - -destkeypass aircontrolenterprise \ - -destkeystore /var/lib/unifi/keystore \ - -srckeystore /var/lib/unifi/unifi.example.com.p12 \ - -srcstoretype PKCS12 -srcstorepass temppass -alias ubnt -noprompt \ - && service unifi restart" + export DEPLOY_SSH_USER="root" + export DEPLOY_SSH_KEYFILE="/var/lib/unifi/unifi.example.com.key" + export DEPLOY_SSH_FULLCHAIN="/var/lib/unifi/unifi.example.com.cer" + export DEPLOY_SSH_REMOTE_CMD="openssl pkcs12 -export \ + -inkey /var/lib/unifi/unifi.example.com.key \ + -in /var/lib/unifi/unifi.example.com.cer \ + -out /var/lib/unifi/unifi.example.com.p12 \ + -name ubnt -password pass:temppass \ + && keytool -importkeystore -deststorepass aircontrolenterprise \ + -destkeypass aircontrolenterprise \ + -destkeystore /var/lib/unifi/keystore \ + -srckeystore /var/lib/unifi/unifi.example.com.p12 \ + -srcstoretype PKCS12 -srcstorepass temppass -alias ubnt -noprompt \ + && service unifi restart" + + acme.sh --deploy -d unifi.example.com --deploy-hook ssh + +In this example we execute several commands on the remote host after the +certificate files have been copied to generate a pkcs12 file compatible +with UniFi, to import it into the UniFi keystore and then finally to +restart the service. -acme.sh --deploy -d unifi.example.com --deploy-hook ssh -``` -In this example we execute several commands on the remote host -after the certificate files have been copied... to generate a pkcs12 file -compatible with Unifi, to import it into the Unifi keystore and then finally -to restart the service. +Note also that once the certificate is imported into the keystore the +individual certificate files are no longer required. We could if we +desired delete those files immediately. If we do that then we should +disable backup at the remote host (as there are no files to backup -- +they were erased during deployment). For example: -Note also that once the certificate is imported -into the keystore the individual certificate files are no longer -required. We could if we desired delete those files immediately. If we -do that then we should disable backup at the remote host (as there are -no files to backup -- they were erased during deployment). For example... -```sh -export DEPLOY_SSH_BACKUP=no -# modify the end of the remote command... -&& rm /var/lib/unifi/unifi.example.com.key \ - /var/lib/unifi/unifi.example.com.cer \ - /var/lib/unifi/unifi.example.com.p12 \ -&& service unifi restart -``` + export DEPLOY_SSH_BACKUP=no + # modify the end of the remote command... + && rm /var/lib/unifi/unifi.example.com.key \ + /var/lib/unifi/unifi.example.com.cer \ + /var/lib/unifi/unifi.example.com.p12 \ + && service unifi restart -## 4. Deploy the cert to local vsftpd server +Deploy the cert to local vsftpd server +-------------------------------------- -```sh -acme.sh --deploy -d ftp.example.com --deploy-hook vsftpd -``` + acme.sh --deploy -d ftp.example.com --deploy-hook vsftpd -The default vsftpd conf file is `/etc/vsftpd.conf`, if your vsftpd conf is not in the default location, you can specify one: +The default vsftpd conf file is `/etc/vsftpd.conf`, if your vsftpd conf +is not in the default location, you can specify one: -```sh -export DEPLOY_VSFTPD_CONF="/etc/vsftpd.conf" + export DEPLOY_VSFTPD_CONF="/etc/vsftpd.conf" -acme.sh --deploy -d ftp.example.com --deploy-hook vsftpd -``` + acme.sh --deploy -d ftp.example.com --deploy-hook vsftpd -The default command to restart vsftpd server is `service vsftpd restart`, if it doesn't work, you can specify one: +The default command to restart vsftpd server is `service vsftpd +restart`, if it doesn't work, you can specify one: -```sh -export DEPLOY_VSFTPD_RELOAD="/etc/init.d/vsftpd restart" + export DEPLOY_VSFTPD_RELOAD="/etc/init.d/vsftpd restart" -acme.sh --deploy -d ftp.example.com --deploy-hook vsftpd -``` + acme.sh --deploy -d ftp.example.com --deploy-hook vsftpd -## 5. Deploy the cert to local exim4 server +Deploy the cert to local exim4 server +------------------------------------- -```sh -acme.sh --deploy -d ftp.example.com --deploy-hook exim4 -``` + acme.sh --deploy -d ftp.example.com --deploy-hook exim4 -The default exim4 conf file is `/etc/exim/exim.conf`, if your exim4 conf is not in the default location, you can specify one: +The default exim4 conf file is `/etc/exim/exim.conf`, if your exim4 conf +is not in the default location, you can specify one: -```sh -export DEPLOY_EXIM4_CONF="/etc/exim4/exim4.conf.template" + export DEPLOY_EXIM4_CONF="/etc/exim4/exim4.conf.template" -acme.sh --deploy -d ftp.example.com --deploy-hook exim4 -``` + acme.sh --deploy -d ftp.example.com --deploy-hook exim4 -The default command to restart exim4 server is `service exim4 restart`, if it doesn't work, you can specify one: +The default command to restart exim4 server is `service exim4 restart`, +if it doesn't work, you can specify one: -```sh -export DEPLOY_EXIM4_RELOAD="/etc/init.d/exim4 restart" + export DEPLOY_EXIM4_RELOAD="/etc/init.d/exim4 restart" -acme.sh --deploy -d ftp.example.com --deploy-hook exim4 -``` + acme.sh --deploy -d ftp.example.com --deploy-hook exim4 -## 6. Deploy the cert to OSX Keychain +Deploy the cert to OSX Keychain +------------------------------- -```sh -acme.sh --deploy -d ftp.example.com --deploy-hook keychain -``` + acme.sh --deploy -d ftp.example.com --deploy-hook keychain -## 7. Deploy to cpanel host using UAPI +Deploy to cpanel host using UAPI +-------------------------------- This hook is using UAPI and works in cPanel & WHM version 56 or newer. -``` -acme.sh --deploy -d example.com --deploy-hook cpanel_uapi -``` -DEPLOY_CPANEL_USER is required only if you run the script as root and it should contain cpanel username. -```sh -export DEPLOY_CPANEL_USER=username -acme.sh --deploy -d example.com --deploy-hook cpanel_uapi -``` -Please note, that the cpanel_uapi hook will deploy only the first domain when your certificate will automatically renew. Therefore you should issue a separate certificate for each domain. - -## 8. Deploy the cert to your FRITZ!Box router - -You must specify the credentials that have administrative privileges on the FRITZ!Box in order to deploy the certificate, plus the URL of your FRITZ!Box, through the following environment variables: -```sh -$ export DEPLOY_FRITZBOX_USERNAME=my_username -$ export DEPLOY_FRITZBOX_PASSWORD=the_password -$ export DEPLOY_FRITZBOX_URL=https://fritzbox.example.com -``` - -After the first deployment, these values will be stored in your $HOME/.acme.sh/account.conf. You may now deploy the certificate like this: - -```sh -acme.sh --deploy -d fritzbox.example.com --deploy-hook fritzbox -``` - -## 9. Deploy the cert to strongswan - -```sh -acme.sh --deploy -d ftp.example.com --deploy-hook strongswan -``` + + acme.sh --deploy -d example.com --deploy-hook cpanel_uapi + +`DEPLOY_CPANEL_USER` is required only if you run the script as root and +it should contain cpanel username. + + export DEPLOY_CPANEL_USER=username + acme.sh --deploy -d example.com --deploy-hook cpanel_uapi + +Please note, that the `cpanel_uapi` hook will deploy only the first +domain when your certificate will automatically renew. Therefore you +should issue a separate certificate for each domain. + +Deploy the cert to your FRITZ!Box router +---------------------------------------- + +You must specify the credentials that have administrative privileges on +the FRITZ!Box in order to deploy the certificate, plus the URL of your +FRITZ!Box, through the following environment variables: + + export DEPLOY_FRITZBOX_USERNAME=my_username + export DEPLOY_FRITZBOX_PASSWORD=the_password + export DEPLOY_FRITZBOX_URL=https://fritzbox.example.com + +After the first deployment, these values will be stored in your +`$HOME/.acme.sh/account.conf`. You may now deploy the certificate like +this: + + acme.sh --deploy -d fritzbox.example.com --deploy-hook fritzbox + +Deploy the cert to strongSwan +----------------------------- + + acme.sh --deploy -d ftp.example.com --deploy-hook strongswan diff --git a/dnsapi/README.md b/dnsapi/README.md index a90b3f75..88e6286a 100644 --- a/dnsapi/README.md +++ b/dnsapi/README.md @@ -1,883 +1,960 @@ -# How to use DNS API +How to use DNS API +================== + +1. [Use CloudFlare domain API to automatically issue cert](#use-cloudflare-domain-api-to-automatically-issue-cert) +2. [Use DNSPod.cn domain API to automatically issue cert](#use-dnspodcn-domain-api-to-automatically-issue-cert) +3. [Use CloudXNS.com domain API to automatically issue cert](#use-cloudxnscom-domain-api-to-automatically-issue-cert) +4. [Use GoDaddy.com domain API to automatically issue cert](#use-godaddycom-domain-api-to-automatically-issue-cert) +5. [Use PowerDNS embedded API to automatically issue cert](#use-powerdns-embedded-api-to-automatically-issue-cert) +6. [Use OVH/kimsufi/soyoustart/runabove API to automatically issue cert](#use-ovhkimsufisoyoustartrunabove-api-to-automatically-issue-cert) +7. [Use nsupdate to automatically issue cert](#use-nsupdate-to-automatically-issue-cert) +8. [Use LuaDNS domain API](#use-luadns-domain-api) +9. [Use DNSMadeEasy domain API](#use-dnsmadeeasy-domain-api) +10. [Use Amazon Route53 domain API](#use-amazon-route53-domain-api) +11. [Use Aliyun domain API to automatically issue cert](#use-aliyun-domain-api-to-automatically-issue-cert) +12. [Use ISPConfig 3.1 API](#use-ispconfig-31-api) +13. [Use Alwaysdata domain API](#use-alwaysdata-domain-api) +14. [Use Linode domain API](#use-linode-domain-api) +15. [Use FreeDNS](#use-freedns) +16. [Use cyon.ch](#use-cyonch) +17. [Use Domain-Offensive/Resellerinterface/Domainrobot API](#use-domain-offensiveresellerinterfacedomainrobot-api) +18. [Use Gandi LiveDNS API](#use-gandi-livedns-api) +19. [Use Knot (knsupdate) DNS API to automatically issue cert](#use-knot-knsupdate-dns-api-to-automatically-issue-cert) +20. [Use DigitalOcean API (native)](#use-digitalocean-api-native) +21. [Use ClouDNS.net API](#use-cloudnsnet-api) +22. [Use Infoblox API](#use-infoblox-api) +23. [Use VSCALE API](#use-vscale-api) +24. [Use Dynu API](#use-dynu-api) +25. [Use DNSimple API](#use-dnsimple-api) +26. [Use NS1.com API](#use-ns1com-api) +27. [Use DuckDNS.org API](#use-duckdnsorg-api) +28. [Use Name.com API](#use-namecom-api) +29. [Use Dyn Managed DNS API to automatically issue cert](#use-dyn-managed-dns-api-to-automatically-issue-cert) +30. [Use pdd.yandex.ru API](#use-pddyandexru-api) +31. [Use Hurricane Electric](#use-hurricane-electric) +32. [Use UnoEuro API to automatically issue cert](#use-unoeuro-api-to-automatically-issue-cert) +33. [Use INWX](#use-inwx) +34. [Use Servercow API v1](#use-servercow-api-v1) +35. [Use Namesilo.com API](#use-namesilocom-api) +36. [Use autoDNS (InternetX)](#use-autodns-internetx) +37. [Use Azure DNS](#use-azure-dns) +38. [Use selectel.com (selectel.ru) domain API to automatically issue cert](#use-selectelcom-selectelru-domain-api-to-automatically-issue-cert) +39. [Use zonomi.com domain API to automatically issue cert](#use-zonomicom-domain-api-to-automatically-issue-cert) +40. [Use DreamHost DNS API](#use-dreamhost-dns-api) +41. [Use DirectAdmin API](#use-directadmin-api) +42. [Use KingHost DNS API](#use-kinghost-dns-api) +43. [Use Zilore DNS API](#use-zilore-dns-api) +44. [Use Loopia.se API](#use-loopiase-api) +45. [Use ACME DNS API](#use-acme-dns-api) + + +Use a custom API +================ -## 1. Use CloudFlare domain API to automatically issue cert +If your API is not supported yet, you can write your own DNS API. + +Let's assume you want to name it `myapi`: + +1. Create a bash script named `~/.acme.sh/dns_myapi.sh`. + +2. In the script, you must have a function named `dns_myapi_add()` + which will be called by acme.sh to add the DNS records. + +3. Then you can use your API to issue cert like this: + + acme.sh --issue --dns dns_myapi -d example.com -d www.example.com + +For more details, please check our sample script: [dns_myapi.sh](dns_myapi.sh) + +See: https://github.com/Neilpang/acme.sh/wiki/DNS-API-Dev-Guide + +Use lexicon DNS API +=================== + +https://github.com/Neilpang/acme.sh/wiki/How-to-use-lexicon-dns-api + +------------------------------------------------------------------------ + + +Use CloudFlare domain API to automatically issue cert +----------------------------------------------------- First you need to login to your CloudFlare account to get your API key. -``` -export CF_Key="sdfsdfsdfljlbjkljlkjsdfoiwje" -export CF_Email="xxxx@sss.com" -``` + export CF_Key="sdfsdfsdfljlbjkljlkjsdfoiwje" + export CF_Email="xxxx@sss.com" + +OK, let's issue a cert now: + + acme.sh --issue --dns dns_cf -d example.com -d www.example.com -Ok, let's issue a cert now: -``` -acme.sh --issue --dns dns_cf -d example.com -d www.example.com -``` +The `CF_Key` and `CF_Email` will be saved in `~/.acme.sh/account.conf` +and will be reused when needed. -The `CF_Key` and `CF_Email` will be saved in `~/.acme.sh/account.conf` and will be reused when needed. +Use DNSPod.cn domain API to automatically issue cert +---------------------------------------------------- -## 2. Use DNSPod.cn domain API to automatically issue cert +First you need to login to your DNSPod account to get your API Key and +ID. -First you need to login to your DNSPod account to get your API Key and ID. + export DP_Id="1234" + export DP_Key="sADDsdasdgdsf" -``` -export DP_Id="1234" -export DP_Key="sADDsdasdgdsf" -``` +OK, let's issue a cert now: -Ok, let's issue a cert now: -``` -acme.sh --issue --dns dns_dp -d example.com -d www.example.com -``` + acme.sh --issue --dns dns_dp -d example.com -d www.example.com -The `DP_Id` and `DP_Key` will be saved in `~/.acme.sh/account.conf` and will be reused when needed. +The `DP_Id` and `DP_Key` will be saved in `~/.acme.sh/account.conf` and +will be reused when needed. -## 3. Use CloudXNS.com domain API to automatically issue cert +Use CloudXNS.com domain API to automatically issue cert +------------------------------------------------------- -First you need to login to your CloudXNS account to get your API Key and Secret. +First you need to login to your CloudXNS account to get your API Key and +Secret. -``` -export CX_Key="1234" -export CX_Secret="sADDsdasdgdsf" -``` + export CX_Key="1234" + export CX_Secret="sADDsdasdgdsf" -Ok, let's issue a cert now: -``` -acme.sh --issue --dns dns_cx -d example.com -d www.example.com -``` +OK, let's issue a cert now: -The `CX_Key` and `CX_Secret` will be saved in `~/.acme.sh/account.conf` and will be reused when needed. + acme.sh --issue --dns dns_cx -d example.com -d www.example.com +The `CX_Key` and `CX_Secret` will be saved in `~/.acme.sh/account.conf` +and will be reused when needed. -## 4. Use GoDaddy.com domain API to automatically issue cert -First you need to login to your GoDaddy account to get your API Key and Secret. +Use GoDaddy.com domain API to automatically issue cert +------------------------------------------------------ + +First you need to login to your GoDaddy account to get your API Key and +Secret. https://developer.godaddy.com/keys/ Please create a Production key, instead of a Test key. -``` -export GD_Key="sdfsdfsdfljlbjkljlkjsdfoiwje" -export GD_Secret="asdfsdafdsfdsfdsfdsfdsafd" -``` + export GD_Key="sdfsdfsdfljlbjkljlkjsdfoiwje" + export GD_Secret="asdfsdafdsfdsfdsfdsfdsafd" + +OK, let's issue a cert now: -Ok, let's issue a cert now: -``` -acme.sh --issue --dns dns_gd -d example.com -d www.example.com -``` + acme.sh --issue --dns dns_gd -d example.com -d www.example.com -The `GD_Key` and `GD_Secret` will be saved in `~/.acme.sh/account.conf` and will be reused when needed. +The `GD_Key` and `GD_Secret` will be saved in `~/.acme.sh/account.conf` +and will be reused when needed. -## 5. Use PowerDNS embedded API to automatically issue cert +Use PowerDNS embedded API to automatically issue cert +----------------------------------------------------- -First you need to login to your PowerDNS account to enable the API and set your API-Token in the configuration. +First you need to login to your PowerDNS account to enable the API and +set your API-Token in the configuration. https://doc.powerdns.com/md/httpapi/README/ -``` -export PDNS_Url="http://ns.example.com:8081" -export PDNS_ServerId="localhost" -export PDNS_Token="0123456789ABCDEF" -export PDNS_Ttl=60 -``` + export PDNS_Url="http://ns.example.com:8081" + export PDNS_ServerId="localhost" + export PDNS_Token="0123456789ABCDEF" + export PDNS_Ttl=60 + +OK, let's issue a cert now: -Ok, let's issue a cert now: -``` -acme.sh --issue --dns dns_pdns -d example.com -d www.example.com -``` + acme.sh --issue --dns dns_pdns -d example.com -d www.example.com -The `PDNS_Url`, `PDNS_ServerId`, `PDNS_Token` and `PDNS_Ttl` will be saved in `~/.acme.sh/account.conf` and will be reused when needed. +The `PDNS_Url`, `PDNS_ServerId`, `PDNS_Token` and `PDNS_Ttl` will be +saved in `~/.acme.sh/account.conf` and will be reused when needed. -## 6. Use OVH/kimsufi/soyoustart/runabove API to automatically issue cert +Use OVH/kimsufi/soyoustart/runabove API to automatically issue cert +------------------------------------------------------------------- https://github.com/Neilpang/acme.sh/wiki/How-to-use-OVH-domain-api -## 7. Use nsupdate to automatically issue cert +Use nsupdate to automatically issue cert +---------------------------------------- First, generate a key for updating the zone -``` -b=$(dnssec-keygen -a hmac-sha512 -b 512 -n USER -K /tmp foo) -cat > /etc/named/keys/update.key < /etc/named/keys/update.key < /etc/knot/acme.key -``` + keymgr tsig generate -t acme_key hmac-sha512 > /etc/knot/acme.key Include this key in your knot configuration file. -``` -include: /etc/knot/acme.key -``` + include: /etc/knot/acme.key Next, configure your zone to allow dynamic updates. -Dynamic updates for the zone are allowed via proper ACL rule with the `update` action. For in-depth instructions, please see [Knot DNS's documentation](https://www.knot-dns.cz/documentation/). +Dynamic updates for the zone are allowed via proper ACL rule with the +`update` action. For in-depth instructions, please see [Knot DNS's +documentation](https://www.knot-dns.cz/documentation/). -``` -acl: - - id: acme_acl - address: 192.168.1.0/24 - key: acme_key - action: update + acl: + - id: acme_acl + address: 192.168.1.0/24 + key: acme_key + action: update -zone: - - domain: example.com - file: example.com.zone - acl: acme_acl -``` + zone: + - domain: example.com + file: example.com.zone + acl: acme_acl Finally, make the DNS server and TSIG Key available to `acme.sh` -``` -export KNOT_SERVER="dns.example.com" -export KNOT_KEY=`grep \# /etc/knot/acme.key | cut -d' ' -f2` -``` + export KNOT_SERVER="dns.example.com" + export KNOT_KEY=`grep \# /etc/knot/acme.key | cut -d' ' -f2` + +OK, let's issue a cert now: + + acme.sh --issue --dns dns_knot -d example.com -d www.example.com + +The `KNOT_SERVER` and `KNOT_KEY` settings will be saved in +`~/.acme.sh/account.conf` and will be reused when needed. -Ok, let's issue a cert now: -``` -acme.sh --issue --dns dns_knot -d example.com -d www.example.com -``` -The `KNOT_SERVER` and `KNOT_KEY` settings will be saved in `~/.acme.sh/account.conf` and will be reused when needed. +Use DigitalOcean API (native) +----------------------------- -## 20. Use DigitalOcean API (native) +You need to obtain a read and write capable API key from your +DigitalOcean account. See: https://www.digitalocean.com/help/api/ -You need to obtain a read and write capable API key from your DigitalOcean account. See: https://www.digitalocean.com/help/api/ + export DO_API_KEY="75310dc4ca779ac39a19f6355db573b49ce92ae126553ebd61ac3a3ae34834cc" -``` -export DO_API_KEY="75310dc4ca779ac39a19f6355db573b49ce92ae126553ebd61ac3a3ae34834cc" -``` +OK, let's issue a cert now: -Ok, let's issue a cert now: -``` -acme.sh --issue --dns dns_dgon -d example.com -d www.example.com -``` + acme.sh --issue --dns dns_dgon -d example.com -d www.example.com -## 21. Use ClouDNS.net API -You need to set the HTTP API user ID and password credentials. See: https://www.cloudns.net/wiki/article/42/. For security reasons, it's recommended to use a sub user ID that only has access to the necessary zones, as a regular API user has access to your entire account. +Use ClouDNS.net API +------------------- -``` -# Use this for a sub auth ID -export CLOUDNS_SUB_AUTH_ID=XXXXX -# Use this for a regular auth ID -#export CLOUDNS_AUTH_ID=XXXXX -export CLOUDNS_AUTH_PASSWORD="YYYYYYYYY" -``` +You need to set the HTTP API user ID and password credentials. See: +https://www.cloudns.net/wiki/article/42/. For security reasons, it's +recommended to use a sub user ID that only has access to the necessary +zones, as a regular API user has access to your entire account. -Ok, let's issue a cert now: -``` -acme.sh --issue --dns dns_cloudns -d example.com -d www.example.com -``` -The `CLOUDNS_AUTH_ID` and `CLOUDNS_AUTH_PASSWORD` will be saved in `~/.acme.sh/account.conf` and will be reused when needed. + # Use this for a sub auth ID + export CLOUDNS_SUB_AUTH_ID=XXXXX + # Use this for a regular auth ID + #export CLOUDNS_AUTH_ID=XXXXX + export CLOUDNS_AUTH_PASSWORD="YYYYYYYYY" -## 22. Use Infoblox API +OK, let's issue a cert now: -First you need to create/obtain API credentials on your Infoblox appliance. + acme.sh --issue --dns dns_cloudns -d example.com -d www.example.com -``` -export Infoblox_Creds="username:password" -export Infoblox_Server="ip or fqdn of infoblox appliance" -``` +The `CLOUDNS_AUTH_ID` and `CLOUDNS_AUTH_PASSWORD` will be saved in +`~/.acme.sh/account.conf` and will be reused when needed. -Ok, let's issue a cert now: -``` -acme.sh --issue --dns dns_infoblox -d example.com -d www.example.com -``` -Note: This script will automatically create and delete the ephemeral txt record. -The `Infoblox_Creds` and `Infoblox_Server` will be saved in `~/.acme.sh/account.conf` and will be reused when needed. +Use Infoblox API +---------------- +First you need to create/obtain API credentials on your Infoblox +appliance. -## 23. Use VSCALE API + export Infoblox_Creds="username:password" + export Infoblox_Server="ip or fqdn of infoblox appliance" -First you need to create/obtain API tokens on your [settings panel](https://vscale.io/panel/settings/tokens/). +OK, let's issue a cert now: -``` -VSCALE_API_KEY="sdfsdfsdfljlbjkljlkjsdfoiwje" -``` + acme.sh --issue --dns dns_infoblox -d example.com -d www.example.com -Ok, let's issue a cert now: -``` -acme.sh --issue --dns dns_vscale -d example.com -d www.example.com -``` +Note: This script will automatically create and delete the ephemeral TXT +record. The `Infoblox_Creds` and `Infoblox_Server` will be saved in +`~/.acme.sh/account.conf` and will be reused when needed. -## 24. Use Dynu API -First you need to create/obtain API credentials from your Dynu account. See: https://www.dynu.com/resources/api/documentation +Use VSCALE API +-------------- -``` -export Dynu_ClientId="xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" -export Dynu_Secret="yyyyyyyyyyyyyyyyyyyyyyyyy" -``` +First you need to create/obtain API tokens on your [settings +panel](https://vscale.io/panel/settings/tokens/). -Ok, let's issue a cert now: -``` -acme.sh --issue --dns dns_dynu -d example.com -d www.example.com -``` + VSCALE_API_KEY="sdfsdfsdfljlbjkljlkjsdfoiwje" -The `Dynu_ClientId` and `Dynu_Secret` will be saved in `~/.acme.sh/account.conf` and will be reused when needed. +OK, let's issue a cert now: -## 25. Use DNSimple API + acme.sh --issue --dns dns_vscale -d example.com -d www.example.com -First you need to login to your DNSimple account and generate a new oauth token. + +Use Dynu API +------------ + +First you need to create/obtain API credentials from your Dynu account. +See: https://www.dynu.com/resources/api/documentation + + export Dynu_ClientId="xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" + export Dynu_Secret="yyyyyyyyyyyyyyyyyyyyyyyyy" + +OK, let's issue a cert now: + + acme.sh --issue --dns dns_dynu -d example.com -d www.example.com + +The `Dynu_ClientId` and `Dynu_Secret` will be saved in +`~/.acme.sh/account.conf` and will be reused when needed. + + +Use DNSimple API +---------------- + +First you need to login to your DNSimple account and generate a new +oauth token. https://dnsimple.com/a/{your account id}/account/access_tokens -Note that this is an _account_ token and not a user token. The account token is -needed to infer the `account_id` used in requests. A user token will not be able -to determine the correct account to use. +Note that this is an _account_ token and not a user token. The account +token is needed to infer the `account_id` used in requests. A user +token will not be able to determine the correct account to use. -``` -export DNSimple_OAUTH_TOKEN="sdfsdfsdfljlbjkljlkjsdfoiwje" -``` + export DNSimple_OAUTH_TOKEN="sdfsdfsdfljlbjkljlkjsdfoiwje" To issue the cert just specify the `dns_dnsimple` API. -``` -acme.sh --issue --dns dns_dnsimple -d example.com -``` + acme.sh --issue --dns dns_dnsimple -d example.com -The `DNSimple_OAUTH_TOKEN` will be saved in `~/.acme.sh/account.conf` and will -be reused when needed. +The `DNSimple_OAUTH_TOKEN` will be saved in `~/.acme.sh/account.conf` +and will be reused when needed. If you have any issues with this integration please report them to https://github.com/pho3nixf1re/acme.sh/issues. -## 26. Use NS1.com API -``` -export NS1_Key="fdmlfsdklmfdkmqsdfk" -``` +Use NS1.com API +--------------- + + export NS1_Key="fdmlfsdklmfdkmqsdfk" + +OK, let's issue a cert now: + + acme.sh --issue --dns dns_nsone -d example.com -d www.example.com -Ok, let's issue a cert now: -``` -acme.sh --issue --dns dns_nsone -d example.com -d www.example.com -``` +Use DuckDNS.org API +------------------- -## 27. Use DuckDNS.org API + export DuckDNS_Token="aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee" -``` -export DuckDNS_Token="aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee" -``` +Please note that since DuckDNS uses StartSSL as their cert provider, +thus `--insecure` may need to be used when issuing certs: -Please note that since DuckDNS uses StartSSL as their cert provider, thus ---insecure may need to be used when issuing certs: -``` -acme.sh --insecure --issue --dns dns_duckdns -d mydomain.duckdns.org -``` + acme.sh --insecure --issue --dns dns_duckdns -d mydomain.duckdns.org For issues, please report to https://github.com/raidenii/acme.sh/issues. -## 28. Use Name.com API + +Use Name.com API +---------------- Create your API token here: https://www.name.com/account/settings/api -Note: `Namecom_Username` should be your Name.com username and not the token name. If you accidentally run the script with the token name as the username see `~/.acme.sh/account.conf` to fix the issue +Note: `Namecom_Username` should be your Name.com username and not the +token name. If you accidentally run the script with the token name as +the username see `~/.acme.sh/account.conf` to fix the issue -``` -export Namecom_Username="testuser" -export Namecom_Token="xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" -``` + export Namecom_Username="testuser" + export Namecom_Token="xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" And now you can issue certs with: -``` -acme.sh --issue --dns dns_namecom -d example.com -d www.example.com -``` + acme.sh --issue --dns dns_namecom -d example.com -d www.example.com For issues, please report to https://github.com/raidenii/acme.sh/issues. -## 29. Use Dyn Managed DNS API to automatically issue cert -First, login to your Dyn Managed DNS account: https://portal.dynect.net/login/ +Use Dyn Managed DNS API to automatically issue cert +--------------------------------------------------- + +First, login to your Dyn Managed DNS account: +https://portal.dynect.net/login/ It is recommended to add a new user specific for API access. The minimum "Zones & Records Permissions" required are: -``` -RecordAdd -RecordUpdate -RecordDelete -RecordGet -ZoneGet -ZoneAddNode -ZoneRemoveNode -ZonePublish -``` + + RecordAdd + RecordUpdate + RecordDelete + RecordGet + ZoneGet + ZoneAddNode + ZoneRemoveNode + ZonePublish Pass the API user credentials to the environment: -``` -export DYN_Customer="customer" -export DYN_Username="apiuser" -export DYN_Password="secret" -``` -Ok, let's issue a cert now: -``` -acme.sh --issue --dns dns_dyn -d example.com -d www.example.com -``` + export DYN_Customer="customer" + export DYN_Username="apiuser" + export DYN_Password="secret" + +OK, let's issue a cert now: + + acme.sh --issue --dns dns_dyn -d example.com -d www.example.com + +The `DYN_Customer`, `DYN_Username` and `DYN_Password` will be saved in +`~/.acme.sh/account.conf` and will be reused when needed. + -The `DYN_Customer`, `DYN_Username` and `DYN_Password` will be saved in `~/.acme.sh/account.conf` and will be reused when needed. +Use pdd.yandex.ru API +--------------------- -## 30. Use pdd.yandex.ru API +Follow these instructions to get the token for your domain +https://tech.yandex.com/domain/doc/concepts/access-docpage/ -``` -export PDD_Token="xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" -``` + export PDD_Token="xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" -Follow these instructions to get the token for your domain https://tech.yandex.com/domain/doc/concepts/access-docpage/ -``` -acme.sh --issue --dns dns_yandex -d mydomain.example.org -``` +OK, let's issue a cert now: + + acme.sh --issue --dns dns_yandex -d mydomain.example.org For issues, please report to https://github.com/non7top/acme.sh/issues. -## 31. Use Hurricane Electric -Hurricane Electric (https://dns.he.net/) doesn't have an API so just set your login credentials like so: +Use Hurricane Electric +---------------------- + +Hurricane Electric (https://dns.he.net/) doesn't have an API so just set +your login credentials like so: + + export HE_Username="yourusername" + export HE_Password="password" -``` -export HE_Username="yourusername" -export HE_Password="password" -``` +OK, let's issue a cert now: -Then you can issue your certificate: + acme.sh --issue --dns dns_he -d example.com -d www.example.com -``` -acme.sh --issue --dns dns_he -d example.com -d www.example.com -``` +The `HE_Username` and `HE_Password` settings will be saved in +`~/.acme.sh/account.conf` and will be reused when needed. -The `HE_Username` and `HE_Password` settings will be saved in `~/.acme.sh/account.conf` and will be reused when needed. +Please report any issues to https://github.com/angel333/acme.sh or to +. -Please report any issues to https://github.com/angel333/acme.sh or to . -## 32. Use UnoEuro API to automatically issue cert +Use UnoEuro API to automatically issue cert +------------------------------------------- First you need to login to your UnoEuro account to get your API key. -``` -export UNO_Key="sdfsdfsdfljlbjkljlkjsdfoiwje" -export UNO_User="UExxxxxx" -``` + export UNO_Key="sdfsdfsdfljlbjkljlkjsdfoiwje" + export UNO_User="UExxxxxx" -Ok, let's issue a cert now: -``` -acme.sh --issue --dns dns_unoeuro -d example.com -d www.example.com -``` +OK, let's issue a cert now: -The `UNO_Key` and `UNO_User` will be saved in `~/.acme.sh/account.conf` and will be reused when needed. + acme.sh --issue --dns dns_unoeuro -d example.com -d www.example.com -## 33. Use INWX +The `UNO_Key` and `UNO_User` will be saved in `~/.acme.sh/account.conf` +and will be reused when needed. -[INWX](https://www.inwx.de/) offers an [xmlrpc api](https://www.inwx.de/de/help/apidoc) with your standard login credentials, set them like so: -``` -export INWX_User="yourusername" -export INWX_Password="password" -``` +Use INWX +-------- -Then you can issue your certificates with: +[INWX](https://www.inwx.de/) offers an [xmlrpc +api](https://www.inwx.de/de/help/apidoc) with your standard login +credentials, set them like so: -``` -acme.sh --issue --dns dns_inwx -d example.com -d www.example.com -``` + export INWX_User="yourusername" + export INWX_Password="password" -The `INWX_User` and `INWX_Password` settings will be saved in `~/.acme.sh/account.conf` and will be reused when needed. +OK, let's issue a cert now: -If your account is secured by mobile tan you have also defined the shared secret. + acme.sh --issue --dns dns_inwx -d example.com -d www.example.com -``` -export INWX_Shared_Secret="shared secret" -``` +The `INWX_User` and `INWX_Password` settings will be saved in +`~/.acme.sh/account.conf` and will be reused when needed. -You may need to re-enable the mobile tan to gain the shared secret. +If your account is secured by Mobile-TAN, you also have to define the +shared secret: -## 34. User Servercow API v1 + export INWX_Shared_Secret="shared secret" -Create a new user from the servercow control center. Don't forget to activate **DNS API** for this user. +You may need to re-enable the Mobile-TAN to get the shared secret. -``` -export SERVERCOW_API_Username=username -export SERVERCOW_API_Password=password -``` -Now you cann issue a cert: +Use Servercow API v1 +--------------------- -``` -acme.sh --issue --dns dns_servercow -d example.com -d www.example.com -``` -Both, `SERVERCOW_API_Username` and `SERVERCOW_API_Password` will be saved in `~/.acme.sh/account.conf` and will be reused when needed. +Create a new user from the servercow control center. Don't forget to +activate **DNS API** for this user. -## 35. Use Namesilo.com API + export SERVERCOW_API_Username=username + export SERVERCOW_API_Password=password -You'll need to generate an API key at https://www.namesilo.com/account_api.php -Optionally you may restrict the access to an IP range there. +OK, let's issue a cert now: -``` -export Namesilo_Key="xxxxxxxxxxxxxxxxxxxxxxxx" -``` + acme.sh --issue --dns dns_servercow -d example.com -d www.example.com -And now you can issue certs with: +Both, `SERVERCOW_API_Username` and `SERVERCOW_API_Password` will be +saved in `~/.acme.sh/account.conf` and will be reused when needed. + + +Use Namesilo.com API +-------------------- -``` -acme.sh --issue --dns dns_namesilo --dnssleep 900 -d example.com -d www.example.com -``` +You'll need to generate an API key at +https://www.namesilo.com/account_api.php Optionally you may restrict the +access to an IP range there. -## 36. Use autoDNS (InternetX) + export Namesilo_Key="xxxxxxxxxxxxxxxxxxxxxxxx" -[InternetX](https://www.internetx.com/) offers an [xml api](https://help.internetx.com/display/API/AutoDNS+XML-API) with your standard login credentials, set them like so: +OK, let's issue a cert now: -``` -export AUTODNS_USER="yourusername" -export AUTODNS_PASSWORD="password" -export AUTODNS_CONTEXT="context" -``` + acme.sh --issue --dns dns_namesilo --dnssleep 900 -d example.com -d www.example.com -Then you can issue your certificates with: -``` -acme.sh --issue --dns dns_autodns -d example.com -d www.example.com -``` +Use autoDNS (InternetX) +----------------------- -The `AUTODNS_USER`, `AUTODNS_PASSWORD` and `AUTODNS_CONTEXT` settings will be saved in `~/.acme.sh/account.conf` and will be reused when needed. +[InternetX](https://www.internetx.com/) offers an [XML +API](https://help.internetx.com/display/API/AutoDNS+XML-API) with your +standard login credentials, set them like so: -## 37. Use Azure DNS + export AUTODNS_USER="yourusername" + export AUTODNS_PASSWORD="password" + export AUTODNS_CONTEXT="context" -You have to create a service principal first. See:[How to use Azure DNS](../../../wiki/How-to-use-Azure-DNS) +OK, let's issue a cert now: -``` -export AZUREDNS_SUBSCRIPTIONID="12345678-9abc-def0-1234-567890abcdef" -export AZUREDNS_TENANTID="11111111-2222-3333-4444-555555555555" -export AZUREDNS_APPID="3b5033b5-7a66-43a5-b3b9-a36b9e7c25ed" -export AZUREDNS_CLIENTSECRET="1b0224ef-34d4-5af9-110f-77f527d561bd" -``` + acme.sh --issue --dns dns_autodns -d example.com -d www.example.com -Then you can issue your certificates with: +The `AUTODNS_USER`, `AUTODNS_PASSWORD` and `AUTODNS_CONTEXT` settings +will be saved in `~/.acme.sh/account.conf` and will be reused when +needed. -``` -acme.sh --issue --dns dns_azure -d example.com -d www.example.com -``` -`AZUREDNS_SUBSCRIPTIONID`, `AZUREDNS_TENANTID`,`AZUREDNS_APPID` and `AZUREDNS_CLIENTSECRET` settings will be saved in `~/.acme.sh/account.conf` and will be reused when needed. +Use Azure DNS +------------- -## 38. Use selectel.com(selectel.ru) domain API to automatically issue cert +You have to create a service principal first. See:[How to use Azure +DNS](https://github.com/Neilpang/acme.sh/wiki/How-to-use-Azure-DNS) -First you need to login to your account to get your API key from: https://my.selectel.ru/profile/apikeys. + export AZUREDNS_SUBSCRIPTIONID="12345678-9abc-def0-1234-567890abcdef" + export AZUREDNS_TENANTID="11111111-2222-3333-4444-555555555555" + export AZUREDNS_APPID="3b5033b5-7a66-43a5-b3b9-a36b9e7c25ed" + export AZUREDNS_CLIENTSECRET="1b0224ef-34d4-5af9-110f-77f527d561bd" -```sh -export SL_Key="sdfsdfsdfljlbjkljlkjsdfoiwje" +OK, let's issue a cert now: -``` + acme.sh --issue --dns dns_azure -d example.com -d www.example.com -Ok, let's issue a cert now: -``` -acme.sh --issue --dns dns_selectel -d example.com -d www.example.com -``` +`AZUREDNS_SUBSCRIPTIONID`, `AZUREDNS_TENANTID`, `AZUREDNS_APPID` and +`AZUREDNS_CLIENTSECRET` settings will be saved in +`~/.acme.sh/account.conf` and will be reused when needed. -The `SL_Key` will be saved in `~/.acme.sh/account.conf` and will be reused when needed. -## 39. Use zonomi.com domain API to automatically issue cert +Use selectel.com (selectel.ru) domain API to automatically issue cert +--------------------------------------------------------------------- -First you need to login to your account to find your API key from: http://zonomi.com/app/dns/dyndns.jsp +First you need to login to your account to get your API key from: +https://my.selectel.ru/profile/apikeys. + + export SL_Key="sdfsdfsdfljlbjkljlkjsdfoiwje" + +OK, let's issue a cert now: + + acme.sh --issue --dns dns_selectel -d example.com -d www.example.com + +The `SL_Key` will be saved in `~/.acme.sh/account.conf` and will be +reused when needed. + + +Use zonomi.com domain API to automatically issue cert +----------------------------------------------------- + +First you need to login to your account to find your API key from: +http://zonomi.com/app/dns/dyndns.jsp Your will find your api key in the example urls: -```sh -https://zonomi.com/app/dns/dyndns.jsp?host=example.com&api_key=1063364558943540954358668888888888 -``` + https://zonomi.com/app/dns/dyndns.jsp?host=example.com&api_key=1063364558943540954358668888888888 -```sh -export ZM_Key="1063364558943540954358668888888888" + export ZM_Key="1063364558943540954358668888888888" -``` +OK, let's issue a cert now: -Ok, let's issue a cert now: -``` -acme.sh --issue --dns dns_zonomi -d example.com -d www.example.com -``` + acme.sh --issue --dns dns_zonomi -d example.com -d www.example.com -The `ZM_Key` will be saved in `~/.acme.sh/account.conf` and will be reused when needed. +The `ZM_Key` will be saved in `~/.acme.sh/account.conf` and will be +reused when needed. -## 40. Use DreamHost DNS API -DNS API keys may be created at https://panel.dreamhost.com/?tree=home.api. -Ensure the created key has add and remove privelages. +Use DreamHost DNS API +--------------------- -``` -export DH_API_KEY="" -acme.sh --issue --dns dns_dreamhost -d example.com -d www.example.com -``` +DNS API keys may be created at +https://panel.dreamhost.com/?tree=home.api. Ensure the created key has +add and remove privileges. + + export DH_API_KEY="" + +OK, let's issue a cert now: + + acme.sh --issue --dns dns_dreamhost -d example.com -d www.example.com The 'DH_API_KEY' will be saved in `~/.acme.sh/account.conf` and will be reused when needed. -## 41. Use DirectAdmin API -The DirectAdmin interface has it's own Let's encrypt functionality, but this -script can be used to generate certificates for names which are not hosted on -DirectAdmin + +Use DirectAdmin API +------------------- + +The DirectAdmin interface has it's own Let's Encrypt functionality, but +this script can be used to generate certificates for names which are not +hosted on DirectAdmin. User must provide login data and URL to the DirectAdmin incl. port. You can create an user which only has access to -- CMD_API_DNS_CONTROL -- CMD_API_SHOW_DOMAINS +- `CMD_API_DNS_CONTROL` +- `CMD_API_SHOW_DOMAINS` -By using the Login Keys function. -See also https://www.directadmin.com/api.php and https://www.directadmin.com/features.php?id=1298 +By using the Login Keys function. See also +https://www.directadmin.com/api.php and +https://www.directadmin.com/features.php?id=1298 -``` -export DA_Api="https://remoteUser:remotePassword@da.domain.tld:8443" -export DA_Api_Insecure=1 -``` -Set `DA_Api_Insecure` to 1 for insecure and 0 for secure -> difference is whether ssl cert is checked for validity (0) or whether it is just accepted (1) + export DA_Api="https://remoteUser:remotePassword@da.domain.tld:8443" + export DA_Api_Insecure=1 -Ok, let's issue a cert now: -``` -acme.sh --issue --dns dns_da -d example.com -d www.example.com -``` +Set `DA_Api_Insecure` to `1` for insecure and `0` for secure -> +difference is whether SSL cert is checked for validity (`0`) or whether +it is just accepted (`1`). -The `DA_Api` and `DA_Api_Insecure` will be saved in `~/.acme.sh/account.conf` and will be reused when needed. +OK, let's issue a cert now: -## 42. Use KingHost DNS API + acme.sh --issue --dns dns_da -d example.com -d www.example.com -API access must be enabled at https://painel.kinghost.com.br/painel.api.php +The `DA_Api` and `DA_Api_Insecure` will be saved in +`~/.acme.sh/account.conf` and will be reused when needed. -``` -export KINGHOST_Username="yourusername" -export KINGHOST_Password="yourpassword" -acme.sh --issue --dns dns_kinghost -d example.com -d *.example.com -``` -The `KINGHOST_username` and `KINGHOST_Password` will be saved in `~/.acme.sh/account.conf` and will be reused when needed. +Use KingHost DNS API +-------------------- -## 43. Use Zilore DNS API +API access must be enabled at +https://painel.kinghost.com.br/painel.api.php -First, get your API key at https://my.zilore.com/account/api + export KINGHOST_Username="yourusername" + export KINGHOST_Password="yourpassword" -``` -export Zilore_Key="5dcad3a2-36cb-50e8-cb92-000002f9" -``` +OK, let's issue a cert now: -Ok, let's issue a cert now: -``` -acme.sh --issue --dns dns_zilore -d example.com -d *.example.com -``` + acme.sh --issue --dns dns_kinghost -d example.com -d *.example.com -The `Zilore_Key` will be saved in `~/.acme.sh/account.conf` and will be reused when needed. +The `KINGHOST_username` and `KINGHOST_Password` will be saved in +`~/.acme.sh/account.conf` and will be reused when needed. -## 44. Use Loopia.se API -User must provide login credentials to the Loopia API. -The user needs the following permissions: -- addSubdomain -- updateZoneRecord -- getDomains -- removeSubdomain +Use Zilore DNS API +------------------ -Set the login credentials: -``` -export LOOPIA_User="user@loopiaapi" -export LOOPIA_Password="password" -``` +First, get your API key at https://my.zilore.com/account/api -And to issue a cert: -``` -acme.sh --issue --dns dns_loopia -d example.com -d *.example.com -``` + export Zilore_Key="5dcad3a2-36cb-50e8-cb92-000002f9" -The username and password will be saved in `~/.acme.sh/account.conf` and will be reused when needed. -## 45. Use ACME DNS API +OK, let's issue a cert now: -ACME DNS is a limited DNS server with RESTful HTTP API to handle ACME DNS challenges easily and securely. -https://github.com/joohoi/acme-dns + acme.sh --issue --dns dns_zilore -d example.com -d *.example.com -``` -export ACMEDNS_UPDATE_URL="https://auth.acme-dns.io/update" -export ACMEDNS_USERNAME="" -export ACMEDNS_PASSWORD="" -export ACMEDNS_SUBDOMAIN="" +The `Zilore_Key` will be saved in `~/.acme.sh/account.conf` and will be +reused when needed. -acme.sh --issue --dns dns_acmedns -d example.com -d www.example.com -``` -The credentials will be saved in `~/.acme.sh/account.conf` and will -be reused when needed. +Use Loopia.se API +----------------- -# Use custom API +User must provide login credentials to the Loopia API. The user needs +the following permissions: -If your API is not supported yet, you can write your own DNS API. +- `addSubdomain` +- `updateZoneRecord` +- `getDomains` +- `removeSubdomain` -Let's assume you want to name it 'myapi': +Set the login credentials: -1. Create a bash script named `~/.acme.sh/dns_myapi.sh`, -2. In the script you must have a function named `dns_myapi_add()` which will be called by acme.sh to add the DNS records. -3. Then you can use your API to issue cert like this: + export LOOPIA_User="user@loopiaapi" + export LOOPIA_Password="password" -``` -acme.sh --issue --dns dns_myapi -d example.com -d www.example.com -``` +OK, let's issue a cert now: -For more details, please check our sample script: [dns_myapi.sh](dns_myapi.sh) + acme.sh --issue --dns dns_loopia -d example.com -d *.example.com -See: https://github.com/Neilpang/acme.sh/wiki/DNS-API-Dev-Guide +The username and password will be saved in `~/.acme.sh/account.conf` and +will be reused when needed. -# Use lexicon DNS API -https://github.com/Neilpang/acme.sh/wiki/How-to-use-lexicon-dns-api +Use ACME DNS API +---------------- + +ACME DNS is a limited DNS server with RESTful HTTP API to handle ACME +DNS challenges easily and securely. https://github.com/joohoi/acme-dns + + export ACMEDNS_UPDATE_URL="https://auth.acme-dns.io/update" + export ACMEDNS_USERNAME="" + export ACMEDNS_PASSWORD="" + export ACMEDNS_SUBDOMAIN="" + +OK, let's issue a cert now: + + acme.sh --issue --dns dns_acmedns -d example.com -d www.example.com + +The credentials will be saved in `~/.acme.sh/account.conf` and will be +reused when needed.