You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

1103 lines
31 KiB

9 years ago
8 years ago
8 years ago
8 years ago
8 years ago
8 years ago
8 years ago
8 years ago
8 years ago
7 years ago
7 years ago
7 years ago
7 years ago
7 years ago
7 years ago
7 years ago
7 years ago
6 years ago
6 years ago
6 years ago
6 years ago
6 years ago
8 years ago
8 years ago
8 years ago
8 years ago
8 years ago
8 years ago
7 years ago
8 years ago
  1. # How to use DNS API
  2. If your dns provider doesn't provide api access, you can use our dns alias mode:
  3. https://github.com/Neilpang/acme.sh/wiki/DNS-alias-mode
  4. ## 1. Use CloudFlare domain API to automatically issue cert
  5. First you need to login to your CloudFlare account to get your [API key](https://dash.cloudflare.com/profile).
  6. ```
  7. export CF_Key="sdfsdfsdfljlbjkljlkjsdfoiwje"
  8. export CF_Email="xxxx@sss.com"
  9. ```
  10. Ok, let's issue a cert now:
  11. ```
  12. acme.sh --issue --dns dns_cf -d example.com -d www.example.com
  13. ```
  14. The `CF_Key` and `CF_Email` will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
  15. ## 2. Use DNSPod.cn domain API to automatically issue cert
  16. First you need to login to your DNSPod account to get your API Key and ID.
  17. ```
  18. export DP_Id="1234"
  19. export DP_Key="sADDsdasdgdsf"
  20. ```
  21. Ok, let's issue a cert now:
  22. ```
  23. acme.sh --issue --dns dns_dp -d example.com -d www.example.com
  24. ```
  25. The `DP_Id` and `DP_Key` will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
  26. ## 3. Use CloudXNS.com domain API to automatically issue cert
  27. First you need to login to your CloudXNS account to get your API Key and Secret.
  28. ```
  29. export CX_Key="1234"
  30. export CX_Secret="sADDsdasdgdsf"
  31. ```
  32. Ok, let's issue a cert now:
  33. ```
  34. acme.sh --issue --dns dns_cx -d example.com -d www.example.com
  35. ```
  36. The `CX_Key` and `CX_Secret` will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
  37. ## 4. Use GoDaddy.com domain API to automatically issue cert
  38. First you need to login to your GoDaddy account to get your API Key and Secret.
  39. https://developer.godaddy.com/keys/
  40. Please create a Production key, instead of a Test key.
  41. ```
  42. export GD_Key="sdfsdfsdfljlbjkljlkjsdfoiwje"
  43. export GD_Secret="asdfsdafdsfdsfdsfdsfdsafd"
  44. ```
  45. Ok, let's issue a cert now:
  46. ```
  47. acme.sh --issue --dns dns_gd -d example.com -d www.example.com
  48. ```
  49. The `GD_Key` and `GD_Secret` will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
  50. ## 5. Use PowerDNS embedded API to automatically issue cert
  51. First you need to login to your PowerDNS account to enable the API and set your API-Token in the configuration.
  52. https://doc.powerdns.com/md/httpapi/README/
  53. ```
  54. export PDNS_Url="http://ns.example.com:8081"
  55. export PDNS_ServerId="localhost"
  56. export PDNS_Token="0123456789ABCDEF"
  57. export PDNS_Ttl=60
  58. ```
  59. Ok, let's issue a cert now:
  60. ```
  61. acme.sh --issue --dns dns_pdns -d example.com -d www.example.com
  62. ```
  63. The `PDNS_Url`, `PDNS_ServerId`, `PDNS_Token` and `PDNS_Ttl` will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
  64. ## 6. Use OVH/kimsufi/soyoustart/runabove API to automatically issue cert
  65. https://github.com/Neilpang/acme.sh/wiki/How-to-use-OVH-domain-api
  66. ## 7. Use nsupdate to automatically issue cert
  67. First, generate a key for updating the zone
  68. ```
  69. b=$(dnssec-keygen -a hmac-sha512 -b 512 -n USER -K /tmp foo)
  70. cat > /etc/named/keys/update.key <<EOF
  71. key "update" {
  72. algorithm hmac-sha512;
  73. secret "$(awk '/^Key/{print $2}' /tmp/$b.private)";
  74. };
  75. EOF
  76. rm -f /tmp/$b.{private,key}
  77. ```
  78. Include this key in your named configuration
  79. ```
  80. include "/etc/named/keys/update.key";
  81. ```
  82. Next, configure your zone to allow dynamic updates.
  83. Depending on your named version, use either
  84. ```
  85. zone "example.com" {
  86. type master;
  87. allow-update { key "update"; };
  88. };
  89. ```
  90. or
  91. ```
  92. zone "example.com" {
  93. type master;
  94. update-policy {
  95. grant update subdomain example.com.;
  96. };
  97. }
  98. ```
  99. Finally, make the DNS server and update Key available to `acme.sh`
  100. ```
  101. export NSUPDATE_SERVER="dns.example.com"
  102. export NSUPDATE_KEY="/path/to/your/nsupdate.key"
  103. ```
  104. and optionally (depending on DNS server)
  105. ```
  106. export NSUPDATE_ZONE="example.com"
  107. ```
  108. Ok, let's issue a cert now:
  109. ```
  110. acme.sh --issue --dns dns_nsupdate -d example.com -d www.example.com
  111. ```
  112. The `NSUPDATE_SERVER`, `NSUPDATE_KEY`, and `NSUPDATE_ZONE` settings will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
  113. ## 8. Use LuaDNS domain API
  114. Get your API token at https://api.luadns.com/settings
  115. ```
  116. export LUA_Key="sdfsdfsdfljlbjkljlkjsdfoiwje"
  117. export LUA_Email="xxxx@sss.com"
  118. ```
  119. To issue a cert:
  120. ```
  121. acme.sh --issue --dns dns_lua -d example.com -d www.example.com
  122. ```
  123. The `LUA_Key` and `LUA_Email` will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
  124. ## 9. Use DNSMadeEasy domain API
  125. Get your API credentials at https://cp.dnsmadeeasy.com/account/info
  126. ```
  127. export ME_Key="sdfsdfsdfljlbjkljlkjsdfoiwje"
  128. export ME_Secret="qdfqsdfkjdskfj"
  129. ```
  130. To issue a cert:
  131. ```
  132. acme.sh --issue --dns dns_me -d example.com -d www.example.com
  133. ```
  134. The `ME_Key` and `ME_Secret` will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
  135. ## 10. Use Amazon Route53 domain API
  136. https://github.com/Neilpang/acme.sh/wiki/How-to-use-Amazon-Route53-API
  137. ```
  138. export AWS_ACCESS_KEY_ID=XXXXXXXXXX
  139. export AWS_SECRET_ACCESS_KEY=XXXXXXXXXXXXXXX
  140. ```
  141. To issue a cert:
  142. ```
  143. acme.sh --issue --dns dns_aws -d example.com -d www.example.com
  144. ```
  145. The `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
  146. ## 11. Use Aliyun domain API to automatically issue cert
  147. First you need to login to your Aliyun account to get your API key.
  148. [https://ak-console.aliyun.com/#/accesskey](https://ak-console.aliyun.com/#/accesskey)
  149. ```
  150. export Ali_Key="sdfsdfsdfljlbjkljlkjsdfoiwje"
  151. export Ali_Secret="jlsdflanljkljlfdsaklkjflsa"
  152. ```
  153. Ok, let's issue a cert now:
  154. ```
  155. acme.sh --issue --dns dns_ali -d example.com -d www.example.com
  156. ```
  157. The `Ali_Key` and `Ali_Secret` will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
  158. ## 12. Use ISPConfig 3.1 API
  159. This only works for ISPConfig 3.1 (and newer).
  160. Create a Remote User in the ISPConfig Control Panel. The Remote User must have access to at least `DNS zone functions` and `DNS txt functions`.
  161. ```
  162. export ISPC_User="xxx"
  163. export ISPC_Password="xxx"
  164. export ISPC_Api="https://ispc.domain.tld:8080/remote/json.php"
  165. export ISPC_Api_Insecure=1
  166. ```
  167. If you have installed ISPConfig on a different port, then alter the 8080 accordingly.
  168. Leaver ISPC_Api_Insecure set to 1 if you have not a valid ssl cert for your installation. Change it to 0 if you have a valid ssl cert.
  169. To issue a cert:
  170. ```
  171. acme.sh --issue --dns dns_ispconfig -d example.com -d www.example.com
  172. ```
  173. The `ISPC_User`, `ISPC_Password`, `ISPC_Api`and `ISPC_Api_Insecure` will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
  174. ## 13. Use Alwaysdata domain API
  175. First you need to login to your Alwaysdata account to get your API Key.
  176. ```sh
  177. export AD_API_KEY="myalwaysdataapikey"
  178. ```
  179. Ok, let's issue a cert now:
  180. ```sh
  181. acme.sh --issue --dns dns_ad -d example.com -d www.example.com
  182. ```
  183. The `AD_API_KEY` will be saved in `~/.acme.sh/account.conf` and will be reused
  184. when needed.
  185. ## 14. Use Linode domain API
  186. First you need to login to your Linode account to get your API Key.
  187. * [Classic Manager](https://manager.linode.com/profile/api)
  188. Under "Add an API key", Give the new key a "Label" (we recommend *ACME*),
  189. set the expiry to never, "Create API Key", and copy the new key into the `LINODE_API_KEY` command
  190. below.
  191. * [Cloud Manager](https://cloud.linode.com/profile/tokens)
  192. Click on "Add a Personal Access Token". Give the new key a "Label" (we
  193. recommend *ACME*), give it Read/Write access to "Domains". "Submit", and
  194. copy the new key into the `LINODE_API_KEY` command below.
  195. ```sh
  196. export LINODE_API_KEY="..."
  197. ```
  198. Due to the reload time of any changes in the DNS records, we have to use the `dnssleep` option to wait at least 15 minutes for the changes to take effect.
  199. Ok, let's issue a cert now:
  200. ```sh
  201. acme.sh --issue --dns dns_linode --dnssleep 900 -d example.com -d www.example.com
  202. ```
  203. The `LINODE_API_KEY` will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
  204. ## 15. Use FreeDNS
  205. FreeDNS (https://freedns.afraid.org/) does not provide an API to update DNS records (other than IPv4 and IPv6
  206. dynamic DNS addresses). The acme.sh plugin therefore retrieves and updates domain TXT records by logging
  207. into the FreeDNS website to read the HTML and posting updates as HTTP. The plugin needs to know your
  208. userid and password for the FreeDNS website.
  209. ```sh
  210. export FREEDNS_User="..."
  211. export FREEDNS_Password="..."
  212. ```
  213. You need only provide this the first time you run the acme.sh client with FreeDNS validation and then again
  214. whenever you change your password at the FreeDNS site. The acme.sh FreeDNS plugin does not store your userid
  215. or password but rather saves an authentication token returned by FreeDNS in `~/.acme.sh/account.conf` and
  216. reuses that when needed.
  217. Now you can issue a certificate.
  218. ```sh
  219. acme.sh --issue --dns dns_freedns -d example.com -d www.example.com
  220. ```
  221. Note that you cannot use acme.sh automatic DNS validation for FreeDNS public domains or for a subdomain that
  222. you create under a FreeDNS public domain. You must own the top level domain in order to automatically
  223. validate with acme.sh at FreeDNS.
  224. ## 16. Use cyon.ch
  225. You only need to set your cyon.ch login credentials.
  226. If you also have 2 Factor Authentication (OTP) enabled, you need to set your secret token too and have `oathtool` installed.
  227. ```
  228. export CY_Username="your_cyon_username"
  229. export CY_Password="your_cyon_password"
  230. export CY_OTP_Secret="your_otp_secret" # Only required if using 2FA
  231. ```
  232. To issue a cert:
  233. ```
  234. acme.sh --issue --dns dns_cyon -d example.com -d www.example.com
  235. ```
  236. The `CY_Username`, `CY_Password` and `CY_OTP_Secret` will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
  237. ## 17. Use Domain-Offensive/Resellerinterface/Domainrobot API
  238. ATTENTION: You need to be a registered Reseller to be able to use the ResellerInterface. As a normal user you can not use this method.
  239. You will need your login credentials (Partner ID+Password) to the Resellerinterface, and export them before you run `acme.sh`:
  240. ```
  241. export DO_PID="KD-1234567"
  242. export DO_PW="cdfkjl3n2"
  243. ```
  244. Ok, let's issue a cert now:
  245. ```
  246. acme.sh --issue --dns dns_do -d example.com -d www.example.com
  247. ```
  248. ## 18. Use Gandi LiveDNS API
  249. You must enable the new Gandi LiveDNS API first and the create your api key, See: http://doc.livedns.gandi.net/
  250. ```
  251. export GANDI_LIVEDNS_KEY="fdmlfsdklmfdkmqsdfk"
  252. ```
  253. Ok, let's issue a cert now:
  254. ```
  255. acme.sh --issue --dns dns_gandi_livedns -d example.com -d www.example.com
  256. ```
  257. ## 19. Use Knot (knsupdate) DNS API to automatically issue cert
  258. First, generate a TSIG key for updating the zone.
  259. ```
  260. keymgr tsig generate -t acme_key hmac-sha512 > /etc/knot/acme.key
  261. ```
  262. Include this key in your knot configuration file.
  263. ```
  264. include: /etc/knot/acme.key
  265. ```
  266. Next, configure your zone to allow dynamic updates.
  267. Dynamic updates for the zone are allowed via proper ACL rule with the `update` action. For in-depth instructions, please see [Knot DNS's documentation](https://www.knot-dns.cz/documentation/).
  268. ```
  269. acl:
  270. - id: acme_acl
  271. address: 192.168.1.0/24
  272. key: acme_key
  273. action: update
  274. zone:
  275. - domain: example.com
  276. file: example.com.zone
  277. acl: acme_acl
  278. ```
  279. Finally, make the DNS server and TSIG Key available to `acme.sh`
  280. ```
  281. export KNOT_SERVER="dns.example.com"
  282. export KNOT_KEY=`grep \# /etc/knot/acme.key | cut -d' ' -f2`
  283. ```
  284. Ok, let's issue a cert now:
  285. ```
  286. acme.sh --issue --dns dns_knot -d example.com -d www.example.com
  287. ```
  288. The `KNOT_SERVER` and `KNOT_KEY` settings will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
  289. ## 20. Use DigitalOcean API (native)
  290. You need to obtain a read and write capable API key from your DigitalOcean account. See: https://www.digitalocean.com/help/api/
  291. ```
  292. export DO_API_KEY="75310dc4ca779ac39a19f6355db573b49ce92ae126553ebd61ac3a3ae34834cc"
  293. ```
  294. Ok, let's issue a cert now:
  295. ```
  296. acme.sh --issue --dns dns_dgon -d example.com -d www.example.com
  297. ```
  298. ## 21. Use ClouDNS.net API
  299. You need to set the HTTP API user ID and password credentials. See: https://www.cloudns.net/wiki/article/42/. For security reasons, it's recommended to use a sub user ID that only has access to the necessary zones, as a regular API user has access to your entire account.
  300. ```
  301. # Use this for a sub auth ID
  302. export CLOUDNS_SUB_AUTH_ID=XXXXX
  303. # Use this for a regular auth ID
  304. #export CLOUDNS_AUTH_ID=XXXXX
  305. export CLOUDNS_AUTH_PASSWORD="YYYYYYYYY"
  306. ```
  307. Ok, let's issue a cert now:
  308. ```
  309. acme.sh --issue --dns dns_cloudns -d example.com -d www.example.com
  310. ```
  311. The `CLOUDNS_AUTH_ID` and `CLOUDNS_AUTH_PASSWORD` will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
  312. ## 22. Use Infoblox API
  313. First you need to create/obtain API credentials on your Infoblox appliance.
  314. ```
  315. export Infoblox_Creds="username:password"
  316. export Infoblox_Server="ip or fqdn of infoblox appliance"
  317. ```
  318. Ok, let's issue a cert now:
  319. ```
  320. acme.sh --issue --dns dns_infoblox -d example.com -d www.example.com
  321. ```
  322. Note: This script will automatically create and delete the ephemeral txt record.
  323. The `Infoblox_Creds` and `Infoblox_Server` will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
  324. ## 23. Use VSCALE API
  325. First you need to create/obtain API tokens on your [settings panel](https://vscale.io/panel/settings/tokens/).
  326. ```
  327. export VSCALE_API_KEY="sdfsdfsdfljlbjkljlkjsdfoiwje"
  328. ```
  329. Ok, let's issue a cert now:
  330. ```
  331. acme.sh --issue --dns dns_vscale -d example.com -d www.example.com
  332. ```
  333. ## 24. Use Dynu API
  334. First you need to create/obtain API credentials from your Dynu account. See: https://www.dynu.com/resources/api/documentation
  335. ```
  336. export Dynu_ClientId="xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
  337. export Dynu_Secret="yyyyyyyyyyyyyyyyyyyyyyyyy"
  338. ```
  339. Ok, let's issue a cert now:
  340. ```
  341. acme.sh --issue --dns dns_dynu -d example.com -d www.example.com
  342. ```
  343. The `Dynu_ClientId` and `Dynu_Secret` will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
  344. ## 25. Use DNSimple API
  345. First you need to login to your DNSimple account and generate a new oauth token.
  346. https://dnsimple.com/a/{your account id}/account/access_tokens
  347. Note that this is an _account_ token and not a user token. The account token is
  348. needed to infer the `account_id` used in requests. A user token will not be able
  349. to determine the correct account to use.
  350. ```
  351. export DNSimple_OAUTH_TOKEN="sdfsdfsdfljlbjkljlkjsdfoiwje"
  352. ```
  353. To issue the cert just specify the `dns_dnsimple` API.
  354. ```
  355. acme.sh --issue --dns dns_dnsimple -d example.com
  356. ```
  357. The `DNSimple_OAUTH_TOKEN` will be saved in `~/.acme.sh/account.conf` and will
  358. be reused when needed.
  359. If you have any issues with this integration please report them to
  360. https://github.com/pho3nixf1re/acme.sh/issues.
  361. ## 26. Use NS1.com API
  362. ```
  363. export NS1_Key="fdmlfsdklmfdkmqsdfk"
  364. ```
  365. Ok, let's issue a cert now:
  366. ```
  367. acme.sh --issue --dns dns_nsone -d example.com -d www.example.com
  368. ```
  369. ## 27. Use DuckDNS.org API
  370. ```
  371. export DuckDNS_Token="aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee"
  372. ```
  373. Please note that since DuckDNS uses StartSSL as their cert provider, thus
  374. --insecure may need to be used when issuing certs:
  375. ```
  376. acme.sh --insecure --issue --dns dns_duckdns -d mydomain.duckdns.org
  377. ```
  378. For issues, please report to https://github.com/raidenii/acme.sh/issues.
  379. ## 28. Use Name.com API
  380. Create your API token here: https://www.name.com/account/settings/api
  381. Note: `Namecom_Username` should be your Name.com username and not the token name. If you accidentally run the script with the token name as the username see `~/.acme.sh/account.conf` to fix the issue
  382. ```
  383. export Namecom_Username="testuser"
  384. export Namecom_Token="xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
  385. ```
  386. And now you can issue certs with:
  387. ```
  388. acme.sh --issue --dns dns_namecom -d example.com -d www.example.com
  389. ```
  390. For issues, please report to https://github.com/raidenii/acme.sh/issues.
  391. ## 29. Use Dyn Managed DNS API to automatically issue cert
  392. First, login to your Dyn Managed DNS account: https://portal.dynect.net/login/
  393. It is recommended to add a new user specific for API access.
  394. The minimum "Zones & Records Permissions" required are:
  395. ```
  396. RecordAdd
  397. RecordUpdate
  398. RecordDelete
  399. RecordGet
  400. ZoneGet
  401. ZoneAddNode
  402. ZoneRemoveNode
  403. ZonePublish
  404. ```
  405. Pass the API user credentials to the environment:
  406. ```
  407. export DYN_Customer="customer"
  408. export DYN_Username="apiuser"
  409. export DYN_Password="secret"
  410. ```
  411. Ok, let's issue a cert now:
  412. ```
  413. acme.sh --issue --dns dns_dyn -d example.com -d www.example.com
  414. ```
  415. The `DYN_Customer`, `DYN_Username` and `DYN_Password` will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
  416. ## 30. Use pdd.yandex.ru API
  417. ```
  418. export PDD_Token="xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
  419. ```
  420. Follow these instructions to get the token for your domain https://tech.yandex.com/domain/doc/concepts/access-docpage/
  421. ```
  422. acme.sh --issue --dns dns_yandex -d mydomain.example.org
  423. ```
  424. For issues, please report to https://github.com/non7top/acme.sh/issues.
  425. ## 31. Use Hurricane Electric
  426. Hurricane Electric (https://dns.he.net/) doesn't have an API so just set your login credentials like so:
  427. ```
  428. export HE_Username="yourusername"
  429. export HE_Password="password"
  430. ```
  431. Then you can issue your certificate:
  432. ```
  433. acme.sh --issue --dns dns_he -d example.com -d www.example.com
  434. ```
  435. The `HE_Username` and `HE_Password` settings will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
  436. Please report any issues to https://github.com/angel333/acme.sh or to <me@ondrejsimek.com>.
  437. ## 32. Use UnoEuro API to automatically issue cert
  438. First you need to login to your UnoEuro account to get your API key.
  439. ```
  440. export UNO_Key="sdfsdfsdfljlbjkljlkjsdfoiwje"
  441. export UNO_User="UExxxxxx"
  442. ```
  443. Ok, let's issue a cert now:
  444. ```
  445. acme.sh --issue --dns dns_unoeuro -d example.com -d www.example.com
  446. ```
  447. The `UNO_Key` and `UNO_User` will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
  448. ## 33. Use INWX
  449. [INWX](https://www.inwx.de/) offers an [xmlrpc api](https://www.inwx.de/de/help/apidoc) with your standard login credentials, set them like so:
  450. ```
  451. export INWX_User="yourusername"
  452. export INWX_Password="password"
  453. ```
  454. Then you can issue your certificates with:
  455. ```
  456. acme.sh --issue --dns dns_inwx -d example.com -d www.example.com
  457. ```
  458. The `INWX_User` and `INWX_Password` settings will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
  459. If your account is secured by mobile tan you have also defined the shared secret.
  460. ```
  461. export INWX_Shared_Secret="shared secret"
  462. ```
  463. You may need to re-enable the mobile tan to gain the shared secret.
  464. ## 34. User Servercow API v1
  465. Create a new user from the servercow control center. Don't forget to activate **DNS API** for this user.
  466. ```
  467. export SERVERCOW_API_Username=username
  468. export SERVERCOW_API_Password=password
  469. ```
  470. Now you cann issue a cert:
  471. ```
  472. acme.sh --issue --dns dns_servercow -d example.com -d www.example.com
  473. ```
  474. Both, `SERVERCOW_API_Username` and `SERVERCOW_API_Password` will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
  475. ## 35. Use Namesilo.com API
  476. You'll need to generate an API key at https://www.namesilo.com/account_api.php
  477. Optionally you may restrict the access to an IP range there.
  478. ```
  479. export Namesilo_Key="xxxxxxxxxxxxxxxxxxxxxxxx"
  480. ```
  481. And now you can issue certs with:
  482. ```
  483. acme.sh --issue --dns dns_namesilo --dnssleep 900 -d example.com -d www.example.com
  484. ```
  485. ## 36. Use autoDNS (InternetX)
  486. [InternetX](https://www.internetx.com/) offers an [xml api](https://help.internetx.com/display/API/AutoDNS+XML-API) with your standard login credentials, set them like so:
  487. ```
  488. export AUTODNS_USER="yourusername"
  489. export AUTODNS_PASSWORD="password"
  490. export AUTODNS_CONTEXT="context"
  491. ```
  492. Then you can issue your certificates with:
  493. ```
  494. acme.sh --issue --dns dns_autodns -d example.com -d www.example.com
  495. ```
  496. The `AUTODNS_USER`, `AUTODNS_PASSWORD` and `AUTODNS_CONTEXT` settings will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
  497. ## 37. Use Azure DNS
  498. You have to create a service principal first. See:[How to use Azure DNS](../../../wiki/How-to-use-Azure-DNS)
  499. ```
  500. export AZUREDNS_SUBSCRIPTIONID="12345678-9abc-def0-1234-567890abcdef"
  501. export AZUREDNS_TENANTID="11111111-2222-3333-4444-555555555555"
  502. export AZUREDNS_APPID="3b5033b5-7a66-43a5-b3b9-a36b9e7c25ed"
  503. export AZUREDNS_CLIENTSECRET="1b0224ef-34d4-5af9-110f-77f527d561bd"
  504. ```
  505. Then you can issue your certificates with:
  506. ```
  507. acme.sh --issue --dns dns_azure -d example.com -d www.example.com
  508. ```
  509. `AZUREDNS_SUBSCRIPTIONID`, `AZUREDNS_TENANTID`,`AZUREDNS_APPID` and `AZUREDNS_CLIENTSECRET` settings will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
  510. ## 38. Use selectel.com(selectel.ru) domain API to automatically issue cert
  511. First you need to login to your account to get your API key from: https://my.selectel.ru/profile/apikeys.
  512. ```sh
  513. export SL_Key="sdfsdfsdfljlbjkljlkjsdfoiwje"
  514. ```
  515. Ok, let's issue a cert now:
  516. ```
  517. acme.sh --issue --dns dns_selectel -d example.com -d www.example.com
  518. ```
  519. The `SL_Key` will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
  520. ## 39. Use zonomi.com domain API to automatically issue cert
  521. First you need to login to your account to find your API key from: http://zonomi.com/app/dns/dyndns.jsp
  522. Your will find your api key in the example urls:
  523. ```sh
  524. https://zonomi.com/app/dns/dyndns.jsp?host=example.com&api_key=1063364558943540954358668888888888
  525. ```
  526. ```sh
  527. export ZM_Key="1063364558943540954358668888888888"
  528. ```
  529. Ok, let's issue a cert now:
  530. ```
  531. acme.sh --issue --dns dns_zonomi -d example.com -d www.example.com
  532. ```
  533. The `ZM_Key` will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
  534. ## 40. Use DreamHost DNS API
  535. DNS API keys may be created at https://panel.dreamhost.com/?tree=home.api.
  536. Ensure the created key has add and remove privelages.
  537. ```
  538. export DH_API_KEY="<api key>"
  539. acme.sh --issue --dns dns_dreamhost -d example.com -d www.example.com
  540. ```
  541. The 'DH_API_KEY' will be saved in `~/.acme.sh/account.conf` and will
  542. be reused when needed.
  543. ## 41. Use DirectAdmin API
  544. The DirectAdmin interface has it's own Let's encrypt functionality, but this
  545. script can be used to generate certificates for names which are not hosted on
  546. DirectAdmin
  547. User must provide login data and URL to the DirectAdmin incl. port.
  548. You can create an user which only has access to
  549. - CMD_API_DNS_CONTROL
  550. - CMD_API_SHOW_DOMAINS
  551. By using the Login Keys function.
  552. See also https://www.directadmin.com/api.php and https://www.directadmin.com/features.php?id=1298
  553. ```
  554. export DA_Api="https://remoteUser:remotePassword@da.domain.tld:8443"
  555. export DA_Api_Insecure=1
  556. ```
  557. Set `DA_Api_Insecure` to 1 for insecure and 0 for secure -> difference is whether ssl cert is checked for validity (0) or whether it is just accepted (1)
  558. Ok, let's issue a cert now:
  559. ```
  560. acme.sh --issue --dns dns_da -d example.com -d www.example.com
  561. ```
  562. The `DA_Api` and `DA_Api_Insecure` will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
  563. ## 42. Use KingHost DNS API
  564. API access must be enabled at https://painel.kinghost.com.br/painel.api.php
  565. ```
  566. export KINGHOST_Username="yourusername"
  567. export KINGHOST_Password="yourpassword"
  568. acme.sh --issue --dns dns_kinghost -d example.com -d *.example.com
  569. ```
  570. The `KINGHOST_username` and `KINGHOST_Password` will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
  571. ## 43. Use Zilore DNS API
  572. First, get your API key at https://my.zilore.com/account/api
  573. ```
  574. export Zilore_Key="5dcad3a2-36cb-50e8-cb92-000002f9"
  575. ```
  576. Ok, let's issue a cert now:
  577. ```
  578. acme.sh --issue --dns dns_zilore -d example.com -d *.example.com
  579. ```
  580. The `Zilore_Key` will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
  581. ## 44. Use Loopia.se API
  582. User must provide login credentials to the Loopia API.
  583. The user needs the following permissions:
  584. - addSubdomain
  585. - updateZoneRecord
  586. - getDomains
  587. - removeSubdomain
  588. Set the login credentials:
  589. ```
  590. export LOOPIA_User="user@loopiaapi"
  591. export LOOPIA_Password="password"
  592. ```
  593. And to issue a cert:
  594. ```
  595. acme.sh --issue --dns dns_loopia -d example.com -d *.example.com
  596. ```
  597. The username and password will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
  598. ## 45. Use ACME DNS API
  599. ACME DNS is a limited DNS server with RESTful HTTP API to handle ACME DNS challenges easily and securely.
  600. https://github.com/joohoi/acme-dns
  601. ```
  602. export ACMEDNS_UPDATE_URL="https://auth.acme-dns.io/update"
  603. export ACMEDNS_USERNAME="<username>"
  604. export ACMEDNS_PASSWORD="<password>"
  605. export ACMEDNS_SUBDOMAIN="<subdomain>"
  606. acme.sh --issue --dns dns_acmedns -d example.com -d www.example.com
  607. ```
  608. The credentials will be saved in `~/.acme.sh/account.conf` and will
  609. be reused when needed.
  610. ## 46. Use TELE3 API
  611. First you need to login to your TELE3 account to set your API-KEY.
  612. https://www.tele3.cz/system-acme-api.html
  613. ```
  614. export TELE3_Key="MS2I4uPPaI..."
  615. export TELE3_Secret="kjhOIHGJKHg"
  616. acme.sh --issue --dns dns_tele3 -d example.com -d *.example.com
  617. ```
  618. The TELE3_Key and TELE3_Secret will be saved in ~/.acme.sh/account.conf and will be reused when needed.
  619. ## 47. Use Euserv.eu API
  620. First you need to login to your euserv.eu account and activate your API Administration (API Verwaltung).
  621. [https://support.euserv.com](https://support.euserv.com)
  622. Once you've activate, login to your API Admin Interface and create an API account.
  623. Please specify the scope (active groups: domain) and assign the allowed IPs.
  624. ```
  625. export EUSERV_Username="99999.user123"
  626. export EUSERV_Password="Asbe54gHde"
  627. ```
  628. Ok, let's issue a cert now: (Be aware to use the `--insecure` flag, cause euserv.eu is still using self-signed certificates!)
  629. ```
  630. acme.sh --issue --dns dns_euserv -d example.com -d *.example.com --insecure
  631. ```
  632. The `EUSERV_Username` and `EUSERV_Password` will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
  633. Please report any issues to https://github.com/initit/acme.sh or to <github@initit.de>
  634. ## 48. Use DNSPod.com domain API to automatically issue cert
  635. First you need to get your API Key and ID by this [get-the-user-token](https://www.dnspod.com/docs/info.html#get-the-user-token).
  636. ```
  637. export DPI_Id="1234"
  638. export DPI_Key="sADDsdasdgdsf"
  639. ```
  640. Ok, let's issue a cert now:
  641. ```
  642. acme.sh --issue --dns dns_dpi -d example.com -d www.example.com
  643. ```
  644. The `DPI_Id` and `DPI_Key` will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
  645. ## 49. Use Google Cloud DNS API to automatically issue cert
  646. First you need to authenticate to gcloud.
  647. ```
  648. gcloud init
  649. ```
  650. **The `dns_gcloud` script uses the active gcloud configuration and credentials.**
  651. There is no logic inside `dns_gcloud` to override the project and other settings.
  652. If needed, create additional [gcloud configurations](https://cloud.google.com/sdk/gcloud/reference/topic/configurations).
  653. You can change the configuration being used without *activating* it; simply set the `CLOUDSDK_ACTIVE_CONFIG_NAME` environment variable.
  654. To issue a certificate you can:
  655. ```
  656. export CLOUDSDK_ACTIVE_CONFIG_NAME=default # see the note above
  657. acme.sh --issue --dns dns_gcloud -d example.com -d '*.example.com'
  658. ```
  659. `dns_gcloud` also supports [DNS alias mode](https://github.com/Neilpang/acme.sh/wiki/DNS-alias-mode).
  660. ## 50. Use ConoHa API
  661. First you need to login to your ConoHa account to get your API credentials.
  662. ```
  663. export CONOHA_Username="xxxxxx"
  664. export CONOHA_Password="xxxxxx"
  665. export CONOHA_TenantId="xxxxxx"
  666. export CONOHA_IdentityServiceApi="https://identity.xxxx.conoha.io/v2.0"
  667. ```
  668. To issue a cert:
  669. ```
  670. acme.sh --issue --dns dns_conoha -d example.com -d www.example.com
  671. ```
  672. The `CONOHA_Username`, `CONOHA_Password`, `CONOHA_TenantId` and `CONOHA_IdentityServiceApi` will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
  673. ## 51. Use netcup DNS API to automatically issue cert
  674. First you need to login in your CCP account to get your API Key and API Password.
  675. ```
  676. export NC_Apikey="<Apikey>"
  677. export NC_Apipw="<Apipassword>"
  678. export NC_CID="<Customernumber>"
  679. ```
  680. Now, let's issue a cert:
  681. ```
  682. acme.sh --issue --dns dns_netcup -d example.com -d www.example.com
  683. ```
  684. The `NC_Apikey`,`NC_Apipw` and `NC_CID` will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
  685. ## 52. Use GratisDNS.dk
  686. GratisDNS.dk (https://gratisdns.dk/) does not provide an API to update DNS records (other than IPv4 and IPv6
  687. dynamic DNS addresses). The acme.sh plugin therefore retrieves and updates domain TXT records by logging
  688. into the GratisDNS website to read the HTML and posting updates as HTTP. The plugin needs to know your
  689. userid and password for the GratisDNS website.
  690. ```sh
  691. export GDNSDK_Username="..."
  692. export GDNSDK_Password="..."
  693. ```
  694. The username and password will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
  695. Now you can issue a certificate.
  696. Note: It usually takes a few minutes (usually 3-4 minutes) before the changes propagates to gratisdns.dk nameservers (ns3.gratisdns.dk often are slow),
  697. and in rare cases I have seen over 5 minutes before google DNS catches it. Therefor a DNS sleep of at least 300 seconds are recommended-
  698. ```sh
  699. acme.sh --issue --dns dns_gdnsdk --dnssleep 300 -d example.com -d *.example.com
  700. ```
  701. ## 53. Use Namecheap
  702. You will need your namecheap username, API KEY (https://www.namecheap.com/support/api/intro.aspx) and your external IP address (or an URL to get it), this IP will need to be whitelisted at Namecheap.
  703. Due to Namecheap's API limitation all the records of your domain will be read and re applied, make sure to have a backup of your records you could apply if any issue would arise.
  704. ```sh
  705. export NAMECHEAP_USERNAME="..."
  706. export NAMECHEAP_API_KEY="..."
  707. export NAMECHEAP_SOURCEIP="..."
  708. ```
  709. NAMECHEAP_SOURCEIP can either be an IP address or an URL to provide it (e.g. https://ifconfig.co/ip).
  710. The username and password will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
  711. Now you can issue a certificate.
  712. ```sh
  713. acme.sh --issue --dns dns_namecheap -d example.com -d *.example.com
  714. ```
  715. ## 54. Use MyDNS.JP API
  716. First, register to MyDNS.JP and get MasterID and Password.
  717. ```
  718. export MYDNSJP_MasterID=MasterID
  719. export MYDNSJP_Password=Password
  720. ```
  721. To issue a certificate:
  722. ```
  723. acme.sh --issue --dns dns_mydnsjp -d example.com -d www.example.com
  724. ```
  725. The `MYDNSJP_MasterID` and `MYDNSJP_Password` will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
  726. ## 55. Use hosting.de API
  727. Create an API key in your hosting.de account here: https://secure.hosting.de
  728. The key needs the following rights:
  729. - DNS_ZONES_EDIT
  730. - DNS_ZONES_LIST
  731. Set your API Key and endpoint:
  732. ```
  733. export HOSTINGDE_APIKEY='xxx'
  734. export HOSTINGDE_ENDPOINT='https://secure.hosting.de'
  735. ```
  736. The plugin can also be used for the http.net API. http.net customers have to set endpoint to https://partner.http.net.
  737. Ok, let's issue a cert now:
  738. ```
  739. acme.sh --issue --dns dns_hostingde -d example.com -d *.example.com
  740. ```
  741. The hosting.de API key and endpoint will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
  742. ## 56. Use Neodigit.net API
  743. ```
  744. export NEODIGIT_API_TOKEN="eXJxTkdUVUZmcHQ3QWJackQ4ZGlMejRDSklRYmo5VG5zcFFKK2thYnE0WnVnNnMy"
  745. ```
  746. Ok, let's issue a cert now:
  747. ```
  748. acme.sh --issue --dns dns_neodigit -d example.com -d www.example.com
  749. ```
  750. Neodigit API Token will be saved in `~/.acme.sh/account.conf` and will be used when needed.
  751. # Use custom API
  752. If your API is not supported yet, you can write your own DNS API.
  753. Let's assume you want to name it 'myapi':
  754. 1. Create a bash script named `~/.acme.sh/dns_myapi.sh`,
  755. 2. In the script you must have a function named `dns_myapi_add()` which will be called by acme.sh to add the DNS records.
  756. 3. Then you can use your API to issue cert like this:
  757. ```
  758. acme.sh --issue --dns dns_myapi -d example.com -d www.example.com
  759. ```
  760. For more details, please check our sample script: [dns_myapi.sh](dns_myapi.sh)
  761. See: https://github.com/Neilpang/acme.sh/wiki/DNS-API-Dev-Guide
  762. # Use lexicon DNS API
  763. https://github.com/Neilpang/acme.sh/wiki/How-to-use-lexicon-dns-api