# How to use DNS API ## 1. Use CloudFlare domain API to automatically issue cert First you need to login to your CloudFlare account to get your API key. ``` export CF_Key="sdfsdfsdfljlbjkljlkjsdfoiwje" export CF_Email="xxxx@sss.com" ``` Ok, let's issue a cert now: ``` acme.sh --issue --dns dns_cf -d example.com -d www.example.com ``` The `CF_Key` and `CF_Email` will be saved in `~/.acme.sh/account.conf` and will be reused when needed. ## 2. Use DNSPod.cn domain API to automatically issue cert First you need to login to your DNSPod account to get your API Key and ID. ``` export DP_Id="1234" export DP_Key="sADDsdasdgdsf" ``` Ok, let's issue a cert now: ``` acme.sh --issue --dns dns_dp -d example.com -d www.example.com ``` The `DP_Id` and `DP_Key` will be saved in `~/.acme.sh/account.conf` and will be reused when needed. ## 3. Use CloudXNS.com domain API to automatically issue cert First you need to login to your CloudXNS account to get your API Key and Secret. ``` export CX_Key="1234" export CX_Secret="sADDsdasdgdsf" ``` Ok, let's issue a cert now: ``` acme.sh --issue --dns dns_cx -d example.com -d www.example.com ``` The `CX_Key` and `CX_Secret` will be saved in `~/.acme.sh/account.conf` and will be reused when needed. ## 4. Use GoDaddy.com domain API to automatically issue cert First you need to login to your GoDaddy account to get your API Key and Secret. https://developer.godaddy.com/keys/ Please create a Production key, instead of a Test key. ``` export GD_Key="sdfsdfsdfljlbjkljlkjsdfoiwje" export GD_Secret="asdfsdafdsfdsfdsfdsfdsafd" ``` Ok, let's issue a cert now: ``` acme.sh --issue --dns dns_gd -d example.com -d www.example.com ``` The `GD_Key` and `GD_Secret` will be saved in `~/.acme.sh/account.conf` and will be reused when needed. ## 5. Use PowerDNS embedded API to automatically issue cert First you need to login to your PowerDNS account to enable the API and set your API-Token in the configuration. https://doc.powerdns.com/md/httpapi/README/ ``` export PDNS_Url="http://ns.example.com:8081" export PDNS_ServerId="localhost" export PDNS_Token="0123456789ABCDEF" export PDNS_Ttl=60 ``` Ok, let's issue a cert now: ``` acme.sh --issue --dns dns_pdns -d example.com -d www.example.com ``` The `PDNS_Url`, `PDNS_ServerId`, `PDNS_Token` and `PDNS_Ttl` will be saved in `~/.acme.sh/account.conf` and will be reused when needed. ## 6. Use OVH/kimsufi/soyoustart/runabove API to automatically issue cert https://github.com/Neilpang/acme.sh/wiki/How-to-use-OVH-domain-api ## 7. Use nsupdate to automatically issue cert First, generate a key for updating the zone ``` b=$(dnssec-keygen -a hmac-sha512 -b 512 -n USER -K /tmp foo) cat > /etc/named/keys/update.key < /etc/knot/acme.key ``` Include this key in your knot configuration file. ``` include: /etc/knot/acme.key ``` Next, configure your zone to allow dynamic updates. Dynamic updates for the zone are allowed via proper ACL rule with the `update` action. For in-depth instructions, please see [Knot DNS's documentation](https://www.knot-dns.cz/documentation/). ``` acl: - id: acme_acl address: 192.168.1.0/24 key: acme_key action: update zone: - domain: example.com file: example.com.zone acl: acme_acl ``` Finally, make the DNS server and TSIG Key available to `acme.sh` ``` export KNOT_SERVER="dns.example.com" export KNOT_KEY=`grep \# /etc/knot/acme.key | cut -d' ' -f2` ``` Ok, let's issue a cert now: ``` acme.sh --issue --dns dns_knot -d example.com -d www.example.com ``` The `KNOT_SERVER` and `KNOT_KEY` settings will be saved in `~/.acme.sh/account.conf` and will be reused when needed. ## 20. Use DigitalOcean API (native) You need to obtain a read and write capable API key from your DigitalOcean account. See: https://www.digitalocean.com/help/api/ ``` export DO_API_KEY="75310dc4ca779ac39a19f6355db573b49ce92ae126553ebd61ac3a3ae34834cc" ``` Ok, let's issue a cert now: ``` acme.sh --issue --dns dns_dgon -d example.com -d www.example.com ``` ## 21. Use ClouDNS.net API You need to set the HTTP API user ID and password credentials. See: https://www.cloudns.net/wiki/article/42/ ``` export CLOUDNS_AUTH_ID=XXXXX export CLOUDNS_AUTH_PASSWORD="YYYYYYYYY" ``` Ok, let's issue a cert now: ``` acme.sh --issue --dns dns_cloudns -d example.com -d www.example.com ``` ## 22. Use Infoblox API First you need to create/obtain API credentials on your Infoblox appliance. ``` export Infoblox_Creds="username:password" export Infoblox_Server="ip or fqdn of infoblox appliance" ``` Ok, let's issue a cert now: ``` acme.sh --issue --dns dns_infoblox -d example.com -d www.example.com ``` Note: This script will automatically create and delete the ephemeral txt record. The `Infoblox_Creds` and `Infoblox_Server` will be saved in `~/.acme.sh/account.conf` and will be reused when needed. ## 23. Use VSCALE API First you need to create/obtain API tokens on your [settings panel](https://vscale.io/panel/settings/tokens/). ``` VSCALE_API_KEY="sdfsdfsdfljlbjkljlkjsdfoiwje" ``` Ok, let's issue a cert now: ``` acme.sh --issue --dns dns_vscale -d example.com -d www.example.com ``` ## 24. Use Dynu API First you need to create/obtain API credentials from your Dynu account. See: https://www.dynu.com/resources/api/documentation ``` export Dynu_ClientId="xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" export Dynu_Secret="yyyyyyyyyyyyyyyyyyyyyyyyy" ``` Ok, let's issue a cert now: ``` acme.sh --issue --dns dns_dynu -d example.com -d www.example.com ``` The `Dynu_ClientId` and `Dynu_Secret` will be saved in `~/.acme.sh/account.conf` and will be reused when needed. ## 25. Use DNSimple API First you need to login to your DNSimple account and generate a new oauth token. https://dnsimple.com/a/{your account id}/account/access_tokens Note that this is an _account_ token and not a user token. The account token is needed to infer the `account_id` used in requests. A user token will not be able to determine the correct account to use. ``` export DNSimple_OAUTH_TOKEN="sdfsdfsdfljlbjkljlkjsdfoiwje" ``` To issue the cert just specify the `dns_dnsimple` API. ``` acme.sh --issue --dns dns_dnsimple -d example.com ``` The `DNSimple_OAUTH_TOKEN` will be saved in `~/.acme.sh/account.conf` and will be reused when needed. If you have any issues with this integration please report them to https://github.com/pho3nixf1re/acme.sh/issues. ## 26. Use NS1.com API ``` export NS1_Key="fdmlfsdklmfdkmqsdfk" ``` Ok, let's issue a cert now: ``` acme.sh --issue --dns dns_nsone -d example.com -d www.example.com ``` ## 27. Use DuckDNS.org API ``` export DuckDNS_Token="aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee" ``` Please note that since DuckDNS uses StartSSL as their cert provider, thus --insecure must be used when issuing certs: ``` acme.sh --insecure --issue --dns dns_duckdns -d mydomain.duckdns.org ``` Also, DuckDNS uses the domain name as username for recording changing, so the account file will always store the lastly used domain name. For issues, please report to https://github.com/raidenii/acme.sh/issues. ## 28. Use Name.com API You'll need to fill out the form at https://www.name.com/reseller/apply to apply for API username and token. ``` export Namecom_Username="testuser" export Namecom_Token="xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" ``` And now you can issue certs with: ``` acme.sh --issue --dns dns_namecom -d example.com -d www.example.com ``` For issues, please report to https://github.com/raidenii/acme.sh/issues. ## 29. Use Dyn Managed DNS API to automatically issue cert First, login to your Dyn Managed DNS account: https://portal.dynect.net/login/ It is recommended to add a new user specific for API access. The minimum "Zones & Records Permissions" required are: ``` RecordAdd RecordUpdate RecordDelete RecordGet ZoneGet ZoneAddNode ZoneRemoveNode ZonePublish ``` Pass the API user credentials to the environment: ``` export DYN_Customer="customer" export DYN_Username="apiuser" export DYN_Password="secret" ``` Ok, let's issue a cert now: ``` acme.sh --issue --dns dns_dyn -d example.com -d www.example.com ``` The `DYN_Customer`, `DYN_Username` and `DYN_Password` will be saved in `~/.acme.sh/account.conf` and will be reused when needed. # 30. Use Hurricane Electric Hurricane Electric doesn't have an API so just set your login credentials like so: ``` export HE_Username="yourusername" export HE_Password="password" ``` Then you can issue your certificate: ``` acme.sh --issue --dns dns_he -d example.com -d www.example.com ``` The `HE_Username` and `HE_Password` settings will be saved in `~/.acme.sh/account.conf` and will be reused when needed. Please report any issues to https://github.com/angel333/acme.sh or to . # Use custom API If your API is not supported yet, you can write your own DNS API. Let's assume you want to name it 'myapi': 1. Create a bash script named `~/.acme.sh/dns_myapi.sh`, 2. In the script you must have a function named `dns_myapi_add()` which will be called by acme.sh to add the DNS records. 3. Then you can use your API to issue cert like this: ``` acme.sh --issue --dns dns_myapi -d example.com -d www.example.com ``` For more details, please check our sample script: [dns_myapi.sh](dns_myapi.sh) # Use lexicon DNS API https://github.com/Neilpang/acme.sh/wiki/How-to-use-lexicon-dns-api