ZoneEdit DNS Authenticator plugin for Certbot.
This plugin automates the process of completing a DNS-01
challenge by creating, and subsequently removing,
TXT
records using the ZoneEdit API end-points.
pip install certbot-dns-zoneedit
To start using DNS authentication for ZoneEdit, pass the following arguments on Certbot's command line:
Option | Description |
---|---|
--authenticator dns-zoneedit |
Select the authenticator plugin (Required) |
--dns-zoneedit-credentials FILE |
ZoneEdit credentials INI file. (Default is /etc/letsencrypt/zoneedit.ini ) |
--dns-zoneedit-propagation-seconds NUM |
How long to wait before veryfing the written TXT challenges. (Default is 120 ) |
Use of this plugin requires a configuration file containing your ZoneEdit user name and authentication token.
The token can be obtained from the ZoneEdit DynDNS settings page.
An example zoneedit.ini
file:
dns_zoneedit_user = <login-user-id>
dns_zoneedit_token = <dyn-authentication-token>
The default path to this file is set to /etc/letsencrypt/zoneedit.ini
, but this can can be changed using the
--dns-zoneedit-credentials
command-line argument.
CAUTION: You should protect these API credentials as you would the password to your ZoneEdit account
(e.g., by using a command like chmod 600
to restrict access to the file).
To acquire a single certificate for both example.com
and *.example.com
, waiting 900 seconds for DNS propagation:
certbot certonly \
--authenticator dns-zoneedit \
--dns-zoneedit-credentials ~/.secrets/certbot/zoneedit.ini \
--dns-zoneedit-propagation-seconds 900 \
--keep-until-expiring --non-interactive --expand \
--server https://acme-v02.api.letsencrypt.org/directory \
-d 'example.com' \
-d '*.example.com'
You can build a docker image from source using the included Dockerfile
or pull the latest version directly from Docker Hub:
docker pull zlaski/certbot-dns-zoneedit
Once the installation is finished, the application can be run as follows:
docker run --rm \
-v /var/lib/letsencrypt:/var/lib/letsencrypt \
-v /etc/letsencrypt:/etc/letsencrypt \
--cap-drop=all \
zlaski/certbot-dns-zoneedit certbot certonly \
--authenticator dns-zoneedit \
--dns-zoneedit-propagation-seconds 900 \
--dns-zoneedit-credentials /var/lib/letsencrypt/zoneedit_credentials.ini \
--keep-until-expiring --non-interactive --expand \
--agree-tos --email "[email protected]" \
-d example.com -d '*.example.com'