# How to use DNS API ## 1. Use CloudFlare domain API to automatically issue cert First you need to login to your CloudFlare account to get your API key. ``` export CF_Key="sdfsdfsdfljlbjkljlkjsdfoiwje" export CF_Email="xxxx@sss.com" ``` Ok, let's issue a cert now: ``` acme.sh --issue --dns dns_cf -d example.com -d www.example.com ``` The `CF_Key` and `CF_Email` will be saved in `~/.acme.sh/account.conf` and will be reused when needed. ## 2. Use DNSPod.cn domain API to automatically issue cert First you need to login to your DNSPod account to get your API Key and ID. ``` export DP_Id="1234" export DP_Key="sADDsdasdgdsf" ``` Ok, let's issue a cert now: ``` acme.sh --issue --dns dns_dp -d example.com -d www.example.com ``` The `DP_Id` and `DP_Key` will be saved in `~/.acme.sh/account.conf` and will be reused when needed. ## 3. Use CloudXNS.com domain API to automatically issue cert First you need to login to your CloudXNS account to get your API Key and Secret. ``` export CX_Key="1234" export CX_Secret="sADDsdasdgdsf" ``` Ok, let's issue a cert now: ``` acme.sh --issue --dns dns_cx -d example.com -d www.example.com ``` The `CX_Key` and `CX_Secret` will be saved in `~/.acme.sh/account.conf` and will be reused when needed. ## 4. Use GoDaddy.com domain API to automatically issue cert First you need to login to your GoDaddy account to get your API Key and Secret. https://developer.godaddy.com/keys/ Please create a Production key, instead of a Test key. ``` export GD_Key="sdfsdfsdfljlbjkljlkjsdfoiwje" export GD_Secret="asdfsdafdsfdsfdsfdsfdsafd" ``` Ok, let's issue a cert now: ``` acme.sh --issue --dns dns_gd -d example.com -d www.example.com ``` The `GD_Key` and `GD_Secret` will be saved in `~/.acme.sh/account.conf` and will be reused when needed. ## 5. Use PowerDNS embedded API to automatically issue cert First you need to login to your PowerDNS account to enable the API and set your API-Token in the configuration. https://doc.powerdns.com/md/httpapi/README/ ``` export PDNS_Url="http://ns.example.com:8081" export PDNS_ServerId="localhost" export PDNS_Token="0123456789ABCDEF" export PDNS_Ttl=60 ``` Ok, let's issue a cert now: ``` acme.sh --issue --dns dns_pdns -d example.com -d www.example.com ``` The `PDNS_Url`, `PDNS_ServerId`, `PDNS_Token` and `PDNS_Ttl` will be saved in `~/.acme.sh/account.conf` and will be reused when needed. ## 6. Use OVH/kimsufi/soyoustart/runabove API to automatically issue cert https://github.com/Neilpang/acme.sh/wiki/How-to-use-OVH-domain-api ## 7. Use nsupdate to automatically issue cert First, generate a key for updating the zone ``` b=$(dnssec-keygen -a hmac-sha512 -b 512 -n USER -K /tmp foo) cat > /etc/named/keys/update.key < /etc/knot/acme.key ``` Include this key in your knot configuration file. ``` include: /etc/knot/acme.key ``` Next, configure your zone to allow dynamic updates. Dynamic updates for the zone are allowed via proper ACL rule with the `update` action. For in-depth instructions, please see [Knot DNS's documentation](https://www.knot-dns.cz/documentation/). ``` acl: - id: acme_acl address: 192.168.1.0/24 key: acme_key action: update zone: - domain: example.com file: example.com.zone acl: acme_acl ``` Finally, make the DNS server and TSIG Key available to `acme.sh` ``` export KNOT_SERVER="dns.example.com" export KNOT_KEY=`grep \# /etc/knot/acme.key | cut -d' ' -f2` ``` Ok, let's issue a cert now: ``` acme.sh --issue --dns dns_knot -d example.com -d www.example.com ``` The `KNOT_SERVER` and `KNOT_KEY` settings will be saved in `~/.acme.sh/account.conf` and will be reused when needed. ## 20. Use DigitalOcean API (native) You need to obtain a read and write capable API key from your DigitalOcean account. See: https://www.digitalocean.com/help/api/ ``` export DO_API_KEY="75310dc4ca779ac39a19f6355db573b49ce92ae126553ebd61ac3a3ae34834cc" ``` Ok, let's issue a cert now: ``` acme.sh --issue --dns dns_dgon -d example.com -d www.example.com ``` ## 21. Use ClouDNS.net API You need to set the HTTP API user ID and password credentials. See: https://www.cloudns.net/wiki/article/42/ ``` export CLOUDNS_AUTH_ID=XXXXX export CLOUDNS_AUTH_PASSWORD="YYYYYYYYY" ``` Ok, let's issue a cert now: ``` acme.sh --issue --dns dns_cloudns -d example.com -d www.example.com ``` ## 22. Use Infoblox API First you need to create/obtain API credentials on your Infoblox appliance. ``` export Infoblox_Creds="username:password" export Infoblox_Server="ip or fqdn of infoblox appliance" ``` Ok, let's issue a cert now: ``` acme.sh --issue --dns dns_infoblox -d example.com -d www.example.com ``` Note: This script will automatically create and delete the ephemeral txt record. The `Infoblox_Creds` and `Infoblox_Server` will be saved in `~/.acme.sh/account.conf` and will be reused when needed. ## 23. Use Dynu API First you need to create/obtain API credentials from your Dynu account. See: https://www.dynu.com/resources/api/documentation ``` export Dynu_ClientId="xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" export Dynu_Secret="yyyyyyyyyyyyyyyyyyyyyyyyy" ``` Ok, let's issue a cert now: ``` acme.sh --issue --dns dns_dynu -d example.com -d www.example.com ``` The `Dynu_ClientId` and `Dynu_Secret` will be saved in `~/.acme.sh/account.conf` and will be reused when needed. # Use custom API If your API is not supported yet, you can write your own DNS API. Let's assume you want to name it 'myapi': 1. Create a bash script named `~/.acme.sh/dns_myapi.sh`, 2. In the script you must have a function named `dns_myapi_add()` which will be called by acme.sh to add the DNS records. 3. Then you can use your API to issue cert like this: ``` acme.sh --issue --dns dns_myapi -d example.com -d www.example.com ``` For more details, please check our sample script: [dns_myapi.sh](dns_myapi.sh) # Use lexicon DNS API https://github.com/Neilpang/acme.sh/wiki/How-to-use-lexicon-dns-api