44
Not found
Whoops. Looks like this page doesn't exist ¯\_(ツ)_/¯.
Whoops. Looks like this page doesn't exist ¯\_(ツ)_/¯.
Configuration for Joohoi’s ACME-DNS.
acme-dnsHere is an example bash command using the Joohoi’s ACME-DNS provider:
ACME_DNS_API_BASE=http://10.0.0.8:4443 \
ACME_DNS_STORAGE_PATH=/root/.lego-acme-dns-accounts.json \
lego --email you@example.com --dns "acme-dns" -d '*.example.com' -d example.com run
# or
ACME_DNS_API_BASE=http://10.0.0.8:4443 \
ACME_DNS_STORAGE_BASE_URL=http://10.10.10.10:80 \
lego --email you@example.com --dns "acme-dns" -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
ACME_DNS_API_BASE |
The ACME-DNS API address |
ACME_DNS_STORAGE_BASE_URL |
The ACME-DNS JSON account data server. |
ACME_DNS_STORAGE_PATH |
The ACME-DNS JSON account data file. A per-domain account will be registered/persisted to this file and used for TXT updates. |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
ACME_DNS_ALLOWLIST |
Source networks using CIDR notation (multiple values should be separated with a comma). |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for Active24.
active24Here is an example bash command using the Active24 provider:
ACTIVE24_API_KEY="xxx" \
ACTIVE24_SECRET="yyy" \
lego --email you@example.com --dns active24 -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
ACTIVE24_API_KEY |
API key |
ACTIVE24_SECRET |
Secret |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
ACTIVE24_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
ACTIVE24_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
ACTIVE24_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 60) |
ACTIVE24_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 120) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for Alibaba Cloud DNS.
alidnsHere is an example bash command using the Alibaba Cloud DNS provider:
# Setup using instance RAM role
ALICLOUD_RAM_ROLE=lego \
lego --email you@example.com --dns alidns -d '*.example.com' -d example.com run
# Or, using credentials
ALICLOUD_ACCESS_KEY=abcdefghijklmnopqrstuvwx \
ALICLOUD_SECRET_KEY=your-secret-key \
ALICLOUD_SECURITY_TOKEN=your-sts-token \
lego --email you@example.com --dns alidns - -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
ALICLOUD_ACCESS_KEY |
Access key ID |
ALICLOUD_RAM_ROLE |
Your instance RAM role (https://www.alibabacloud.com/help/en/ecs/user-guide/attach-an-instance-ram-role-to-an-ecs-instance) |
ALICLOUD_SECRET_KEY |
Access Key secret |
ALICLOUD_SECURITY_TOKEN |
STS Security Token (optional) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
ALICLOUD_HTTP_TIMEOUT |
API request timeout in seconds (Default: 10) |
ALICLOUD_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
ALICLOUD_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 60) |
ALICLOUD_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 600) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for all-inkl.
allinklHere is an example bash command using the all-inkl provider:
ALL_INKL_LOGIN=xxxxxxxxxxxxxxxxxxxxxxxxxx \
ALL_INKL_PASSWORD=yyyyyyyyyyyyyyyyyyyyyyyyyy \
lego --email you@example.com --dns allinkl -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
ALL_INKL_LOGIN |
KAS login |
ALL_INKL_PASSWORD |
KAS password |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
ALL_INKL_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
ALL_INKL_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
ALL_INKL_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 60) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for Anexia CloudDNS.
anexiaHere is an example bash command using the Anexia CloudDNS provider:
ANEXIA_TOKEN=xxx \
lego --email you@example.com --dns anexia -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
ANEXIA_TOKEN |
API token for Anexia Engine |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
ANEXIA_API_URL |
API endpoint URL (default: https://engine.anexia-it.com) |
ANEXIA_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
ANEXIA_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
ANEXIA_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 300) |
ANEXIA_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 300) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
You need to create an API token in the Anexia Engine.
The token must have permissions to manage DNS zones and records.
Configuration for ArvanCloud.
arvancloudHere is an example bash command using the ArvanCloud provider:
ARVANCLOUD_API_KEY="Apikey xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" \
lego --email you@example.com --dns arvancloud -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
ARVANCLOUD_API_KEY |
API key |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
ARVANCLOUD_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
ARVANCLOUD_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
ARVANCLOUD_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 120) |
ARVANCLOUD_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 600) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for Aurora DNS.
auroradnsHere is an example bash command using the Aurora DNS provider:
AURORA_API_KEY=xxxxx \
AURORA_SECRET=yyyyyy \
lego --email you@example.com --dns auroradns -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
AURORA_API_KEY |
API key or username to used |
AURORA_SECRET |
Secret password to be used |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
AURORA_ENDPOINT |
API endpoint URL |
AURORA_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
AURORA_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 60) |
AURORA_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 300) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for Autodns.
autodnsHere is an example bash command using the Autodns provider:
AUTODNS_API_USER=username \
AUTODNS_API_PASSWORD=supersecretpassword \
lego --email you@example.com --dns autodns -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
AUTODNS_API_PASSWORD |
User Password |
AUTODNS_API_USER |
Username |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
AUTODNS_CONTEXT |
API context (4 for production, 1 for testing. Defaults to 4) |
AUTODNS_ENDPOINT |
API endpoint URL, defaults to https://api.autodns.com/v1/ |
AUTODNS_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
AUTODNS_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
AUTODNS_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 120) |
AUTODNS_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 600) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for Axelname.
axelnameHere is an example bash command using the Axelname provider:
AXELNAME_NICKNAME="yyy" \
AXELNAME_TOKEN="xxx" \
lego --email you@example.com --dns axelname -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
AXELNAME_NICKNAME |
Account nickname |
AXELNAME_TOKEN |
API token |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
AXELNAME_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
AXELNAME_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
AXELNAME_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 60) |
AXELNAME_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 120) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for Azion.
azionHere is an example bash command using the Azion provider:
AZION_PERSONAL_TOKEN=xxxxxxxxxxxxxxxxxxxxxxxxxx \
lego --email you@example.com --dns azion -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
AZION_PERSONAL_TOKEN |
Your Azion personal token. |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
AZION_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
AZION_PAGE_SIZE |
The page size for the API request (Default: 50) |
AZION_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
AZION_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 60) |
AZION_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 120) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for Azure (deprecated).
azurePlease contribute by adding a CLI example.
| Environment Variable Name | Description |
|---|---|
AZURE_CLIENT_ID |
Client ID |
AZURE_CLIENT_SECRET |
Client secret |
AZURE_ENVIRONMENT |
Azure environment, one of: public, usgovernment, german, and china |
AZURE_RESOURCE_GROUP |
Resource group |
AZURE_SUBSCRIPTION_ID |
Subscription ID |
AZURE_TENANT_ID |
Tenant ID |
instance metadata service |
If the credentials are not set via the environment, then it will attempt to get a bearer token via the instance metadata service. |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
AZURE_METADATA_ENDPOINT |
Metadata Service endpoint URL |
AZURE_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
AZURE_PRIVATE_ZONE |
Set to true to use Azure Private DNS Zones and not public |
AZURE_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 120) |
AZURE_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 60) |
AZURE_ZONE_NAME |
Zone name to use inside Azure DNS service to add the TXT record in |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for Azure DNS.
azurednsHere is an example bash command using the Azure DNS provider:
### Using client secret
AZURE_CLIENT_ID=<your service principal client ID> \
AZURE_TENANT_ID=<your service principal tenant ID> \
AZURE_CLIENT_SECRET=<your service principal client secret> \
lego --email you@example.com --dns azuredns -d '*.example.com' -d example.com run
### Using client certificate
AZURE_CLIENT_ID=<your service principal client ID> \
AZURE_TENANT_ID=<your service principal tenant ID> \
AZURE_CLIENT_CERTIFICATE_PATH=<your service principal certificate path> \
lego --email you@example.com --dns azuredns -d '*.example.com' -d example.com run
### Using Azure CLI
az login \
lego --email you@example.com --dns azuredns -d '*.example.com' -d example.com run
### Using Managed Identity (Azure VM)
AZURE_TENANT_ID=<your service principal tenant ID> \
AZURE_RESOURCE_GROUP=<your target zone resource group name> \
lego --email you@example.com --dns azuredns -d '*.example.com' -d example.com run
### Using Managed Identity (Azure Arc)
AZURE_TENANT_ID=<your service principal tenant ID> \
IMDS_ENDPOINT=http://localhost:40342 \
IDENTITY_ENDPOINT=http://localhost:40342/metadata/identity/oauth2/token \
lego --email you@example.com --dns azuredns -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
AZURE_CLIENT_CERTIFICATE_PATH |
Client certificate path |
AZURE_CLIENT_ID |
Client ID |
AZURE_CLIENT_SECRET |
Client secret |
AZURE_TENANT_ID |
Tenant ID |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
AZURE_AUTH_METHOD |
Specify which authentication method to use |
AZURE_AUTH_MSI_TIMEOUT |
Managed Identity timeout duration |
AZURE_ENVIRONMENT |
Azure environment, one of: public, usgovernment, and china |
AZURE_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
AZURE_PRIVATE_ZONE |
Set to true to use Azure Private DNS Zones and not public |
AZURE_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 120) |
AZURE_RESOURCE_GROUP |
DNS zone resource group |
AZURE_SERVICEDISCOVERY_FILTER |
Advanced ServiceDiscovery filter using Kusto query condition |
AZURE_SUBSCRIPTION_ID |
DNS zone subscription ID |
AZURE_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 60) |
AZURE_ZONE_NAME |
Zone name to use inside Azure DNS service to add the TXT record in |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Several authentication methods can be used to authenticate against Azure DNS API.
Default Azure Credentials automatically detects in the following locations and prioritized in the following order:
AZURE_CLIENT_ID, AZURE_TENANT_ID, AZURE_CLIENT_SECRETAZURE_CLIENT_ID, AZURE_TENANT_ID, AZURE_CLIENT_CERTIFICATE_PATH~/.azure folder), used by Azure CLILink:
Lego automatically finds all visible Azure (private) DNS zones using Azure ResourceGraph query.
This can be limited by specifying environment variable AZURE_SUBSCRIPTION_ID and/or AZURE_RESOURCE_GROUP which limits the
DNS zones to only a subscription or to one resourceGroup.
Additionally environment variable AZURE_SERVICEDISCOVERY_FILTER can be used to filter DNS zones with an addition Kusto filter eg:
resources
| where type =~ "microsoft.network/dnszones"
| ${AZURE_SERVICEDISCOVERY_FILTER}
| project subscriptionId, resourceGroup, nameThe Azure Credentials can be configured using the following environment variables:
This authentication method can be specifically used by setting the AZURE_AUTH_METHOD environment variable to env.
The Azure Credentials can be configured using the following environment variables:
This authentication method can be specifically used by setting the AZURE_AUTH_METHOD environment variable to env.
Workload identity allows workloads running Azure Kubernetes Services (AKS) clusters to authenticate as an Azure AD application identity using federated credentials.
This must be configured in kubernetes workload deployment in one hand and on the Azure AD application registration in the other hand.
Here is a summary of the steps to follow to use it :
ServiceAccount resource, add following annotations to reference the targeted Azure AD application registration : azure.workload.identity/client-id and azure.workload.identity/tenant-id.Deployment resource you must reference the previous ServiceAccount and add the following label : azure.workload.identity/use: "true".Kubernetes accessing Azure resources, add the cluster issuer URL and add the namespace and name of your kubernetes service account.Link :
This authentication method can be specifically used by setting the AZURE_AUTH_METHOD environment variable to wli.
The Azure Managed Identity service allows linking Azure AD identities to Azure resources, without needing to manually manage client IDs and secrets.
Workloads with a Managed Identity can manage their own certificates, with permissions on specific domain names set using IAM assignments.
For this to work, the Managed Identity requires the Reader role on the target DNS Zone,
and the DNS Zone Contributor on the relevant _acme-challenge TXT records.
For example, to allow a Managed Identity to create a certificate for “fw01.lab.example.com”, using Azure CLI:
export AZURE_SUBSCRIPTION_ID="00000000-0000-0000-0000-000000000000"
export AZURE_RESOURCE_GROUP="rg1"
export SERVICE_PRINCIPAL_ID="00000000-0000-0000-0000-000000000000"
export AZURE_DNS_ZONE="lab.example.com"
export AZ_HOSTNAME="fw01"
export AZ_RECORD_SET="_acme-challenge.${AZ_HOSTNAME}"
az role assignment create \
--assignee "${SERVICE_PRINCIPAL_ID}" \
--role "Reader" \
--scope "/subscriptions/${AZURE_SUBSCRIPTION_ID}/resourceGroups/${AZURE_RESOURCE_GROUP}/providers/Microsoft.Network/dnszones/${AZURE_DNS_ZONE}"
az role assignment create \
--assignee "${SERVICE_PRINCIPAL_ID}" \
--role "DNS Zone Contributor" \
--scope "/subscriptions/${AZURE_SUBSCRIPTION_ID}/resourceGroups/${AZURE_RESOURCE_GROUP}/providers/Microsoft.Network/dnszones/${AZURE_DNS_ZONE}/TXT/${AZ_RECORD_SET}"A timeout wrapper is configured for this authentication method.
The duration can be configured by setting the AZURE_AUTH_MSI_TIMEOUT.
The default timeout is 2 seconds.
This authentication method can be specifically used by setting the AZURE_AUTH_METHOD environment variable to msi.
The Azure Arc agent provides the ability to use a Managed Identity on resources hosted outside of Azure (such as on-prem virtual machines, or VMs in another cloud provider).
While the upstream azidentity SDK will try to automatically identify and use the Azure Arc metadata service,
if you get azuredns: DefaultAzureCredential: failed to acquire a token. error messages,
you may need to set the environment variables:
IMDS_ENDPOINT=http://localhost:40342IDENTITY_ENDPOINT=http://localhost:40342/metadata/identity/oauth2/tokenA timeout wrapper is configured for this authentication method.
The duration can be configured by setting the AZURE_AUTH_MSI_TIMEOUT.
The default timeout is 2 seconds.
This authentication method can be specifically used by setting the AZURE_AUTH_METHOD environment variable to msi.
The Azure CLI is a command-line tool provided by Microsoft to interact with Azure resources.
It provides an easy way to authenticate by simply running az login command.
The generated token will be cached by default in the ~/.azure folder.
This authentication method can be specifically used by setting the AZURE_AUTH_METHOD environment variable to cli.
Open ID Connect is a mechanism that establish a trust relationship between a running environment and the Azure AD identity provider.
It can be enabled by setting the AZURE_AUTH_METHOD environment variable to oidc.
It can be enabled by setting the AZURE_AUTH_METHOD environment variable to pipeline.
Configuration for Baidu Cloud.
baiducloudHere is an example bash command using the Baidu Cloud provider:
BAIDUCLOUD_ACCESS_KEY_ID="xxx" \
BAIDUCLOUD_SECRET_ACCESS_KEY="yyy" \
lego --email you@example.com --dns baiducloud -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
BAIDUCLOUD_ACCESS_KEY_ID |
Access key |
BAIDUCLOUD_SECRET_ACCESS_KEY |
Secret access key |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
BAIDUCLOUD_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
BAIDUCLOUD_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 60) |
BAIDUCLOUD_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 120) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for Beget.com.
begetHere is an example bash command using the Beget.com provider:
BEGET_USERNAME=xxxxxx \
BEGET_PASSWORD=yyyyyy \
lego --email you@example.com --dns beget -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
BEGET_PASSWORD |
API password |
BEGET_USERNAME |
API username |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
BEGET_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
BEGET_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 30) |
BEGET_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 300) |
BEGET_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 120) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for Binary Lane.
binarylaneHere is an example bash command using the Binary Lane provider:
BINARYLANE_API_TOKEN="xxxxxxxxxxxxxxxxxxxxx" \
lego --email you@example.com --dns binarylane -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
BINARYLANE_API_TOKEN |
API token |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
BINARYLANE_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
BINARYLANE_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
BINARYLANE_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 60) |
BINARYLANE_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 120) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for Bindman.
bindmanHere is an example bash command using the Bindman provider:
BINDMAN_MANAGER_ADDRESS=<your bindman manager address> \
lego --email you@example.com --dns bindman -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
BINDMAN_MANAGER_ADDRESS |
The server URL, should have scheme, hostname, and port (if required) of the Bindman-DNS Manager server |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
BINDMAN_HTTP_TIMEOUT |
API request timeout in seconds (Default: 60) |
BINDMAN_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
BINDMAN_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 60) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for Bluecat.
bluecatHere is an example bash command using the Bluecat provider:
BLUECAT_PASSWORD=mypassword \
BLUECAT_DNS_VIEW=myview \
BLUECAT_USER_NAME=myusername \
BLUECAT_CONFIG_NAME=myconfig \
BLUECAT_SERVER_URL=https://bam.example.com \
BLUECAT_TTL=30 \
lego --email you@example.com --dns bluecat -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
BLUECAT_CONFIG_NAME |
Configuration name |
BLUECAT_DNS_VIEW |
External DNS View Name |
BLUECAT_PASSWORD |
API password |
BLUECAT_SERVER_URL |
The server URL, should have scheme, hostname, and port (if required) of the authoritative Bluecat BAM serve |
BLUECAT_USER_NAME |
API username |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
BLUECAT_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
BLUECAT_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
BLUECAT_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 60) |
BLUECAT_SKIP_DEPLOY |
Skip deployements |
BLUECAT_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 120) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for BookMyName.
bookmynameHere is an example bash command using the BookMyName provider:
BOOKMYNAME_USERNAME="xxx" \
BOOKMYNAME_PASSWORD="yyy" \
lego --email you@example.com --dns bookmyname -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
BOOKMYNAME_PASSWORD |
Password |
BOOKMYNAME_USERNAME |
Username |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
BOOKMYNAME_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
BOOKMYNAME_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
BOOKMYNAME_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 60) |
BOOKMYNAME_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 120) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Brandit has been acquired by Abion. Abion has a different API.
If you are a Brandit/Albion user, you can try the PR https://github.com/go-acme/lego/pull/2112.
branditHere is an example bash command using the Brandit (deprecated) provider:
BRANDIT_API_KEY=xxxxxxxxxxxxxxxxxxxxx \
BRANDIT_API_USERNAME=yyyyyyyyyyyyyyyyyyyy \
lego --email you@example.com --dns brandit -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
BRANDIT_API_KEY |
The API key |
BRANDIT_API_USERNAME |
The API username |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
BRANDIT_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
BRANDIT_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
BRANDIT_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 600) |
BRANDIT_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 600) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for Bunny.
bunnyHere is an example bash command using the Bunny provider:
BUNNY_API_KEY=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxxxxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx \
lego --email you@example.com --dns bunny -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
BUNNY_API_KEY |
API key |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
BUNNY_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
BUNNY_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
BUNNY_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 120) |
BUNNY_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 60) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for Checkdomain.
checkdomainHere is an example bash command using the Checkdomain provider:
CHECKDOMAIN_TOKEN=yoursecrettoken \
lego --email you@example.com --dns checkdomain -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
CHECKDOMAIN_TOKEN |
API token |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
CHECKDOMAIN_ENDPOINT |
API endpoint URL, defaults to https://api.checkdomain.de |
CHECKDOMAIN_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
CHECKDOMAIN_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 300) |
CHECKDOMAIN_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 7) |
CHECKDOMAIN_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 300) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for Civo.
civoHere is an example bash command using the Civo provider:
CIVO_TOKEN=xxxxxx \
lego --email you@example.com --dns civo -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
CIVO_TOKEN |
Authentication token |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
CIVO_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 30) |
CIVO_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 300) |
CIVO_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 600) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for CloudDNS.
clouddnsHere is an example bash command using the CloudDNS provider:
CLOUDDNS_CLIENT_ID=bLsdFAks23429841238feb177a572aX \
CLOUDDNS_EMAIL=you@example.com \
CLOUDDNS_PASSWORD=b9841238feb177a84330f \
lego --email you@example.com --dns clouddns -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
CLOUDDNS_CLIENT_ID |
Client ID |
CLOUDDNS_EMAIL |
Account email |
CLOUDDNS_PASSWORD |
Account password |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
CLOUDDNS_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
CLOUDDNS_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 5) |
CLOUDDNS_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 120) |
CLOUDDNS_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 300) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for Cloudflare.
cloudflareHere is an example bash command using the Cloudflare provider:
CLOUDFLARE_EMAIL=you@example.com \
CLOUDFLARE_API_KEY=b9841238feb177a84330febba8a83208921177bffe733 \
lego --email you@example.com --dns cloudflare -d '*.example.com' -d example.com run
# or
CLOUDFLARE_DNS_API_TOKEN=1234567890abcdefghijklmnopqrstuvwxyz \
lego --email you@example.com --dns cloudflare -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
CF_API_EMAIL |
Account email |
CF_API_KEY |
API key |
CF_DNS_API_TOKEN |
API token with DNS:Edit permission (since v3.1.0) |
CF_ZONE_API_TOKEN |
API token with Zone:Read permission (since v3.1.0) |
CLOUDFLARE_API_KEY |
Alias to CF_API_KEY |
CLOUDFLARE_DNS_API_TOKEN |
Alias to CF_DNS_API_TOKEN |
CLOUDFLARE_EMAIL |
Alias to CF_API_EMAIL |
CLOUDFLARE_ZONE_API_TOKEN |
Alias to CF_ZONE_API_TOKEN |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
CLOUDFLARE_BASE_URL |
API base URL (Default: https://api.cloudflare.com/client/v4) |
CLOUDFLARE_HTTP_TIMEOUT |
API request timeout in seconds (Default: ) |
CLOUDFLARE_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
CLOUDFLARE_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 120) |
CLOUDFLARE_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 120) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
You may use CF_API_EMAIL and CF_API_KEY to authenticate, or CF_DNS_API_TOKEN, or CF_DNS_API_TOKEN and CF_ZONE_API_TOKEN.
If using API keys (CF_API_EMAIL and CF_API_KEY), the Global API Key needs to be used, not the Origin CA Key.
Please be aware, that this in principle allows Lego to read and change everything related to this account.
With API tokens (CF_DNS_API_TOKEN, and optionally CF_ZONE_API_TOKEN),
very specific access can be granted to your resources at Cloudflare.
See this Cloudflare announcement for details.
The main resources Lego cares for are the DNS entries for your Zones. It also needs to resolve a domain name to an internal Zone ID in order to manipulate DNS entries.
Hence, you should create an API token with the following permissions:
You also need to scope the access to all your domains for this to work.
Then pass the API token as CF_DNS_API_TOKEN to Lego.
Alternatively, if you prefer a more strict set of privileges, you can split the access tokens:
CF_ZONE_API_TOKEN to Lego.CF_DNS_API_TOKEN to Lego.Zone:Read and DNS:Edit permission for the zone.This “paranoid” setup is mainly interesting for users who manage many zones/domains with a single Cloudflare account. It follows the principle of least privilege and limits the possible damage, should one of the hosts become compromised.
Configuration for ClouDNS.
cloudnsHere is an example bash command using the ClouDNS provider:
CLOUDNS_AUTH_ID=xxxx \
CLOUDNS_AUTH_PASSWORD=yyyy \
lego --email you@example.com --dns cloudns -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
CLOUDNS_AUTH_ID |
The API user ID |
CLOUDNS_AUTH_PASSWORD |
The password for API user ID |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
CLOUDNS_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
CLOUDNS_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 10) |
CLOUDNS_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 180) |
CLOUDNS_SUB_AUTH_ID |
The API sub user ID |
CLOUDNS_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 60) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for Cloud.ru.
cloudruHere is an example bash command using the Cloud.ru provider:
CLOUDRU_SERVICE_INSTANCE_ID=ppp \
CLOUDRU_KEY_ID=xxx \
CLOUDRU_SECRET=yyy \
lego --email you@example.com --dns cloudru -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
CLOUDRU_KEY_ID |
Key ID (login) |
CLOUDRU_SECRET |
Key Secret |
CLOUDRU_SERVICE_INSTANCE_ID |
Service Instance ID (parentId) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
CLOUDRU_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
CLOUDRU_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 5) |
CLOUDRU_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 300) |
CLOUDRU_SEQUENCE_INTERVAL |
Time between sequential requests in seconds (Default: 120) |
CLOUDRU_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 120) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
The CloudXNS DNS provider has shut down.
cloudxnsHere is an example bash command using the CloudXNS (Deprecated) provider:
CLOUDXNS_API_KEY=xxxx \
CLOUDXNS_SECRET_KEY=yyyy \
lego --email you@example.com --dns cloudxns -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
CLOUDXNS_API_KEY |
The API key |
CLOUDXNS_SECRET_KEY |
The API secret key |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
CLOUDXNS_HTTP_TIMEOUT |
API request timeout in seconds (Default: ) |
CLOUDXNS_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: ) |
CLOUDXNS_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: ) |
CLOUDXNS_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: ) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for ConoHa v2.
conohaHere is an example bash command using the ConoHa v2 provider:
CONOHA_TENANT_ID=487727e3921d44e3bfe7ebb337bf085e \
CONOHA_API_USERNAME=xxxx \
CONOHA_API_PASSWORD=yyyy \
lego --email you@example.com --dns conoha -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
CONOHA_API_PASSWORD |
The API password |
CONOHA_API_USERNAME |
The API username |
CONOHA_TENANT_ID |
Tenant ID |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
CONOHA_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
CONOHA_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
CONOHA_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 60) |
CONOHA_REGION |
The region (Default: tyo1) |
CONOHA_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 60) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for ConoHa v3.
conohav3Here is an example bash command using the ConoHa v3 provider:
CONOHAV3_TENANT_ID=487727e3921d44e3bfe7ebb337bf085e \
CONOHAV3_API_USER_ID=xxxx \
CONOHAV3_API_PASSWORD=yyyy \
lego --email you@example.com --dns conohav3 -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
CONOHAV3_API_PASSWORD |
The API password |
CONOHAV3_API_USER_ID |
The API user ID |
CONOHAV3_TENANT_ID |
Tenant ID |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
CONOHAV3_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
CONOHAV3_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
CONOHAV3_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 60) |
CONOHAV3_REGION |
The region (Default: c3j1) |
CONOHAV3_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 60) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for Constellix.
constellixHere is an example bash command using the Constellix provider:
CONSTELLIX_API_KEY=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx \
CONSTELLIX_SECRET_KEY=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx \
lego --email you@example.com --dns constellix -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
CONSTELLIX_API_KEY |
User API key |
CONSTELLIX_SECRET_KEY |
User secret key |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
CONSTELLIX_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
CONSTELLIX_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 10) |
CONSTELLIX_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 60) |
CONSTELLIX_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 60) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for Core-Networks.
corenetworksHere is an example bash command using the Core-Networks provider:
CORENETWORKS_LOGIN="xxxx" \
CORENETWORKS_PASSWORD="yyyy" \
lego --email you@example.com --dns corenetworks -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
CORENETWORKS_LOGIN |
The username of the API account |
CORENETWORKS_PASSWORD |
The password |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
CORENETWORKS_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
CORENETWORKS_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
CORENETWORKS_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 60) |
CORENETWORKS_SEQUENCE_INTERVAL |
Time between sequential requests in seconds (Default: 60) |
CORENETWORKS_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 3600) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for CPanel/WHM.
cpanelHere is an example bash command using the CPanel/WHM provider:
### CPANEL (default)
CPANEL_USERNAME="yyyy" \
CPANEL_TOKEN="xxxx" \
CPANEL_BASE_URL="https://example.com:2083" \
lego --email you@example.com --dns cpanel -d '*.example.com' -d example.com run
## WHM
CPANEL_MODE=whm \
CPANEL_USERNAME="yyyy" \
CPANEL_TOKEN="xxxx" \
CPANEL_BASE_URL="https://example.com:2087" \
lego --email you@example.com --dns cpanel -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
CPANEL_BASE_URL |
API server URL |
CPANEL_TOKEN |
API token |
CPANEL_USERNAME |
username |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
CPANEL_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
CPANEL_MODE |
use cpanel API or WHM API (Default: cpanel) |
CPANEL_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
CPANEL_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 120) |
CPANEL_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 300) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for Derak Cloud.
derakHere is an example bash command using the Derak Cloud provider:
DERAK_API_KEY="xxxxxxxxxxxxxxxxxxxxx" \
lego --email you@example.com --dns derak -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
DERAK_API_KEY |
The API key |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
DERAK_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
DERAK_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 5) |
DERAK_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 120) |
DERAK_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 120) |
DERAK_WEBSITE_ID |
Force the zone/website ID |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for deSEC.io.
desecHere is an example bash command using the deSEC.io provider:
DESEC_TOKEN=x-xxxxxxxxxxxxxxxxxxxxxxxxxx \
lego --email you@example.com --dns desec -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
DESEC_TOKEN |
Domain token |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
DESEC_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
DESEC_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 4) |
DESEC_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 120) |
DESEC_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 3600) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for Designate DNSaaS for Openstack.
designateHere is an example bash command using the Designate DNSaaS for Openstack provider:
# With a `clouds.yaml`
OS_CLOUD=my_openstack \
lego --email you@example.com --dns designate -d '*.example.com' -d example.com run
# or
OS_AUTH_URL=https://openstack.example.org \
OS_REGION_NAME=RegionOne \
OS_PROJECT_ID=23d4522a987d4ab529f722a007c27846
OS_USERNAME=myuser \
OS_PASSWORD=passw0rd \
lego --email you@example.com --dns designate -d '*.example.com' -d example.com run
# or
OS_AUTH_URL=https://openstack.example.org \
OS_REGION_NAME=RegionOne \
OS_AUTH_TYPE=v3applicationcredential \
OS_APPLICATION_CREDENTIAL_ID=imn74uq0or7dyzz20dwo1ytls4me8dry \
OS_APPLICATION_CREDENTIAL_SECRET=68FuSPSdQqkFQYH5X1OoriEIJOwyLtQ8QSqXZOc9XxFK1A9tzZT6He2PfPw0OMja \
lego --email you@example.com --dns designate -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
OS_APPLICATION_CREDENTIAL_ID |
Application credential ID |
OS_APPLICATION_CREDENTIAL_NAME |
Application credential name |
OS_APPLICATION_CREDENTIAL_SECRET |
Application credential secret |
OS_AUTH_URL |
Identity endpoint URL |
OS_PASSWORD |
Password |
OS_PROJECT_NAME |
Project name |
OS_REGION_NAME |
Region name |
OS_USERNAME |
Username |
OS_USER_ID |
User ID |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
DESIGNATE_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 10) |
DESIGNATE_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 600) |
DESIGNATE_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 10) |
DESIGNATE_ZONE_NAME |
The zone name to use in the OpenStack Project to manage TXT records. |
OS_PROJECT_ID |
Project ID |
OS_TENANT_NAME |
Tenant name (deprecated see OS_PROJECT_NAME and OS_PROJECT_ID) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
There are three main ways of authenticating with Designate:
OS_CLOUD environment variable and a clouds.yaml file.OS_USERNAME, OS_PASSWORD and OS_PROJECT_NAME environment variables.OS_APPLICATION_CREDENTIAL_* and OS_USER_ID environment variables.For the username/password and application methods, the OS_AUTH_URL and OS_REGION_NAME environment variables are required.
For more information, you can read about the different methods of authentication with OpenStack in the Keystone’s documentation and the gophercloud documentation:
Public cloud providers with support for Designate:
Configuration for Digital Ocean.
digitaloceanHere is an example bash command using the Digital Ocean provider:
DO_AUTH_TOKEN=xxxxxx \
lego --email you@example.com --dns digitalocean -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
DO_AUTH_TOKEN |
Authentication token |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
DO_API_URL |
The URL of the API |
DO_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
DO_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 5) |
DO_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 60) |
DO_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 30) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for DirectAdmin.
directadminHere is an example bash command using the DirectAdmin provider:
DIRECTADMIN_API_URL="http://example.com:2222" \
DIRECTADMIN_USERNAME=xxxx \
DIRECTADMIN_PASSWORD=yyy \
lego --email you@example.com --dns directadmin -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
DIRECTADMIN_API_URL |
URL of the API |
DIRECTADMIN_PASSWORD |
API password |
DIRECTADMIN_USERNAME |
API username |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
DIRECTADMIN_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
DIRECTADMIN_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 5) |
DIRECTADMIN_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 60) |
DIRECTADMIN_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 30) |
DIRECTADMIN_ZONE_NAME |
Zone name used to add the TXT record |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for dnsHome.de.
dnshomedeHere is an example bash command using the dnsHome.de provider:
DNSHOMEDE_CREDENTIALS=example.org:password \
lego --email you@example.com --dns dnshomede -d '*.example.com' -d example.com run
DNSHOMEDE_CREDENTIALS=my.example.org:password1,demo.example.org:password2 \
lego --email you@example.com --dns dnshomede -d my.example.org -d demo.example.org| Environment Variable Name | Description |
|---|---|
DNSHOMEDE_CREDENTIALS |
Comma-separated list of domain:password credential pairs |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
DNSHOMEDE_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
DNSHOMEDE_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 1200) |
DNSHOMEDE_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 2) |
DNSHOMEDE_SEQUENCE_INTERVAL |
Time between sequential requests in seconds (Default: 120) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for DNSimple.
dnsimpleHere is an example bash command using the DNSimple provider:
DNSIMPLE_OAUTH_TOKEN=1234567890abcdefghijklmnopqrstuvwxyz \
lego --email you@example.com --dns dnsimple -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
DNSIMPLE_OAUTH_TOKEN |
OAuth token |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
DNSIMPLE_BASE_URL |
API endpoint URL |
DNSIMPLE_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
DNSIMPLE_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 60) |
DNSIMPLE_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 120) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
DNSIMPLE_BASE_URL is optional and must be set to production (https://api.dnsimple.com).
if DNSIMPLE_BASE_URL is not defined or empty, the production URL is used by default.
While you can manage DNS records in the DNSimple Sandbox environment, DNS records will not resolve, and you will not be able to satisfy the ACME DNS challenge.
To authenticate you need to provide a valid API token. HTTP Basic Authentication is intentionally not supported.
You can generate a new API token from your account page. Only Account API tokens are supported, if you try to use a User API token you will receive an error message.
Configuration for DNS Made Easy.
dnsmadeeasyHere is an example bash command using the DNS Made Easy provider:
DNSMADEEASY_API_KEY=xxxxxx \
DNSMADEEASY_API_SECRET=yyyyy \
lego --email you@example.com --dns dnsmadeeasy -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
DNSMADEEASY_API_KEY |
The API key |
DNSMADEEASY_API_SECRET |
The API Secret key |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
DNSMADEEASY_HTTP_TIMEOUT |
API request timeout in seconds (Default: 10) |
DNSMADEEASY_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
DNSMADEEASY_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 60) |
DNSMADEEASY_SANDBOX |
Activate the sandbox (boolean) |
DNSMADEEASY_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 120) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Use the Tencent Cloud provider instead.
dnspodHere is an example bash command using the DNSPod (deprecated) provider:
DNSPOD_API_KEY=xxxxxx \
lego --email you@example.com --dns dnspod -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
DNSPOD_API_KEY |
The user token |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
DNSPOD_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
DNSPOD_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
DNSPOD_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 60) |
DNSPOD_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 600) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for Domain Offensive (do.de).
dodeHere is an example bash command using the Domain Offensive (do.de) provider:
DODE_TOKEN=xxxxxx \
lego --email you@example.com --dns dode -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
DODE_TOKEN |
API token |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
DODE_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
DODE_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
DODE_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 60) |
DODE_SEQUENCE_INTERVAL |
Time between sequential requests in seconds (Default: 60) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for Domeneshop.
domeneshopHere is an example bash command using the Domeneshop provider:
DOMENESHOP_API_TOKEN=<token> \
DOMENESHOP_API_SECRET=<secret> \
lego --email example@example.com --dns domeneshop -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
DOMENESHOP_API_SECRET |
API secret |
DOMENESHOP_API_TOKEN |
API token |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
DOMENESHOP_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
DOMENESHOP_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 20) |
DOMENESHOP_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 300) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Visit the following page for information on how to create API credentials with Domeneshop:
https://api.domeneshop.no/docs/#section/Authentication
Configuration for DreamHost.
dreamhostHere is an example bash command using the DreamHost provider:
DREAMHOST_API_KEY="YOURAPIKEY" \
lego --email you@example.com --dns dreamhost -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
DREAMHOST_API_KEY |
The API key |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
DREAMHOST_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
DREAMHOST_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 60) |
DREAMHOST_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 3600) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for Duck DNS.
duckdnsHere is an example bash command using the Duck DNS provider:
DUCKDNS_TOKEN=xxxxxx \
lego --email you@example.com --dns duckdns -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
DUCKDNS_TOKEN |
Account token |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
DUCKDNS_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
DUCKDNS_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
DUCKDNS_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 60) |
DUCKDNS_SEQUENCE_INTERVAL |
Time between sequential requests in seconds (Default: 60) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for Dyn.
dynHere is an example bash command using the Dyn provider:
DYN_CUSTOMER_NAME=xxxxxx \
DYN_USER_NAME=yyyyy \
DYN_PASSWORD=zzzz \
lego --email you@example.com --dns dyn -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
DYN_CUSTOMER_NAME |
Customer name |
DYN_PASSWORD |
Password |
DYN_USER_NAME |
User name |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
DYN_HTTP_TIMEOUT |
API request timeout in seconds (Default: 10) |
DYN_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
DYN_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 60) |
DYN_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 120) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for DynDnsFree.de.
dyndnsfreeHere is an example bash command using the DynDnsFree.de provider:
DYNDNSFREE_USERNAME="xxx" \
DYNDNSFREE_PASSWORD="yyy" \
lego --email you@example.com --dns dyndnsfree -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
DYNDNSFREE_PASSWORD |
Password |
DYNDNSFREE_USERNAME |
Username |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
DYNDNSFREE_HTTP_TIMEOUT |
Request timeout in seconds (Default: 30) |
DYNDNSFREE_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
DYNDNSFREE_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 60) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for Dynu.
dynuHere is an example bash command using the Dynu provider:
DYNU_API_KEY=1234567890abcdefghijklmnopqrstuvwxyz \
lego --email you@example.com --dns dynu -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
DYNU_API_KEY |
API key |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
DYNU_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
DYNU_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 10) |
DYNU_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 180) |
DYNU_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 300) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for EasyDNS.
easydnsHere is an example bash command using the EasyDNS provider:
EASYDNS_TOKEN=xxx \
EASYDNS_KEY=yyy \
lego --email you@example.com --dns easydns -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
EASYDNS_KEY |
API Key |
EASYDNS_TOKEN |
API Token |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
EASYDNS_ENDPOINT |
The endpoint URL of the API Server |
EASYDNS_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
EASYDNS_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
EASYDNS_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 60) |
EASYDNS_SEQUENCE_INTERVAL |
Time between sequential requests in seconds (Default: 60) |
EASYDNS_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 120) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
To test with the sandbox environment set EASYDNS_ENDPOINT=https://sandbox.rest.easydns.net
Akamai edgedns supersedes FastDNS; implementing a DNS provider for solving the DNS-01 challenge using Akamai EdgeDNS
edgednsHere is an example bash command using the Akamai EdgeDNS provider:
AKAMAI_CLIENT_SECRET=abcdefghijklmnopqrstuvwxyz1234567890ABCDEFG= \
AKAMAI_CLIENT_TOKEN=akab-mnbvcxzlkjhgfdsapoiuytrewq1234567 \
AKAMAI_HOST=akab-aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.luna.akamaiapis.net \
AKAMAI_ACCESS_TOKEN=akab-1234567890qwerty-asdfghjklzxcvtnu \
lego --email you@example.com --dns edgedns -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
AKAMAI_ACCESS_TOKEN |
Access token, managed by the Akamai EdgeGrid client |
AKAMAI_CLIENT_SECRET |
Client secret, managed by the Akamai EdgeGrid client |
AKAMAI_CLIENT_TOKEN |
Client token, managed by the Akamai EdgeGrid client |
AKAMAI_EDGERC |
Path to the .edgerc file, managed by the Akamai EdgeGrid client |
AKAMAI_EDGERC_SECTION |
Configuration section, managed by the Akamai EdgeGrid client |
AKAMAI_HOST |
API host, managed by the Akamai EdgeGrid client |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
AKAMAI_ACCOUNT_SWITCH_KEY |
Target account ID when the DNS zone and credentials belong to different accounts |
AKAMAI_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 15) |
AKAMAI_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 180) |
AKAMAI_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 120) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Akamai’s credentials are automatically detected in the following locations and prioritized in the following order:
{SECTION} is specified using AKAMAI_EDGERC_SECTION):AKAMAI_{SECTION}_HOSTAKAMAI_{SECTION}_ACCESS_TOKENAKAMAI_{SECTION}_CLIENT_TOKENAKAMAI_{SECTION}_CLIENT_SECRETAKAMAI_EDGERC_SECTION is not defined or is set to default, environment variables:AKAMAI_HOSTAKAMAI_ACCESS_TOKENAKAMAI_CLIENT_TOKENAKAMAI_CLIENT_SECRET.edgerc file located at AKAMAI_EDGERC~/.edgerc, sections can be specified using AKAMAI_EDGERC_SECTIONAKAMAI_HOSTAKAMAI_ACCESS_TOKENAKAMAI_CLIENT_TOKENAKAMAI_CLIENT_SECRETSee also:
Configuration for Tencent EdgeOne.
edgeoneHere is an example bash command using the Tencent EdgeOne provider:
EDGEONE_SECRET_ID=abcdefghijklmnopqrstuvwx \
EDGEONE_SECRET_KEY=your-secret-key \
lego --email you@example.com --dns edgeone -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
EDGEONE_SECRET_ID |
Access key ID |
EDGEONE_SECRET_KEY |
Access Key secret |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
EDGEONE_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
EDGEONE_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 30) |
EDGEONE_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 1200) |
EDGEONE_REGION |
Region |
EDGEONE_SESSION_TOKEN |
Access Key token |
EDGEONE_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 60) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for Efficient IP.
efficientipHere is an example bash command using the Efficient IP provider:
EFFICIENTIP_USERNAME="user" \
EFFICIENTIP_PASSWORD="secret" \
EFFICIENTIP_HOSTNAME="ipam.example.org" \
EFFICIENTIP_DNS_NAME="dns.smart" \
lego --email you@example.com --dns efficientip -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
EFFICIENTIP_DNS_NAME |
DNS name (ex: dns.smart) |
EFFICIENTIP_HOSTNAME |
Hostname (ex: foo.example.com) |
EFFICIENTIP_PASSWORD |
Password |
EFFICIENTIP_USERNAME |
Username |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
EFFICIENTIP_HTTP_TIMEOUT |
API request timeout in seconds (Default: 10) |
EFFICIENTIP_INSECURE_SKIP_VERIFY |
Whether or not to verify EfficientIP API certificate |
EFFICIENTIP_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
EFFICIENTIP_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 60) |
EFFICIENTIP_VIEW_NAME |
View name (ex: external) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for Epik.
epikHere is an example bash command using the Epik provider:
EPIK_SIGNATURE=xxxxxxxxxxxxxxxxxxxxxxxxxx \
lego --email you@example.com --dns epik -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
EPIK_SIGNATURE |
Epik API signature (https://registrar.epik.com/account/api-settings/) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
EPIK_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
EPIK_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
EPIK_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 60) |
EPIK_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 3600) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Solving the DNS-01 challenge using an external program.
execHere is an example bash command using the External program provider:
EXEC_PATH=/the/path/to/myscript.sh \
lego --email you@example.com --dns exec -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
EXEC_MODE |
RAW, none |
EXEC_PATH |
The path of the the external program. |
| Environment Variable Name | Description |
|---|---|
EXEC_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 3). |
EXEC_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 60). |
EXEC_SEQUENCE_INTERVAL |
Time between sequential requests in seconds (Default: 60). |
The file name of the external program is specified in the environment variable EXEC_PATH.
When it is run by lego, three command-line parameters are passed to it: The action (“present” or “cleanup”), the fully-qualified domain name and the value for the record.
For example, requesting a certificate for the domain ‘my.example.org’ can be achieved by calling lego as follows:
EXEC_PATH=./update-dns.sh \
lego --email you@example.com --dns exec --d my.example.org runIt will then call the program ‘./update-dns.sh’ with like this:
./update-dns.sh "present" "_acme-challenge.my.example.org." "MsijOYZxqyjGnFGwhjrhfg-Xgbl5r68WPda0J9EgqqI"The program then needs to make sure the record is inserted. When it returns an error via a non-zero exit code, lego aborts.
When the record is to be removed again,
the program is called with the first command-line parameter set to cleanup instead of present.
If you want to use the raw domain, token, and keyAuth values with your program, you can set EXEC_MODE=RAW:
EXEC_MODE=RAW \
EXEC_PATH=./update-dns.sh \
lego --email you@example.com --dns exec -d my.example.org runIt will then call the program ./update-dns.sh like this:
./update-dns.sh "present" "--" "my.example.org." "some-token" "KxAy-J3NwUmg9ZQuM-gP_Mq1nStaYSaP9tYQs5_-YsE.ksT-qywTd8058G-SHHWA3RAN72Pr0yWtPYmmY5UBpQ8"The -- is because the token MAY start with a -, and the called program may try and interpret a - as indicating a flag.
In the case of urfave, which is commonly used,
you can use the -- delimiter to specify the start of positional arguments, and handle such a string safely.
| Mode | Command |
|---|---|
| default | myprogram present <FQDN> <record> |
RAW |
myprogram present -- <domain> <token> <key_auth> |
| Mode | Command |
|---|---|
| default | myprogram cleanup <FQDN> <record> |
RAW |
myprogram cleanup -- <domain> <token> <key_auth> |
Configuration for Exoscale.
exoscaleHere is an example bash command using the Exoscale provider:
EXOSCALE_API_KEY=abcdefghijklmnopqrstuvwx \
EXOSCALE_API_SECRET=xxxxxxx \
lego --email you@example.com --dns exoscale -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
EXOSCALE_API_KEY |
API key |
EXOSCALE_API_SECRET |
API secret |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
EXOSCALE_ENDPOINT |
API endpoint URL |
EXOSCALE_HTTP_TIMEOUT |
API request timeout in seconds (Default: 60) |
EXOSCALE_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
EXOSCALE_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 60) |
EXOSCALE_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 120) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for F5 XC.
f5xcHere is an example bash command using the F5 XC provider:
F5XC_API_TOKEN="xxx" \
F5XC_TENANT_NAME="yyy" \
F5XC_GROUP_NAME="zzz" \
lego --email you@example.com --dns f5xc -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
F5XC_API_TOKEN |
API token |
F5XC_GROUP_NAME |
Group name |
F5XC_TENANT_NAME |
XC Tenant shortname |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
F5XC_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
F5XC_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
F5XC_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 60) |
F5XC_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 120) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for freemyip.com.
freemyipHere is an example bash command using the freemyip.com provider:
FREEMYIP_TOKEN=xxxxxx \
lego --email you@example.com --dns freemyip -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
FREEMYIP_TOKEN |
Account token |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
FREEMYIP_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
FREEMYIP_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
FREEMYIP_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 60) |
FREEMYIP_SEQUENCE_INTERVAL |
Time between sequential requests in seconds (Default: 60) |
FREEMYIP_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 3600) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for Gandi.
gandiHere is an example bash command using the Gandi provider:
GANDI_API_KEY=abcdefghijklmnopqrstuvwx \
lego --email you@example.com --dns gandi -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
GANDI_API_KEY |
API key |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
GANDI_HTTP_TIMEOUT |
API request timeout in seconds (Default: 60) |
GANDI_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 60) |
GANDI_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 2400) |
GANDI_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 300) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for Gandi Live DNS (v5).
gandiv5Here is an example bash command using the Gandi Live DNS (v5) provider:
GANDIV5_PERSONAL_ACCESS_TOKEN=abcdefghijklmnopqrstuvwx \
lego --email you@example.com --dns gandiv5 -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
GANDIV5_API_KEY |
API key (Deprecated) |
GANDIV5_PERSONAL_ACCESS_TOKEN |
Personal Access Token |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
GANDIV5_HTTP_TIMEOUT |
API request timeout in seconds (Default: 10) |
GANDIV5_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 20) |
GANDIV5_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 1200) |
GANDIV5_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 300) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for Google Cloud.
gcloudHere is an example bash command using the Google Cloud provider:
# Using a service account file
GCE_PROJECT="gc-project-id" \
GCE_SERVICE_ACCOUNT_FILE="/path/to/svc/account/file.json" \
lego --email you@example.com --dns gcloud -d '*.example.com' -d example.com run
# Using default credentials with impersonation
GCE_PROJECT="gc-project-id" \
GCE_IMPERSONATE_SERVICE_ACCOUNT="target-sa@gc-project-id.iam.gserviceaccount.com" \
lego --email you@example.com --dns gcloud -d '*.example.com' -d example.com run
# Using service account key with impersonation
GCE_PROJECT="gc-project-id" \
GCE_SERVICE_ACCOUNT_FILE="/path/to/svc/account/file.json" \
GCE_IMPERSONATE_SERVICE_ACCOUNT="target-sa@gc-project-id.iam.gserviceaccount.com" \
lego --email you@example.com --dns gcloud -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
Application Default Credentials |
Documentation |
GCE_PROJECT |
Project name (by default, the project name is auto-detected by using the metadata service) |
GCE_SERVICE_ACCOUNT |
Account |
GCE_SERVICE_ACCOUNT_FILE |
Account file path |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
GCE_ALLOW_PRIVATE_ZONE |
Allows requested domain to be in private DNS zone, works only with a private ACME server (by default: false) |
GCE_IMPERSONATE_SERVICE_ACCOUNT |
Service account email to impersonate |
GCE_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 5) |
GCE_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 180) |
GCE_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 120) |
GCE_ZONE_ID |
Allows to skip the automatic detection of the zone |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Supports service account impersonation to access Google Cloud DNS resources across different projects or with restricted permissions.
When using impersonation, the source service account must have:
Configuration for G-Core.
gcoreHere is an example bash command using the G-Core provider:
GCORE_PERMANENT_API_TOKEN=xxxxx \
lego --email you@example.com --dns gcore -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
GCORE_PERMANENT_API_TOKEN |
Permanent API token (https://gcore.com/blog/permanent-api-token-explained/) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
GCORE_HTTP_TIMEOUT |
API request timeout in seconds (Default: 10) |
GCORE_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 20) |
GCORE_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 360) |
GCORE_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 120) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for Glesys.
glesysHere is an example bash command using the Glesys provider:
GLESYS_API_USER=xxxxx \
GLESYS_API_KEY=yyyyy \
lego --email you@example.com --dns glesys -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
GLESYS_API_KEY |
API key |
GLESYS_API_USER |
API user |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
GLESYS_HTTP_TIMEOUT |
API request timeout in seconds (Default: 10) |
GLESYS_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 20) |
GLESYS_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 1200) |
GLESYS_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 60) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for Go Daddy.
godaddyHere is an example bash command using the Go Daddy provider:
GODADDY_API_KEY=xxxxxxxx \
GODADDY_API_SECRET=yyyyyyyy \
lego --email you@example.com --dns godaddy -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
GODADDY_API_KEY |
API key |
GODADDY_API_SECRET |
API secret |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
GODADDY_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
GODADDY_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
GODADDY_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 120) |
GODADDY_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 600) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
GoDaddy has recently (2024-04) updated the account requirements to access parts of their production Domains API:
The Google Domains DNS provider has shut down.
googledomainsHere is an example bash command using the Google Domains provider:
GOOGLE_DOMAINS_ACCESS_TOKEN=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx \
lego --email you@example.com --dns googledomains -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
GOOGLE_DOMAINS_ACCESS_TOKEN |
Access token |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
GOOGLE_DOMAINS_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
GOOGLE_DOMAINS_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
GOOGLE_DOMAINS_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 120) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for Hetzner.
hetznerHere is an example bash command using the Hetzner provider:
HETZNER_API_TOKEN="xxxxxxxxxxxxxxxxxxxxx" \
lego --email you@example.com --dns hetzner -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
HETZNER_API_TOKEN |
API token |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
HETZNER_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
HETZNER_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
HETZNER_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 60) |
HETZNER_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 120) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for Hosting.de.
hostingdeHere is an example bash command using the Hosting.de provider:
HOSTINGDE_API_KEY=xxxxxxxx \
lego --email you@example.com --dns hostingde -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
HOSTINGDE_API_KEY |
API key |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
HOSTINGDE_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
HOSTINGDE_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
HOSTINGDE_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 120) |
HOSTINGDE_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 120) |
HOSTINGDE_ZONE_NAME |
Zone name in ACE format |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for Hostinger.
hostingerHere is an example bash command using the Hostinger provider:
HOSTINGER_API_TOKEN="xxxxxxxxxxxxxxxxxxxxx" \
lego --email you@example.com --dns hostinger -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
HOSTINGER_API_TOKEN |
API Token |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
HOSTINGER_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
HOSTINGER_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
HOSTINGER_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 60) |
HOSTINGER_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 120) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for Hosttech.
hosttechHere is an example bash command using the Hosttech provider:
HOSTTECH_API_KEY=xxxxxxxxxxxxxxxxxxxxxxxxxx \
lego --email you@example.com --dns hosttech -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
HOSTTECH_API_KEY |
API login |
HOSTTECH_PASSWORD |
API password |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
HOSTTECH_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
HOSTTECH_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
HOSTTECH_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 60) |
HOSTTECH_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 3600) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for http.net.
httpnetHere is an example bash command using the http.net provider:
HTTPNET_API_KEY=xxxxxxxx \
lego --email you@example.com --dns httpnet -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
HTTPNET_API_KEY |
API key |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
HTTPNET_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
HTTPNET_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
HTTPNET_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 120) |
HTTPNET_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 120) |
HTTPNET_ZONE_NAME |
Zone name in ACE format |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for HTTP request.
httpreqHere is an example bash command using the HTTP request provider:
HTTPREQ_ENDPOINT=http://my.server.com:9090 \
lego --email you@example.com --dns httpreq -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
HTTPREQ_ENDPOINT |
The URL of the server |
HTTPREQ_MODE |
RAW, none |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
HTTPREQ_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
HTTPREQ_PASSWORD |
Basic authentication password |
HTTPREQ_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
HTTPREQ_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 60) |
HTTPREQ_USERNAME |
Basic authentication username |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
The server must provide:
POST /presentPOST /cleanupThe URL of the server must be defined by HTTPREQ_ENDPOINT.
There are 2 modes (HTTPREQ_MODE):
{
"fqdn": "_acme-challenge.domain.",
"value": "LHDhK3oGRvkiefQnx7OOczTY5Tic_xZ6HcMOc_gmtoM"
}RAW{
"domain": "domain",
"token": "token",
"keyAuth": "key"
}Basic authentication (optional) can be set with some environment variables:
HTTPREQ_USERNAME and HTTPREQ_PASSWORDConfiguration for Huawei Cloud.
huaweicloudHere is an example bash command using the Huawei Cloud provider:
HUAWEICLOUD_ACCESS_KEY_ID=your-access-key-id \
HUAWEICLOUD_SECRET_ACCESS_KEY=your-secret-access-key \
HUAWEICLOUD_REGION=cn-south-1 \
lego --email you@example.com --dns huaweicloud -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
HUAWEICLOUD_ACCESS_KEY_ID |
Access key ID |
HUAWEICLOUD_REGION |
Region |
HUAWEICLOUD_SECRET_ACCESS_KEY |
Access Key secret |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
HUAWEICLOUD_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
HUAWEICLOUD_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
HUAWEICLOUD_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 60) |
HUAWEICLOUD_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 300) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for Hurricane Electric DNS.
hurricaneHere is an example bash command using the Hurricane Electric DNS provider:
HURRICANE_TOKENS=example.org:token \
lego --email you@example.com --dns hurricane -d '*.example.com' -d example.com run
HURRICANE_TOKENS=my.example.org:token1,demo.example.org:token2 \
lego --email you@example.com --dns hurricane -d my.example.org -d demo.example.org| Environment Variable Name | Description |
|---|---|
HURRICANE_TOKENS |
TXT record names and tokens |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
HURRICANE_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
HURRICANE_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
HURRICANE_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation (Default: 300) |
HURRICANE_SEQUENCE_INTERVAL |
Time between sequential requests in seconds (Default: 60) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Before using lego to request a certificate for a given domain or wildcard (such as my.example.org or *.my.example.org),
create a TXT record named _acme-challenge.my.example.org, and enable dynamic updates on it.
Generate a token for each URL with Hurricane Electric’s UI, and copy it down.
Stick to alphanumeric tokens for greatest reliability.
To authenticate with the Hurricane Electric API,
add each record name/token pair you want to update to the HURRICANE_TOKENS environment variable, as shown in the examples.
Record names (without the _acme-challenge. component) and their tokens are separated with colons,
while the credential pairs are concatenated into a comma-separated list, like so:
HURRICANE_TOKENS=my.example.org:token1,demo.example.org:token2If you are issuing both a wildcard certificate and a standard certificate for a given subdomain, you should not have repeat entries for that name, as both will use the same credential.
HURRICANE_TOKENS=example.org:tokenConfiguration for HyperOne.
hyperoneHere is an example bash command using the HyperOne provider:
lego --email you@example.com --dns hyperone -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
HYPERONE_API_URL |
Allows to pass custom API Endpoint to be used in the challenge (default https://api.hyperone.com/v2) |
HYPERONE_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
HYPERONE_LOCATION_ID |
Specifies location (region) to be used in API calls. (default pl-waw-1) |
HYPERONE_PASSPORT_LOCATION |
Allows to pass custom passport file location (default ~/.h1/passport.json) |
HYPERONE_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 60) |
HYPERONE_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 2) |
HYPERONE_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 120) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Default configuration does not require any additional environment variables,
just a passport file in ~/.h1/passport.json location.
To use this application you have to generate passport file for sa:
h1 iam project sa credential generate --name my-passport --project <project ID> --sa <sa ID> --passport-output-file ~/.h1/passport.jsonThe application requires following permissions:
dns/zone/listdns/zone.recordset/listdns/zone.recordset/createdns/zone.recordset/deletedns/zone.record/createdns/zone.record/listdns/zone.record/deleteAll required permissions are available via platform role tool.lego.
Configuration for IBM Cloud (SoftLayer).
ibmcloudHere is an example bash command using the IBM Cloud (SoftLayer) provider:
SOFTLAYER_USERNAME=xxxxx \
SOFTLAYER_API_KEY=yyyyy \
lego --email you@example.com --dns ibmcloud -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
SOFTLAYER_API_KEY |
Classic Infrastructure API key |
SOFTLAYER_USERNAME |
Username (IBM Cloud is {accountID}_{emailAddress}) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
SOFTLAYER_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
SOFTLAYER_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 60) |
SOFTLAYER_TIMEOUT |
API request timeout in seconds (Default: 30) |
SOFTLAYER_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 120) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for Internet Initiative Japan.
iijHere is an example bash command using the Internet Initiative Japan provider:
IIJ_API_ACCESS_KEY=xxxxxxxx \
IIJ_API_SECRET_KEY=yyyyyy \
IIJ_DO_SERVICE_CODE=zzzzzz \
lego --email you@example.com --dns iij -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
IIJ_API_ACCESS_KEY |
API access key |
IIJ_API_SECRET_KEY |
API secret key |
IIJ_DO_SERVICE_CODE |
DO service code |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
IIJ_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 4) |
IIJ_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 240) |
IIJ_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 300) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for IIJ DNS Platform Service.
iijdpfHere is an example bash command using the IIJ DNS Platform Service provider:
IIJ_DPF_API_TOKEN=xxxxxxxx \
IIJ_DPF_DPM_SERVICE_CODE=yyyyyy \
lego --email you@example.com --dns iijdpf -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
IIJ_DPF_API_TOKEN |
API token |
IIJ_DPF_DPM_SERVICE_CODE |
IIJ Managed DNS Service’s service code |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
IIJ_DPF_API_ENDPOINT |
API endpoint URL, defaults to https://api.dns-platform.jp/dpf/v1 |
IIJ_DPF_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 5) |
IIJ_DPF_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 660) |
IIJ_DPF_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 300) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Credentials and DNS configuration for DNS providers must be passed through environment variables.
The environment variables can reference a value.
Here is an example bash command using the Cloudflare DNS provider:
$ CLOUDFLARE_EMAIL=you@example.com \
CLOUDFLARE_API_KEY=b9841238feb177a84330febba8a83208921177bffe733 \
lego --dns cloudflare --domains www.example.com --email you@example.com runThe environment variables can reference a path to file.
In this case the name of environment variable must be suffixed by _FILE.
The file must contain only the value.
Here is an example bash command using the CloudFlare DNS provider:
$ cat /the/path/to/my/key
b9841238feb177a84330febba8a83208921177bffe733
$ cat /the/path/to/my/email
you@example.com
$ CLOUDFLARE_EMAIL_FILE=/the/path/to/my/email \
CLOUDFLARE_API_KEY_FILE=/the/path/to/my/key \
lego --dns cloudflare --domains www.example.com --email you@example.com run| Provider name | CLI flag name | Required lego version | |
|---|---|---|---|
| Active24 | Website |
active24
|
v4.23.0 |
| Akamai EdgeDNS | Website |
edgedns
|
v3.9.0 |
| Alibaba Cloud DNS | Website |
alidns
|
v1.1.0 |
| all-inkl | Website |
allinkl
|
v4.5.0 |
| Amazon Lightsail | Website |
lightsail
|
v0.5.0 |
| Amazon Route 53 | Website |
route53
|
v0.3.0 |
| Anexia CloudDNS | Website |
anexia
|
v4.28.0 |
| ArvanCloud | Website |
arvancloud
|
v3.8.0 |
| Aurora DNS | Website |
auroradns
|
v0.4.0 |
| Autodns | Website |
autodns
|
v3.2.0 |
| Axelname | Website |
axelname
|
v4.23.0 |
| Azion | Website |
azion
|
v4.24.0 |
| Azure (deprecated) | Website |
azure
|
v0.4.0 |
| Azure DNS | Website |
azuredns
|
v4.13.0 |
| Baidu Cloud | Website |
baiducloud
|
v4.23.0 |
| Beget.com | Website |
beget
|
v4.27.0 |
| Binary Lane | Website |
binarylane
|
v4.26.0 |
| Bindman | Website |
bindman
|
v2.6.0 |
| Bluecat | Website |
bluecat
|
v0.5.0 |
| BookMyName | Website |
bookmyname
|
v4.23.0 |
| Brandit (deprecated) | Website |
brandit
|
v4.11.0 |
| Bunny | Website |
bunny
|
v4.11.0 |
| Checkdomain | Website |
checkdomain
|
v3.3.0 |
| Civo | Website |
civo
|
v4.9.0 |
| Cloud.ru | Website |
cloudru
|
v4.14.0 |
| CloudDNS | Website |
clouddns
|
v3.6.0 |
| Cloudflare | Website |
cloudflare
|
v0.3.0 |
| ClouDNS | Website |
cloudns
|
v2.3.0 |
| CloudXNS (Deprecated) | Website |
cloudxns
|
v0.5.0 |
| ConoHa v2 | Website |
conoha
|
v1.2.0 |
| ConoHa v3 | Website |
conohav3
|
v4.24.0 |
| Constellix | Website |
constellix
|
v3.4.0 |
| Core-Networks | Website |
corenetworks
|
v4.20.0 |
| CPanel/WHM | Website |
cpanel
|
v4.16.0 |
| Derak Cloud | Website |
derak
|
v4.12.0 |
| deSEC.io | Website |
desec
|
v3.7.0 |
| Designate DNSaaS for Openstack | Website |
designate
|
v2.2.0 |
| Digital Ocean | Website |
digitalocean
|
v0.3.0 |
| DirectAdmin | Website |
directadmin
|
v4.18.0 |
| DNS Made Easy | Website |
dnsmadeeasy
|
v0.4.0 |
| dnsHome.de | Website |
dnshomede
|
v4.10.0 |
| DNSimple | Website |
dnsimple
|
v0.3.0 |
| DNSPod (deprecated) | Website |
dnspod
|
v0.4.0 |
| Domain Offensive (do.de) | Website |
dode
|
v2.4.0 |
| Domeneshop | Website |
domeneshop
|
v4.3.0 |
| DreamHost | Website |
dreamhost
|
v1.1.0 |
| Duck DNS | Website |
duckdns
|
v0.5.0 |
| Dyn | Website |
dyn
|
v0.3.0 |
| DynDnsFree.de | Website |
dyndnsfree
|
v4.23.0 |
| Dynu | Website |
dynu
|
v3.5.0 |
| EasyDNS | Website |
easydns
|
v2.6.0 |
| Efficient IP | Website |
efficientip
|
v4.13.0 |
| Epik | Website |
epik
|
v4.5.0 |
| Exoscale | Website |
exoscale
|
v0.4.0 |
| External program | Website |
exec
|
v0.5.0 |
| F5 XC | Website |
f5xc
|
v4.23.0 |
| freemyip.com | Website |
freemyip
|
v4.5.0 |
| G-Core | Website |
gcore
|
v4.5.0 |
| Gandi | Website |
gandi
|
v0.3.0 |
| Gandi Live DNS (v5) | Website |
gandiv5
|
v0.5.0 |
| Glesys | Website |
glesys
|
v0.5.0 |
| Go Daddy | Website |
godaddy
|
v0.5.0 |
| Google Cloud | Website |
gcloud
|
v0.3.0 |
| Google Domains | Website |
googledomains
|
v4.11.0 |
| Hetzner | Website |
hetzner
|
v3.7.0 |
| Hosting.de | Website |
hostingde
|
v1.1.0 |
| Hostinger | Website |
hostinger
|
v4.27.0 |
| Hosttech | Website |
hosttech
|
v4.5.0 |
| HTTP request | Website |
httpreq
|
v2.0.0 |
| http.net | Website |
httpnet
|
v4.15.0 |
| Huawei Cloud | Website |
huaweicloud
|
v4.19 |
| Hurricane Electric DNS | Website |
hurricane
|
v4.3.0 |
| HyperOne | Website |
hyperone
|
v3.9.0 |
| IBM Cloud (SoftLayer) | Website |
ibmcloud
|
v4.5.0 |
| IIJ DNS Platform Service | Website |
iijdpf
|
v4.7.0 |
| Infoblox | Website |
infoblox
|
v4.4.0 |
| Infomaniak | Website |
infomaniak
|
v4.1.0 |
| Internet Initiative Japan | Website |
iij
|
v1.1.0 |
| Internet.bs | Website |
internetbs
|
v4.5.0 |
| INWX | Website |
inwx
|
v2.0.0 |
| Ionos | Website |
ionos
|
v4.2.0 |
| IPv64 | Website |
ipv64
|
v4.13.0 |
| iwantmyname (Deprecated) | Website |
iwantmyname
|
v4.7.0 |
| Joker | Website |
joker
|
v2.6.0 |
| Joohoi's ACME-DNS | Website |
acme-dns
|
v1.1.0 |
| KeyHelp | Website |
keyhelp
|
v4.26.0 |
| Liara | Website |
liara
|
v4.10.0 |
| Lima-City | Website |
limacity
|
v4.18.0 |
| Linode (v4) | Website |
linode
|
v1.1.0 |
| Liquid Web | Website |
liquidweb
|
v3.1.0 |
| Loopia | Website |
loopia
|
v4.2.0 |
| LuaDNS | Website |
luadns
|
v3.7.0 |
| Mail-in-a-Box | Website |
mailinabox
|
v4.16.0 |
| ManageEngine CloudDNS | Website |
manageengine
|
v4.21.0 |
| Manual |
manual
|
v0.3.0 | |
| Metaname | Website |
metaname
|
v4.13.0 |
| Metaregistrar | Website |
metaregistrar
|
v4.23.0 |
| mijn.host | Website |
mijnhost
|
v4.18.0 |
| Mittwald | Website |
mittwald
|
v1.48.0 |
| myaddr.{tools,dev,io} | Website |
myaddr
|
v4.22.0 |
| MyDNS.jp | Website |
mydnsjp
|
v1.2.0 |
| MythicBeasts | Website |
mythicbeasts
|
v0.3.7 |
| Name.com | Website |
namedotcom
|
v0.5.0 |
| Namecheap | Website |
namecheap
|
v0.3.0 |
| Namesilo | Website |
namesilo
|
v2.7.0 |
| NearlyFreeSpeech.NET | Website |
nearlyfreespeech
|
v4.8.0 |
| Netcup | Website |
netcup
|
v1.1.0 |
| Netlify | Website |
netlify
|
v3.7.0 |
| Nicmanager | Website |
nicmanager
|
v4.5.0 |
| NIFCloud | Website |
nifcloud
|
v1.1.0 |
| Njalla | Website |
njalla
|
v4.3.0 |
| Nodion | Website |
nodion
|
v4.11.0 |
| NS1 | Website |
ns1
|
v0.4.0 |
| Octenium | Website |
octenium
|
v4.27.0 |
| Open Telekom Cloud | Website |
otc
|
v0.4.1 |
| Oracle Cloud | Website |
oraclecloud
|
v2.3.0 |
| OVH | Website |
ovh
|
v0.4.0 |
| plesk.com | Website |
plesk
|
v4.11.0 |
| Porkbun | Website |
porkbun
|
v4.4.0 |
| PowerDNS | Website |
pdns
|
v0.4.0 |
| Rackspace | Website |
rackspace
|
v0.4.0 |
| Rain Yun/雨云 | Website |
rainyun
|
v4.21.0 |
| RcodeZero | Website |
rcodezero
|
v4.13 |
| reg.ru | Website |
regru
|
v3.5.0 |
| Regfish | Website |
regfish
|
v4.20.0 |
| RFC2136 | Website |
rfc2136
|
v0.3.0 |
| RimuHosting | Website |
rimuhosting
|
v0.3.5 |
| RU CENTER | Website |
nicru
|
v4.24.0 |
| Sakura Cloud | Website |
sakuracloud
|
v1.1.0 |
| Scaleway | Website |
scaleway
|
v3.4.0 |
| Selectel | Website |
selectel
|
v1.2.0 |
| Selectel v2 | Website |
selectelv2
|
v4.17.0 |
| SelfHost.(de|eu) | Website |
selfhostde
|
v4.19.0 |
| Servercow | Website |
servercow
|
v3.4.0 |
| Shellrent | Website |
shellrent
|
v4.16.0 |
| Simply.com | Website |
simply
|
v4.4.0 |
| Sonic | Website |
sonic
|
v4.4.0 |
| Spaceship | Website |
spaceship
|
v4.22.0 |
| Stackpath | Website |
stackpath
|
v1.1.0 |
| Technitium | Website |
technitium
|
v4.20.0 |
| Tencent Cloud DNS | Website |
tencentcloud
|
v4.6.0 |
| Tencent EdgeOne | Website |
edgeone
|
v4.26.0 |
| Timeweb Cloud | Website |
timewebcloud
|
v4.20.0 |
| TransIP | Website |
transip
|
v2.0.0 |
| UKFast SafeDNS | Website |
safedns
|
v4.6.0 |
| Ultradns | Website |
ultradns
|
v4.10.0 |
| Variomedia | Website |
variomedia
|
v4.8.0 |
| VegaDNS | Website |
vegadns
|
v1.1.0 |
| Vercel | Website |
vercel
|
v4.7.0 |
| Versio.[nl|eu|uk] | Website |
versio
|
v2.7.0 |
| VinylDNS | Website |
vinyldns
|
v4.4.0 |
| VK Cloud | Website |
vkcloud
|
v4.9.0 |
| Volcano Engine/火山引擎 | Website |
volcengine
|
v4.19.0 |
| Vscale | Website |
vscale
|
v2.0.0 |
| Vultr | Website |
vultr
|
v0.3.1 |
| webnames.ca | Website |
webnamesca
|
v4.28.0 |
| webnames.ru | Website |
webnames
|
v4.15.0 |
| Websupport | Website |
websupport
|
v4.10.0 |
| WEDOS | Website |
wedos
|
v4.4.0 |
| West.cn/西部数码 | Website |
westcn
|
v4.21.0 |
| Yandex 360 | Website |
yandex360
|
v4.14.0 |
| Yandex Cloud | Website |
yandexcloud
|
v4.9.0 |
| Yandex PDD | Website |
yandex
|
v3.7.0 |
| Zone.ee | Website |
zoneee
|
v2.1.0 |
| ZoneEdit | Website |
zoneedit
|
v4.25.0 |
| Zonomi | Website |
zonomi
|
v3.5.0 |
Configuration for Infoblox.
infobloxHere is an example bash command using the Infoblox provider:
INFOBLOX_USERNAME=api-user-529 \
INFOBLOX_PASSWORD=b9841238feb177a84330febba8a83208921177bffe733 \
INFOBLOX_HOST=infoblox.example.org
lego --email you@example.com --dns infoblox -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
INFOBLOX_HOST |
Host URI |
INFOBLOX_PASSWORD |
Account Password |
INFOBLOX_USERNAME |
Account Username |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
INFOBLOX_CA_CERTIFICATE |
The path to the CA certificate (PEM encoded) |
INFOBLOX_DNS_VIEW |
The view for the TXT records (Default: External) |
INFOBLOX_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
INFOBLOX_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
INFOBLOX_PORT |
The port for the infoblox grid manager (Default: 443) |
INFOBLOX_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 60) |
INFOBLOX_SSL_VERIFY |
Whether or not to verify the TLS certificate (Default: true) |
INFOBLOX_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 120) |
INFOBLOX_WAPI_VERSION |
The version of WAPI being used (Default: 2.11) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
When creating an API’s user ensure it has the proper permissions for the view you are working with.
Configuration for Infomaniak.
infomaniakHere is an example bash command using the Infomaniak provider:
INFOMANIAK_ACCESS_TOKEN=1234567898765432 \
lego --email you@example.com --dns infomaniak -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
INFOMANIAK_ACCESS_TOKEN |
Access token |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
INFOMANIAK_ENDPOINT |
https://api.infomaniak.com |
INFOMANIAK_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
INFOMANIAK_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 10) |
INFOMANIAK_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 120) |
INFOMANIAK_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 300) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Access token can be created at the url https://manager.infomaniak.com/v3/infomaniak-api. You will need domain scope.
Configuration for Internet.bs.
internetbsHere is an example bash command using the Internet.bs provider:
INTERNET_BS_API_KEY=xxxxxxxxxxxxxxxxxxxxxxxxxx \
INTERNET_BS_PASSWORD=yyyyyyyyyyyyyyyyyyyyyyyyyy \
lego --email you@example.com --dns internetbs -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
INTERNET_BS_API_KEY |
API key |
INTERNET_BS_PASSWORD |
API password |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
INTERNET_BS_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
INTERNET_BS_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
INTERNET_BS_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 60) |
INTERNET_BS_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 3600) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for INWX.
inwxHere is an example bash command using the INWX provider:
INWX_USERNAME=xxxxxxxxxx \
INWX_PASSWORD=yyyyyyyyyy \
lego --email you@example.com --dns inwx -d '*.example.com' -d example.com run
# 2FA
INWX_USERNAME=xxxxxxxxxx \
INWX_PASSWORD=yyyyyyyyyy \
INWX_SHARED_SECRET=zzzzzzzzzz \
lego --email you@example.com --dns inwx -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
INWX_PASSWORD |
Password |
INWX_USERNAME |
Username |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
INWX_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
INWX_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 360) |
INWX_SANDBOX |
Activate the sandbox (boolean) |
INWX_SHARED_SECRET |
shared secret related to 2FA |
INWX_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 300) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for Ionos.
ionosHere is an example bash command using the Ionos provider:
IONOS_API_KEY=xxxxxxxx \
lego --email you@example.com --dns ionos -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
IONOS_API_KEY |
API key <prefix>.<secret> https://developer.hosting.ionos.com/docs/getstarted |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
IONOS_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
IONOS_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
IONOS_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 900) |
IONOS_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 300) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for IPv64.
ipv64Here is an example bash command using the IPv64 provider:
IPV64_API_KEY=xxxxxx \
lego --email you@example.com --dns ipv64 -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
IPV64_API_KEY |
Account API Key |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
IPV64_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
IPV64_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
IPV64_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 60) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
The iwantmyname API has shut down.
https://github.com/go-acme/lego/issues/2563
iwantmynameHere is an example bash command using the iwantmyname (Deprecated) provider:
IWANTMYNAME_USERNAME=xxxxxxxx \
IWANTMYNAME_PASSWORD=xxxxxxxx \
lego --email you@example.com --dns iwantmyname -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
IWANTMYNAME_PASSWORD |
API password |
IWANTMYNAME_USERNAME |
API username |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
IWANTMYNAME_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
IWANTMYNAME_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
IWANTMYNAME_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 60) |
IWANTMYNAME_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 120) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for Joker.
jokerHere is an example bash command using the Joker provider:
# SVC
JOKER_API_MODE=SVC \
JOKER_USERNAME=<your email> \
JOKER_PASSWORD=<your password> \
lego --email you@example.com --dns joker -d '*.example.com' -d example.com run
# DMAPI
JOKER_API_MODE=DMAPI \
JOKER_USERNAME=<your email> \
JOKER_PASSWORD=<your password> \
lego --email you@example.com --dns joker -d '*.example.com' -d example.com run
## or
JOKER_API_MODE=DMAPI \
JOKER_API_KEY=<your API key> \
lego --email you@example.com --dns joker -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
JOKER_API_KEY |
API key (only with DMAPI mode) |
JOKER_API_MODE |
‘DMAPI’ or ‘SVC’. DMAPI is for resellers accounts. (Default: DMAPI) |
JOKER_PASSWORD |
Joker.com password |
JOKER_USERNAME |
Joker.com username |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
JOKER_HTTP_TIMEOUT |
API request timeout in seconds (Default: 60) |
JOKER_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
JOKER_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 120) |
JOKER_SEQUENCE_INTERVAL |
Time between sequential requests in seconds (Default: 60), only with ‘SVC’ mode |
JOKER_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 120) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
In the SVC mode, username and passsword are not your email and account passwords, but those displayed in Joker.com domain dashboard when enabling Dynamic DNS.
As per Joker.com documentation:
please log in at Joker.com, visit ‘My Domains’, find the domain you want to add Let’s Encrypt certificate for, and chose “DNS” in the menu
on the top right, you will find the setting for ‘Dynamic DNS’. If not already active, please activate it. It will not affect any other already existing DNS records of this domain.
please take a note of the credentials which are now shown as ‘Dynamic DNS Authentication’, consisting of a ‘username’ and a ‘password’.
this is all you have to do here - and only once per domain.
Configuration for KeyHelp.
keyhelpHere is an example bash command using the KeyHelp provider:
KEYHELP_BASE_URL="https://keyhelp.example.com" \
KEYHELP_API_KEY="xxx" \
lego --email you@example.com --dns keyhelp -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
KEYHELP_API_KEY |
API key |
KEYHELP_BASE_URL |
Server URL |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
KEYHELP_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
KEYHELP_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
KEYHELP_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 60) |
KEYHELP_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 120) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for Liara.
liaraHere is an example bash command using the Liara provider:
LIARA_API_KEY="xxxxxxxxxxxxxxxxxxxxx" \
lego --email you@example.com --dns liara -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
LIARA_API_KEY |
The API key |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
LIARA_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
LIARA_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
LIARA_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 60) |
LIARA_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 3600) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for Amazon Lightsail.
lightsailPlease contribute by adding a CLI example.
| Environment Variable Name | Description |
|---|---|
AWS_ACCESS_KEY_ID |
Managed by the AWS client. Access key ID (AWS_ACCESS_KEY_ID_FILE is not supported, use AWS_SHARED_CREDENTIALS_FILE instead) |
AWS_SECRET_ACCESS_KEY |
Managed by the AWS client. Secret access key (AWS_SECRET_ACCESS_KEY_FILE is not supported, use AWS_SHARED_CREDENTIALS_FILE instead) |
DNS_ZONE |
Domain name of the DNS zone |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
AWS_SHARED_CREDENTIALS_FILE |
Managed by the AWS client. Shared credentials file. |
LIGHTSAIL_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
LIGHTSAIL_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 120) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
AWS Credentials are automatically detected in the following locations and prioritized in the following order:
AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, [AWS_SESSION_TOKEN]~/.aws/credentials, profiles can be specified using AWS_PROFILE)AWS region is not required to set as the Lightsail DNS zone is in global (us-east-1) region.
The following AWS IAM policy document describes the minimum permissions required for lego to complete the DNS challenge.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"lightsail:DeleteDomainEntry",
"lightsail:CreateDomainEntry"
],
"Resource": "<Lightsail DNS zone ARN>"
}
]
}Replace the Resource value with your Lightsail DNS zone ARN.
You can retrieve the ARN using aws cli by running aws lightsail get-domains --region us-east-1 (Lightsail web console does not show the ARN, unfortunately).
It should be in the format of arn:aws:lightsail:global:<ACCOUNT ID>:Domain/<DOMAIN ID>.
You also need to replace the region in the ARN to us-east-1 (instead of global).
Alternatively, you can also set the Resource to * (wildcard), which allow to access all domain, but this is not recommended.
Configuration for Lima-City.
limacityHere is an example bash command using the Lima-City provider:
LIMACITY_API_KEY="xxxxxxxxxxxxxxxxxxxxx" \
lego --email you@example.com --dns limacity -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
LIMACITY_API_KEY |
The API key |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
LIMACITY_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
LIMACITY_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 80) |
LIMACITY_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 480) |
LIMACITY_SEQUENCE_INTERVAL |
Time between sequential requests in seconds (Default: 90) |
LIMACITY_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 60) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for Linode (v4).
linodeHere is an example bash command using the Linode (v4) provider:
LINODE_TOKEN=xxxxx \
lego --email you@example.com --dns linode -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
LINODE_TOKEN |
API token |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
LINODE_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
LINODE_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 15) |
LINODE_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 120) |
LINODE_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 300) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for Liquid Web.
liquidwebHere is an example bash command using the Liquid Web provider:
LWAPI_USERNAME=someuser \
LWAPI_PASSWORD=somepass \
lego --email you@example.com --dns liquidweb -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
LWAPI_PASSWORD |
Liquid Web API Password |
LWAPI_USERNAME |
Liquid Web API Username |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
LWAPI_HTTP_TIMEOUT |
API request timeout in seconds (Default: 60) |
LWAPI_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
LWAPI_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 120) |
LWAPI_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 300) |
LWAPI_URL |
Liquid Web API endpoint |
LWAPI_ZONE |
DNS Zone |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for Loopia.
loopiaHere is an example bash command using the Loopia provider:
LOOPIA_API_USER=xxxxxxxx \
LOOPIA_API_PASSWORD=yyyyyyyy \
lego --email you@example.com --dns loopia -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
LOOPIA_API_PASSWORD |
API password |
LOOPIA_API_USER |
API username |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
LOOPIA_API_URL |
API endpoint. Ex: https://api.loopia.se/RPCSERV or https://api.loopia.rs/RPCSERV |
LOOPIA_HTTP_TIMEOUT |
API request timeout in seconds (Default: 60) |
LOOPIA_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2400) |
LOOPIA_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 60) |
LOOPIA_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 300) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
You can generate a new API user from your account page.
It needs to have the following permissions:
Configuration for LuaDNS.
luadnsHere is an example bash command using the LuaDNS provider:
LUADNS_API_USERNAME=youremail \
LUADNS_API_TOKEN=xxxxxxxx \
lego --email you@example.com --dns luadns -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
LUADNS_API_TOKEN |
API token |
LUADNS_API_USERNAME |
Username (your email) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
LUADNS_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
LUADNS_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
LUADNS_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 120) |
LUADNS_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 300) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for Mail-in-a-Box.
mailinaboxHere is an example bash command using the Mail-in-a-Box provider:
MAILINABOX_EMAIL=user@example.com \
MAILINABOX_PASSWORD=yyyy \
MAILINABOX_BASE_URL=https://box.example.com \
lego --email you@example.com --dns mailinabox -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
MAILINABOX_BASE_URL |
Base API URL (ex: https://box.example.com) |
MAILINABOX_EMAIL |
User email |
MAILINABOX_PASSWORD |
User password |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
MAILINABOX_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
MAILINABOX_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 4) |
MAILINABOX_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 120) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for ManageEngine CloudDNS.
manageengineHere is an example bash command using the ManageEngine CloudDNS provider:
MANAGEENGINE_CLIENT_ID="xxx" \
MANAGEENGINE_CLIENT_SECRET="yyy" \
lego --email you@example.com --dns manageengine -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
MANAGEENGINE_CLIENT_ID |
Client ID |
MANAGEENGINE_CLIENT_SECRET |
Client Secret |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
MANAGEENGINE_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
MANAGEENGINE_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 60) |
MANAGEENGINE_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 120) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Solving the DNS-01 challenge using CLI prompt.
To start using the CLI prompt “provider”, start lego with --dns manual:
$ lego --email "you@example.com" --domains="example.com" --dns "manual" run
What follows are a few log print-outs, interspersed with some prompts, asking for you to do perform some actions:
No key found for account you@example.com. Generating a P256 key.
Saved key to ./.lego/accounts/acme-v02.api.letsencrypt.org/you@example.com/keys/you@example.com.key
Please review the TOS at https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf
Do you accept the TOS? Y/nIf you accept the linked Terms of Service, hit Enter.
[INFO] acme: Registering account for you@example.com
!!!! HEADS UP !!!!
Your account credentials have been saved in your Let's Encrypt
configuration directory at "./.lego/accounts".
You should make a secure backup of this folder now. This
configuration directory will also contain certificates and
private keys obtained from Let's Encrypt so making regular
backups of this folder is ideal.
[INFO] [example.com] acme: Obtaining bundled SAN certificate
[INFO] [example.com] AuthURL: https://acme-v02.api.letsencrypt.org/acme/authz-v3/2345678901
[INFO] [example.com] acme: Could not find solver for: tls-alpn-01
[INFO] [example.com] acme: Could not find solver for: http-01
[INFO] [example.com] acme: use dns-01 solver
[INFO] [example.com] acme: Preparing to solve DNS-01
lego: Please create the following TXT record in your example.com. zone:
_acme-challenge.example.com. 120 IN TXT "hX0dPkG6Gfs9hUvBAchQclkyyoEKbShbpvJ9mY5q2JQ"
lego: Press 'Enter' when you are doneDo as instructed, and create the TXT records, and hit Enter.
[INFO] [example.com] acme: Trying to solve DNS-01
[INFO] [example.com] acme: Checking DNS record propagation using [192.168.8.1:53]
[INFO] Wait for propagation [timeout: 1m0s, interval: 2s]
[INFO] [example.com] acme: Waiting for DNS record propagation.
[INFO] [example.com] The server validated our request
[INFO] [example.com] acme: Cleaning DNS-01 challenge
lego: You can now remove this TXT record from your example.com. zone:
_acme-challenge.example.com. 120 IN TXT "hX0dPkG6Gfs9hUvBAchQclkyyoEKbShbpvJ9mY5q2JQ"
[INFO] [example.com] acme: Validations succeeded; requesting certificates
[INFO] [example.com] Server responded with a certificate.As mentioned, you can now remove the TXT record again.
Configuration for Metaname.
metanameHere is an example bash command using the Metaname provider:
METANAME_ACCOUNT_REFERENCE=xxxx \
METANAME_API_KEY=yyyyyyy \
lego --email you@example.com --dns metaname -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
METANAME_ACCOUNT_REFERENCE |
The four-digit reference of a Metaname account |
METANAME_API_KEY |
API Key |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
METANAME_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
METANAME_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 60) |
METANAME_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 120) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for Metaregistrar.
metaregistrarHere is an example bash command using the Metaregistrar provider:
METAREGISTRAR_API_TOKEN="xxxxxxxxxxxxxxxxxxxxx" \
lego --email you@example.com --dns metaregistrar -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
METAREGISTRAR_API_TOKEN |
The API token |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
METAREGISTRAR_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
METAREGISTRAR_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
METAREGISTRAR_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 60) |
METAREGISTRAR_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 120) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for mijn.host.
mijnhostHere is an example bash command using the mijn.host provider:
MIJNHOST_API_KEY="xxxxxxxxxxxxxxxxxxxxx" \
lego --email you@example.com --dns mijnhost -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
MIJNHOST_API_KEY |
The API key |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
MIJNHOST_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
MIJNHOST_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
MIJNHOST_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 60) |
MIJNHOST_SEQUENCE_INTERVAL |
Time between sequential requests in seconds (Default: 60) |
MIJNHOST_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 120) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for Mittwald.
mittwaldHere is an example bash command using the Mittwald provider:
MITTWALD_TOKEN=my-token \
lego --email you@example.com --dns mittwald -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
MITTWALD_TOKEN |
API token |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
MITTWALD_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
MITTWALD_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 10) |
MITTWALD_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 120) |
MITTWALD_SEQUENCE_INTERVAL |
Time between sequential requests in seconds (Default: 120) |
MITTWALD_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 300) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for myaddr.{tools,dev,io}.
myaddrHere is an example bash command using the myaddr.{tools,dev,io} provider:
MYADDR_PRIVATE_KEYS_MAPPING="example:123,test:456" \
lego --email you@example.com --dns myaddr -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
MYADDR_PRIVATE_KEYS_MAPPING |
Mapping between subdomains and private keys. The format is: <subdomain1>:<private_key1>,<subdomain2>:<private_key2>,<subdomain3>:<private_key3> |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
MYADDR_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
MYADDR_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
MYADDR_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 60) |
MYADDR_SEQUENCE_INTERVAL |
Time between sequential requests in seconds (Default: 2) |
MYADDR_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 120) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for MyDNS.jp.
mydnsjpHere is an example bash command using the MyDNS.jp provider:
MYDNSJP_MASTER_ID=xxxxx \
MYDNSJP_PASSWORD=xxxxx \
lego --email you@example.com --dns mydnsjp -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
MYDNSJP_MASTER_ID |
Master ID |
MYDNSJP_PASSWORD |
Password |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
MYDNSJP_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
MYDNSJP_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
MYDNSJP_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 120) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for MythicBeasts.
mythicbeastsHere is an example bash command using the MythicBeasts provider:
MYTHICBEASTS_USERNAME=myuser \
MYTHICBEASTS_PASSWORD=mypass \
lego --email you@example.com --dns mythicbeasts -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
MYTHICBEASTS_PASSWORD |
Password |
MYTHICBEASTS_USERNAME |
User name |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
MYTHICBEASTS_API_ENDPOINT |
The endpoint for the API (must implement v2) |
MYTHICBEASTS_AUTH_API_ENDPOINT |
The endpoint for Mythic Beasts’ Authentication |
MYTHICBEASTS_HTTP_TIMEOUT |
API request timeout in seconds (Default: 10) |
MYTHICBEASTS_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
MYTHICBEASTS_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 60) |
MYTHICBEASTS_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 120) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
If you are using specific API keys, then the username is the API ID for your API key, and the password is the API secret.
Your API key name is not needed to operate lego.
Configuration for Namecheap.
To enable API access on the Namecheap production environment, some opaque requirements must be met. More information in the section Enabling API Access of the Namecheap documentation. (2020-08: Account balance of $50+, 20+ domains in your account, or purchases totaling $50+ within the last 2 years.)
namecheapHere is an example bash command using the Namecheap provider:
NAMECHEAP_API_USER=user \
NAMECHEAP_API_KEY=key \
lego --email you@example.com --dns namecheap -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
NAMECHEAP_API_KEY |
API key |
NAMECHEAP_API_USER |
API user |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
NAMECHEAP_HTTP_TIMEOUT |
API request timeout in seconds (Default: 60) |
NAMECHEAP_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 15) |
NAMECHEAP_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 3600) |
NAMECHEAP_SANDBOX |
Activate the sandbox (boolean) |
NAMECHEAP_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 120) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for Name.com.
namedotcomHere is an example bash command using the Name.com provider:
NAMECOM_USERNAME=foo.bar \
NAMECOM_API_TOKEN=a379a6f6eeafb9a55e378c118034e2751e682fab \
lego --email you@example.com --dns namedotcom -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
NAMECOM_API_TOKEN |
API token |
NAMECOM_USERNAME |
Username |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
NAMECOM_HTTP_TIMEOUT |
API request timeout in seconds (Default: 10) |
NAMECOM_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 20) |
NAMECOM_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 900) |
NAMECOM_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 300) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for Namesilo.
namesiloHere is an example bash command using the Namesilo provider:
NAMESILO_API_KEY=b9841238feb177a84330febba8a83208921177bffe733 \
lego --email you@example.com --dns namesilo -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
NAMESILO_API_KEY |
Client ID |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
NAMESILO_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
NAMESILO_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 60), it is better to set larger than 15 minutes |
NAMESILO_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 3600), should be in [3600, 2592000] |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for NearlyFreeSpeech.NET.
nearlyfreespeechHere is an example bash command using the NearlyFreeSpeech.NET provider:
NEARLYFREESPEECH_API_KEY=xxxxxx \
NEARLYFREESPEECH_LOGIN=xxxx \
lego --email you@example.com --dns nearlyfreespeech -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
NEARLYFREESPEECH_API_KEY |
API Key for API requests |
NEARLYFREESPEECH_LOGIN |
Username for API requests |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
NEARLYFREESPEECH_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
NEARLYFREESPEECH_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
NEARLYFREESPEECH_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 60) |
NEARLYFREESPEECH_SEQUENCE_INTERVAL |
Time between sequential requests in seconds (Default: 60) |
NEARLYFREESPEECH_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 3600) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for Netcup.
netcupHere is an example bash command using the Netcup provider:
NETCUP_CUSTOMER_NUMBER=xxxx \
NETCUP_API_KEY=yyyy \
NETCUP_API_PASSWORD=zzzz \
lego --email you@example.com --dns netcup -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
NETCUP_API_KEY |
API key |
NETCUP_API_PASSWORD |
API password |
NETCUP_CUSTOMER_NUMBER |
Customer number |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
NETCUP_HTTP_TIMEOUT |
API request timeout in seconds (Default: 10) |
NETCUP_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 30) |
NETCUP_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 900) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for Netlify.
netlifyHere is an example bash command using the Netlify provider:
NETLIFY_TOKEN=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx \
lego --email you@example.com --dns netlify -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
NETLIFY_TOKEN |
Token |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
NETLIFY_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
NETLIFY_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
NETLIFY_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 60) |
NETLIFY_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 300) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for Nicmanager.
nicmanagerHere is an example bash command using the Nicmanager provider:
## Login using email
NICMANAGER_API_EMAIL = "you@example.com" \
NICMANAGER_API_PASSWORD = "password" \
# Optionally, if your account has TOTP enabled, set the secret here
NICMANAGER_API_OTP = "long-secret" \
lego --email you@example.com --dns nicmanager -d '*.example.com' -d example.com run
## Login using account name + username
NICMANAGER_API_LOGIN = "myaccount" \
NICMANAGER_API_USERNAME = "myuser" \
NICMANAGER_API_PASSWORD = "password" \
# Optionally, if your account has TOTP enabled, set the secret here
NICMANAGER_API_OTP = "long-secret" \
lego --email you@example.com --dns nicmanager -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
NICMANAGER_API_EMAIL |
Email-based login |
NICMANAGER_API_LOGIN |
Login, used for Username-based login |
NICMANAGER_API_PASSWORD |
Password, always required |
NICMANAGER_API_USERNAME |
Username, used for Username-based login |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
NICMANAGER_API_MODE |
mode: ‘anycast’ or ‘zones’ (for FreeDNS) (default: ‘anycast’) |
NICMANAGER_API_OTP |
TOTP Secret (optional) |
NICMANAGER_HTTP_TIMEOUT |
API request timeout in seconds (Default: 10) |
NICMANAGER_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
NICMANAGER_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 300) |
NICMANAGER_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 900) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
You can log in using your account name + username or using your email address.
Optionally, if TOTP is configured for your account, set NICMANAGER_API_OTP.
Configuration for RU CENTER.
nicruHere is an example bash command using the RU CENTER provider:
NICRU_USER="<your_user>" \
NICRU_PASSWORD="<your_password>" \
NICRU_SERVICE_ID="<service_id>" \
NICRU_SECRET="<service_secret>" \
lego --dns nicru --domains "*.example.com" --email you@example.com run| Environment Variable Name | Description |
|---|---|
NICRU_PASSWORD |
Password for an account in RU CENTER |
NICRU_SECRET |
Secret for application in DNS-hosting RU CENTER |
NICRU_SERVICE_ID |
Service ID for application in DNS-hosting RU CENTER |
NICRU_SERVICE_NAME |
Service Name for DNS-hosting RU CENTER |
NICRU_USER |
Agreement for an account in RU CENTER |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
NICRU_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 60) |
NICRU_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 600) |
NICRU_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 30) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
You can find information about service ID and secret https://www.nic.ru/manager/oauth.cgi?step=oauth.app_list
| ENV Variable | Parameter from page | Example |
|---|---|---|
| NICRU_USER | Username (Number of agreement) | NNNNNNN/NIC-D |
| NICRU_PASSWORD | Password account | |
| NICRU_SERVICE_ID | Application ID | hex-based, len 32 |
| NICRU_SECRET | Identity endpoint | string len 91 |
Configuration for NIFCloud.
nifcloudHere is an example bash command using the NIFCloud provider:
NIFCLOUD_ACCESS_KEY_ID=xxxx \
NIFCLOUD_SECRET_ACCESS_KEY=yyyy \
lego --email you@example.com --dns nifcloud -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
NIFCLOUD_ACCESS_KEY_ID |
Access key |
NIFCLOUD_SECRET_ACCESS_KEY |
Secret access key |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
NIFCLOUD_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
NIFCLOUD_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
NIFCLOUD_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 60) |
NIFCLOUD_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 120) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for Njalla.
njallaHere is an example bash command using the Njalla provider:
NJALLA_TOKEN=xxxxxxxxxxxxxxxxxxxxxxxxxx \
lego --email you@example.com --dns njalla -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
NJALLA_TOKEN |
API token |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
NJALLA_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
NJALLA_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
NJALLA_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 60) |
NJALLA_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 300) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for Nodion.
nodionHere is an example bash command using the Nodion provider:
NODION_API_TOKEN="xxxxxxxxxxxxxxxxxxxxx" \
lego --email you@example.com --dns nodion -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
NODION_API_TOKEN |
The API token |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
NODION_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
NODION_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
NODION_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 120) |
NODION_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 120) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for NS1.
ns1Here is an example bash command using the NS1 provider:
NS1_API_KEY=xxxx \
lego --email you@example.com --dns ns1 -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
NS1_API_KEY |
API key |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
NS1_HTTP_TIMEOUT |
API request timeout in seconds (Default: 10) |
NS1_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
NS1_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 60) |
NS1_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 120) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for Octenium.
octeniumHere is an example bash command using the Octenium provider:
OCTENIUM_API_KEY="xxx" \
lego --email you@example.com --dns octenium -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
OCTENIUM_API_KEY |
API key |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
OCTENIUM_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
OCTENIUM_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
OCTENIUM_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 60) |
OCTENIUM_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 120) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for Oracle Cloud.
oraclecloudHere is an example bash command using the Oracle Cloud provider:
# Using API Key authentication:
OCI_PRIVATE_KEY_PATH="~/.oci/oci_api_key.pem" \
OCI_PRIVATE_KEY_PASSWORD="secret" \
OCI_TENANCY_OCID="ocid1.tenancy.oc1..secret" \
OCI_USER_OCID="ocid1.user.oc1..secret" \
OCI_FINGERPRINT="00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00" \
OCI_REGION="us-phoenix-1" \
OCI_COMPARTMENT_OCID="ocid1.tenancy.oc1..secret" \
lego --email you@example.com --dns oraclecloud -d '*.example.com' -d example.com run
# Using Instance Principal authentication (when running on OCI compute instances):
# https://docs.oracle.com/en-us/iaas/Content/Identity/Tasks/callingservicesfrominstances.htm
OCI_AUTH_TYPE="instance_principal" \
OCI_COMPARTMENT_OCID="ocid1.tenancy.oc1..secret" \
lego --email you@example.com --dns oraclecloud -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
OCI_COMPARTMENT_OCID |
Compartment OCID |
OCI_FINGERPRINT |
Public key fingerprint (ignored if OCI_AUTH_TYPE=instance_principal) |
OCI_PRIVATE_KEY_PASSWORD |
Private key password (ignored if OCI_AUTH_TYPE=instance_principal) |
OCI_PRIVATE_KEY_PATH |
Private key file (ignored if OCI_AUTH_TYPE=instance_principal) |
OCI_REGION |
Region (it can be empty if OCI_AUTH_TYPE=instance_principal). |
OCI_TENANCY_OCID |
Tenancy OCID (ignored if OCI_AUTH_TYPE=instance_principal) |
OCI_USER_OCID |
User OCID (ignored if OCI_AUTH_TYPE=instance_principal) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
OCI_AUTH_TYPE |
Authorization type. Possible values: ‘instance_principal’, ’’ (Default: ‘’) |
OCI_HTTP_TIMEOUT |
API request timeout in seconds (Default: 60) |
OCI_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
OCI_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 60) |
OCI_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 120) |
TF_VAR_fingerprint |
Alias on OCI_FINGERPRINT |
TF_VAR_private_key_path |
Alias on OCI_PRIVATE_KEY_PATH |
TF_VAR_region |
Alias on OCI_REGION |
TF_VAR_tenancy_ocid |
Alias on OCI_TENANCY_OCID |
TF_VAR_user_ocid |
Alias on OCI_USER_OCID |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for Open Telekom Cloud.
otcHere is an example bash command using the Open Telekom Cloud provider:
OTC_DOMAIN_NAME=domain_name \
OTC_USER_NAME=user_name \
OTC_PASSWORD=password \
OTC_PROJECT_NAME=project_name \
lego --email you@example.com --dns otc -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
OTC_DOMAIN_NAME |
Domain name |
OTC_PASSWORD |
Password |
OTC_PROJECT_NAME |
Project name |
OTC_USER_NAME |
User name |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
OTC_HTTP_TIMEOUT |
API request timeout in seconds (Default: 10) |
OTC_IDENTITY_ENDPOINT |
Identity endpoint URL (default: https://iam.eu-de.otc.t-systems.com:443/v3/auth/tokens) |
OTC_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
OTC_PRIVATE_ZONE |
Set to true to use private zones only (default: use public zones only) |
OTC_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 60) |
OTC_SEQUENCE_INTERVAL |
Time between sequential requests in seconds (Default: 60) |
OTC_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 300) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for OVH.
ovhHere is an example bash command using the OVH provider:
# Application Key authentication:
OVH_APPLICATION_KEY=1234567898765432 \
OVH_APPLICATION_SECRET=b9841238feb177a84330febba8a832089 \
OVH_CONSUMER_KEY=256vfsd347245sdfg \
OVH_ENDPOINT=ovh-eu \
lego --email you@example.com --dns ovh -d '*.example.com' -d example.com run
# Or Access Token:
OVH_ACCESS_TOKEN=xxx \
OVH_ENDPOINT=ovh-eu \
lego --email you@example.com --dns ovh -d '*.example.com' -d example.com run
# Or OAuth2:
OVH_CLIENT_ID=yyy \
OVH_CLIENT_SECRET=xxx \
OVH_ENDPOINT=ovh-eu \
lego --email you@example.com --dns ovh -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
OVH_ACCESS_TOKEN |
Access token |
OVH_APPLICATION_KEY |
Application key (Application Key authentication) |
OVH_APPLICATION_SECRET |
Application secret (Application Key authentication) |
OVH_CLIENT_ID |
Client ID (OAuth2) |
OVH_CLIENT_SECRET |
Client secret (OAuth2) |
OVH_CONSUMER_KEY |
Consumer key (Application Key authentication) |
OVH_ENDPOINT |
Endpoint URL (ovh-eu or ovh-ca) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
OVH_HTTP_TIMEOUT |
API request timeout in seconds (Default: 180) |
OVH_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
OVH_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 60) |
OVH_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 120) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Application key and secret can be created by following the OVH guide.
When requesting the consumer key, the following configuration can be used to define access rights:
{
"accessRules": [
{
"method": "POST",
"path": "/domain/zone/*"
},
{
"method": "DELETE",
"path": "/domain/zone/*"
}
]
}Another method for authentication is by using OAuth2 client credentials.
An IAM policy and service account can be created by following the OVH guide.
Following IAM policies need to be authorized for the affected domain:
Both authentication methods cannot be used at the same time.
Configuration for PowerDNS.
pdnsHere is an example bash command using the PowerDNS provider:
PDNS_API_URL=http://pdns-server:80/ \
PDNS_API_KEY=xxxx \
lego --email you@example.com --dns pdns -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
PDNS_API_KEY |
API key |
PDNS_API_URL |
API URL |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
PDNS_API_VERSION |
Skip API version autodetection and use the provided version number. |
PDNS_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
PDNS_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
PDNS_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 120) |
PDNS_SERVER_NAME |
Name of the server in the URL, ’localhost’ by default |
PDNS_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 120) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Tested and confirmed to work with PowerDNS authoritative server 3.4.8 and 4.0.1. Refer to PowerDNS documentation instructions on how to enable the built-in API interface.
PowerDNS Notes:
_acme-challenge record is added/modified via the API, set SOA-EDIT-API to INCEPTION-INCREMENT for the zone in the domainmetadata tablePDNS_API_VERSION.Configuration for plesk.com.
pleskHere is an example bash command using the plesk.com provider:
PLESK_SERVER_BASE_URL="https://plesk.myserver.com:8443" \
PLESK_USERNAME=xxxxxx \
PLESK_PASSWORD=yyyyyy \
lego --email you@example.com --dns plesk -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
PLESK_PASSWORD |
API password |
PLESK_SERVER_BASE_URL |
Base URL of the server (ex: https://plesk.myserver.com:8443) |
PLESK_USERNAME |
API username |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
PLESK_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
PLESK_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
PLESK_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 60) |
PLESK_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 300) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for Porkbun.
porkbunHere is an example bash command using the Porkbun provider:
PORKBUN_SECRET_API_KEY=xxxxxx \
PORKBUN_API_KEY=yyyyyy \
lego --email you@example.com --dns porkbun -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
PORKBUN_API_KEY |
API key |
PORKBUN_SECRET_API_KEY |
secret API key |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
PORKBUN_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
PORKBUN_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 10) |
PORKBUN_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 600) |
PORKBUN_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 300) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for Rackspace.
rackspaceHere is an example bash command using the Rackspace provider:
RACKSPACE_USER=xxxx \
RACKSPACE_API_KEY=yyyy \
lego --email you@example.com --dns rackspace -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
RACKSPACE_API_KEY |
API key |
RACKSPACE_USER |
API user |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
RACKSPACE_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
RACKSPACE_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 3) |
RACKSPACE_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 60) |
RACKSPACE_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 300) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for Rain Yun/雨云.
rainyunHere is an example bash command using the Rain Yun/雨云 provider:
RAINYUN_API_KEY="xxxxxxxxxxxxxxxxxxxxx" \
lego --email you@example.com --dns rainyun -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
RAINYUN_API_KEY |
API key |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
RAINYUN_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
RAINYUN_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
RAINYUN_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 120) |
RAINYUN_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 120) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for RcodeZero.
rcodezeroHere is an example bash command using the RcodeZero provider:
RCODEZERO_API_TOKEN=<mytoken> \
lego --email you@example.com --dns rcodezero -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
RCODEZERO_API_TOKEN |
API token |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
RCODEZERO_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
RCODEZERO_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 10) |
RCODEZERO_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 240) |
RCODEZERO_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 120) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Generate your API Token via https://my.rcodezero.at with the ACME permissions.
These are special tokens with limited access for ACME requests only.
RcodeZero is an Anycast Network so the distribution of the DNS01-Challenge can take up to 2 minutes.
Configuration for Regfish.
regfishHere is an example bash command using the Regfish provider:
REGFISH_API_KEY="xxxxxxxxxxxxxxxxxxxxx" \
lego --email you@example.com --dns regfish -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
REGFISH_API_KEY |
API key |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
REGFISH_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
REGFISH_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
REGFISH_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 60) |
REGFISH_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 120) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for reg.ru.
regruHere is an example bash command using the reg.ru provider:
REGRU_USERNAME=xxxxxx \
REGRU_PASSWORD=yyyyyy \
lego --email you@example.com --dns regru -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
REGRU_PASSWORD |
API password |
REGRU_USERNAME |
API username |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
REGRU_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
REGRU_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
REGRU_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 60) |
REGRU_TLS_CERT |
authentication certificate |
REGRU_TLS_KEY |
authentication private key |
REGRU_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 300) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for RFC2136.
rfc2136Here is an example bash command using the RFC2136 provider:
RFC2136_NAMESERVER=127.0.0.1 \
RFC2136_TSIG_KEY=example.com \
RFC2136_TSIG_ALGORITHM=hmac-sha256. \
RFC2136_TSIG_SECRET=YWJjZGVmZGdoaWprbG1ub3BxcnN0dXZ3eHl6MTIzNDU= \
lego --email you@example.com --dns rfc2136 -d '*.example.com' -d example.com run
## ---
keyname=example.com; keyfile=example.com.key; tsig-keygen $keyname > $keyfile
RFC2136_NAMESERVER=127.0.0.1 \
RFC2136_TSIG_FILE="$keyfile" \
lego --email you@example.com --dns rfc2136 -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
RFC2136_NAMESERVER |
Network address in the form “host” or “host:port” |
RFC2136_TSIG_ALGORITHM |
TSIG algorithm. See miekg/dns#tsig.go for supported values. To disable TSIG authentication, leave the RFC2136_TSIG_KEY or RFC2136_TSIG_SECRET variables unset. |
RFC2136_TSIG_KEY |
Name of the secret key as defined in DNS server configuration. To disable TSIG authentication, leave the RFC2136_TSIG_KEY variable unset. |
RFC2136_TSIG_SECRET |
Secret key payload. To disable TSIG authentication, leave the RFC2136_TSIG_SECRET variable unset. |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
RFC2136_DNS_TIMEOUT |
API request timeout in seconds (Default: 10) |
RFC2136_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
RFC2136_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 60) |
RFC2136_SEQUENCE_INTERVAL |
Time between sequential requests in seconds (Default: 60) |
RFC2136_TSIG_FILE |
Path to a key file generated by tsig-keygen |
RFC2136_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 120) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for RimuHosting.
rimuhostingHere is an example bash command using the RimuHosting provider:
RIMUHOSTING_API_KEY=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx \
lego --email you@example.com --dns rimuhosting -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
RIMUHOSTING_API_KEY |
User API key |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
RIMUHOSTING_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
RIMUHOSTING_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
RIMUHOSTING_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 60) |
RIMUHOSTING_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 3600) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for Amazon Route 53.
route53Here is an example bash command using the Amazon Route 53 provider:
AWS_ACCESS_KEY_ID=your_key_id \
AWS_SECRET_ACCESS_KEY=your_secret_access_key \
AWS_REGION=aws-region \
AWS_HOSTED_ZONE_ID=your_hosted_zone_id \
lego --email you@example.com --dns route53 -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
AWS_ACCESS_KEY_ID |
Managed by the AWS client. Access key ID (AWS_ACCESS_KEY_ID_FILE is not supported, use AWS_SHARED_CREDENTIALS_FILE instead) |
AWS_ASSUME_ROLE_ARN |
Managed by the AWS Role ARN (AWS_ASSUME_ROLE_ARN_FILE is not supported) |
AWS_EXTERNAL_ID |
Managed by STS AssumeRole API operation (AWS_EXTERNAL_ID_FILE is not supported) |
AWS_HOSTED_ZONE_ID |
Override the hosted zone ID. |
AWS_PROFILE |
Managed by the AWS client (AWS_PROFILE_FILE is not supported) |
AWS_REGION |
Managed by the AWS client (AWS_REGION_FILE is not supported) |
AWS_SDK_LOAD_CONFIG |
Managed by the AWS client. Retrieve the region from the CLI config file (AWS_SDK_LOAD_CONFIG_FILE is not supported) |
AWS_SECRET_ACCESS_KEY |
Managed by the AWS client. Secret access key (AWS_SECRET_ACCESS_KEY_FILE is not supported, use AWS_SHARED_CREDENTIALS_FILE instead) |
AWS_WAIT_FOR_RECORD_SETS_CHANGED |
Wait for changes to be INSYNC (it can be unstable) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
AWS_MAX_RETRIES |
The number of maximum returns the service will use to make an individual API request |
AWS_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 4) |
AWS_PRIVATE_ZONE |
Set to true to use private zones only (default: use public zones only) |
AWS_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 120) |
AWS_SHARED_CREDENTIALS_FILE |
Managed by the AWS client. Shared credentials file. |
AWS_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 10) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
AWS Credentials are automatically detected in the following locations and prioritized in the following order:
AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, [AWS_SESSION_TOKEN]~/.aws/credentials, profiles can be specified using AWS_PROFILE)The AWS Region is automatically detected in the following locations and prioritized in the following order:
AWS_REGIONAWS_SDK_LOAD_CONFIG is set (defaults to ~/.aws/config, profiles can be specified using AWS_PROFILE)If AWS_HOSTED_ZONE_ID is not set, Lego tries to determine the correct public hosted zone via the FQDN.
See also:
The following IAM policy document grants access to the required APIs needed by lego to complete the DNS challenge. A word of caution: These permissions grant write access to any DNS record in any hosted zone, so it is recommended to narrow them down as much as possible if you are using this policy in production.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"route53:GetChange",
"route53:ChangeResourceRecordSets",
"route53:ListResourceRecordSets"
],
"Resource": [
"arn:aws:route53:::hostedzone/*",
"arn:aws:route53:::change/*"
]
},
{
"Effect": "Allow",
"Action": "route53:ListHostedZonesByName",
"Resource": "*"
}
]
}The following AWS IAM policy document describes the least privilege permissions required for lego to complete the DNS challenge.
Write access is limited to a specified hosted zone’s DNS TXT records with a key of _acme-challenge.example.com.
Replace Z11111112222222333333 with your hosted zone ID and example.com with your domain name to use this policy.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "route53:GetChange",
"Resource": "arn:aws:route53:::change/*"
},
{
"Effect": "Allow",
"Action": "route53:ListHostedZonesByName",
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"route53:ListResourceRecordSets"
],
"Resource": [
"arn:aws:route53:::hostedzone/Z11111112222222333333"
]
},
{
"Effect": "Allow",
"Action": [
"route53:ChangeResourceRecordSets"
],
"Resource": [
"arn:aws:route53:::hostedzone/Z11111112222222333333"
],
"Condition": {
"ForAllValues:StringEquals": {
"route53:ChangeResourceRecordSetsNormalizedRecordNames": [
"_acme-challenge.example.com"
],
"route53:ChangeResourceRecordSetsRecordTypes": [
"TXT"
]
}
}
}
]
}Configuration for UKFast SafeDNS.
safednsHere is an example bash command using the UKFast SafeDNS provider:
SAFEDNS_AUTH_TOKEN=xxxxxx \
lego --email you@example.com --dns safedns -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
SAFEDNS_AUTH_TOKEN |
Authentication token |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
SAFEDNS_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
SAFEDNS_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
SAFEDNS_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 60) |
SAFEDNS_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 120) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for Sakura Cloud.
sakuracloudHere is an example bash command using the Sakura Cloud provider:
SAKURACLOUD_ACCESS_TOKEN=xxxxx \
SAKURACLOUD_ACCESS_TOKEN_SECRET=yyyyy \
lego --email you@example.com --dns sakuracloud -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
SAKURACLOUD_ACCESS_TOKEN |
Access token |
SAKURACLOUD_ACCESS_TOKEN_SECRET |
Access token secret |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
SAKURACLOUD_HTTP_TIMEOUT |
API request timeout in seconds (Default: 10) |
SAKURACLOUD_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
SAKURACLOUD_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 60) |
SAKURACLOUD_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 120) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for Scaleway.
scalewayHere is an example bash command using the Scaleway provider:
SCW_SECRET_KEY=xxxxxxx-xxxxx-xxxx-xxx-xxxxxx \
lego --email you@example.com --dns scaleway -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
SCW_PROJECT_ID |
Project to use (optional) |
SCW_SECRET_KEY |
Secret key |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
SCW_ACCESS_KEY |
Access key |
SCW_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
SCW_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 10) |
SCW_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 120) |
SCW_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 60) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for Selectel.
selectelHere is an example bash command using the Selectel provider:
SELECTEL_API_TOKEN=xxxxx \
lego --email you@example.com --dns selectel -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
SELECTEL_API_TOKEN |
API token |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
SELECTEL_BASE_URL |
API endpoint URL |
SELECTEL_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
SELECTEL_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
SELECTEL_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 120) |
SELECTEL_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 60) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for Selectel v2.
selectelv2Here is an example bash command using the Selectel v2 provider:
SELECTELV2_USERNAME=trex \
SELECTELV2_PASSWORD=xxxxx \
SELECTELV2_ACCOUNT_ID=1234567 \
SELECTELV2_PROJECT_ID=111a11111aaa11aa1a11aaa11111aa1a \
lego --email you@example.com --dns selectelv2 -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
SELECTELV2_ACCOUNT_ID |
Selectel account ID (INT) |
SELECTELV2_PASSWORD |
Openstack username’s password |
SELECTELV2_PROJECT_ID |
Cloud project ID (UUID) |
SELECTELV2_USERNAME |
Openstack username |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
SELECTELV2_AUTH_REGION |
Location for auth endpoint like ResellAPI or Keystone (default: ‘ru-1’) |
SELECTELV2_AUTH_URL |
Identity endpoint (defaul: ‘https://cloud.api.selcloud.ru/identity/v3/') |
SELECTELV2_BASE_URL |
API endpoint URL |
SELECTELV2_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
SELECTELV2_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 5) |
SELECTELV2_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 120) |
SELECTELV2_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 60) |
SELECTELV2_USER_DOMAIN_NAME |
To specify the domain name (account ID) where the user is located. (default: SELECTELV2_ACCOUNT_ID) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for SelfHost.(de|eu).
selfhostdeHere is an example bash command using the SelfHost.(de|eu) provider:
SELFHOSTDE_USERNAME=xxx \
SELFHOSTDE_PASSWORD=yyy \
SELFHOSTDE_RECORDS_MAPPING=my.example.com:123 \
lego --email you@example.com --dns selfhostde -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
SELFHOSTDE_PASSWORD |
Password |
SELFHOSTDE_RECORDS_MAPPING |
Record IDs mapping with domains (ex: example.com:123:456,example.org:789,foo.example.com:147) |
SELFHOSTDE_USERNAME |
Username |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
SELFHOSTDE_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
SELFHOSTDE_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 30) |
SELFHOSTDE_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 240) |
SELFHOSTDE_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 120) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
SelfHost.de doesn’t have an API to create or delete TXT records, there is only an “unofficial” and undocumented endpoint to update an existing TXT record.
So, before using lego to request a certificate for a given domain or wildcard (such as my.example.org or *.my.example.org),
you must create:
_acme-challenge.my.example.org if you are not using wildcard for this domain._acme-challenge.my.example.org if you are using wildcard for this domain.After that you must edit the TXT record(s) to get the ID(s).
You then must prepare the SELFHOSTDE_RECORDS_MAPPING environment variable with the following format:
<domain_A>:<record_id_A1>:<record_id_A2>,<domain_B>:<record_id_B1>:<record_id_B2>,<domain_C>:<record_id_C1>:<record_id_C2>where each group of domain + record ID(s) is separated with a comma (,),
and the domain and record ID(s) are separated with a colon (:).
For example, if you want to create or renew a certificate for my.example.org, *.my.example.org, and other.example.org,
you would need:
_acme-challenge.my.example.org_acme-challenge.other.example.orgThe resulting environment variable would then be: SELFHOSTDE_RECORDS_MAPPING=my.example.com:123:456,other.example.com:789
Configuration for Servercow.
servercowHere is an example bash command using the Servercow provider:
SERVERCOW_USERNAME=xxxxxxxx \
SERVERCOW_PASSWORD=xxxxxxxx \
lego --email you@example.com --dns servercow -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
SERVERCOW_PASSWORD |
API password |
SERVERCOW_USERNAME |
API username |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
SERVERCOW_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
SERVERCOW_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
SERVERCOW_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 60) |
SERVERCOW_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 120) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for Shellrent.
shellrentHere is an example bash command using the Shellrent provider:
SHELLRENT_USERNAME=xxxx \
SHELLRENT_TOKEN=yyyy \
lego --email you@example.com --dns shellrent -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
SHELLRENT_TOKEN |
Token |
SHELLRENT_USERNAME |
Username |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
SHELLRENT_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
SHELLRENT_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 10) |
SHELLRENT_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 300) |
SHELLRENT_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 3600) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for Simply.com.
simplyHere is an example bash command using the Simply.com provider:
SIMPLY_ACCOUNT_NAME=xxxxxx \
SIMPLY_API_KEY=yyyyyy \
lego --email you@example.com --dns simply -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
SIMPLY_ACCOUNT_NAME |
Account name |
SIMPLY_API_KEY |
API key |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
SIMPLY_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
SIMPLY_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 10) |
SIMPLY_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 300) |
SIMPLY_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 120) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for Sonic.
sonicHere is an example bash command using the Sonic provider:
SONIC_USER_ID=12345 \
SONIC_API_KEY=4d6fbf2f9ab0fa11697470918d37625851fc0c51 \
lego --email you@example.com --dns sonic -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
SONIC_API_KEY |
API Key |
SONIC_USER_ID |
User ID |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
SONIC_HTTP_TIMEOUT |
API request timeout in seconds (Default: 10) |
SONIC_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
SONIC_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 60) |
SONIC_SEQUENCE_INTERVAL |
Time between sequential requests in seconds (Default: 60) |
SONIC_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 120) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
The API keys must be generated by calling the dyndns/api_key endpoint.
Example:
$ curl -X POST -H "Content-Type: application/json" --data '{"username":"notarealuser","password":"notarealpassword","hostname":"example.com"}' https://public-api.sonic.net/dyndns/api_key
{"userid":"12345","apikey":"4d6fbf2f9ab0fa11697470918d37625851fc0c51","result":200,"message":"OK"}See https://public-api.sonic.net/dyndns/#requesting_an_api_key for additional details.
This userid and apikey combo allow modifications to any DNS entries connected to the managed domain (hostname).
Hostname should be the toplevel domain managed e.g. example.com not www.example.com.
Configuration for Spaceship.
spaceshipHere is an example bash command using the Spaceship provider:
SPACESHIP_API_KEY="xxxxxxxxxxxxxxxxxxxxx" \
SPACESHIP_API_SECRET="xxxxxxxxxxxxxxxxxxxxx" \
lego --email you@example.com --dns spaceship -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
SPACESHIP_API_KEY |
API key |
SPACESHIP_API_SECRET |
API secret |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
SPACESHIP_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
SPACESHIP_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
SPACESHIP_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 60) |
SPACESHIP_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 120) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for Stackpath.
stackpathHere is an example bash command using the Stackpath provider:
STACKPATH_CLIENT_ID=xxxxx \
STACKPATH_CLIENT_SECRET=yyyyy \
STACKPATH_STACK_ID=zzzzz \
lego --email you@example.com --dns stackpath -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
STACKPATH_CLIENT_ID |
Client ID |
STACKPATH_CLIENT_SECRET |
Client secret |
STACKPATH_STACK_ID |
Stack ID |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
STACKPATH_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
STACKPATH_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 60) |
STACKPATH_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 120) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for Technitium.
technitiumHere is an example bash command using the Technitium provider:
TECHNITIUM_SERVER_BASE_URL="https://localhost:5380" \
TECHNITIUM_API_TOKEN="xxxxxxxxxxxxxxxxxxxxx" \
lego --email you@example.com --dns technitium -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
TECHNITIUM_API_TOKEN |
API token |
TECHNITIUM_SERVER_BASE_URL |
Server base URL |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
TECHNITIUM_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
TECHNITIUM_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
TECHNITIUM_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 60) |
TECHNITIUM_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 120) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Technitium DNS Server supports Dynamic Updates (RFC2136) for primary zones, so you can also use the RFC2136 provider.
RFC2136 provider is much better compared to the HTTP API option from security perspective. Technitium recommends to use it in production over the HTTP API.
Configuration for Tencent Cloud DNS.
tencentcloudHere is an example bash command using the Tencent Cloud DNS provider:
TENCENTCLOUD_SECRET_ID=abcdefghijklmnopqrstuvwx \
TENCENTCLOUD_SECRET_KEY=your-secret-key \
lego --email you@example.com --dns tencentcloud -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
TENCENTCLOUD_SECRET_ID |
Access key ID |
TENCENTCLOUD_SECRET_KEY |
Access Key secret |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
TENCENTCLOUD_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
TENCENTCLOUD_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
TENCENTCLOUD_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 60) |
TENCENTCLOUD_REGION |
Region |
TENCENTCLOUD_SESSION_TOKEN |
Access Key token |
TENCENTCLOUD_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 600) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for Timeweb Cloud.
timewebcloudHere is an example bash command using the Timeweb Cloud provider:
TIMEWEBCLOUD_AUTH_TOKEN=xxxxxx \
lego --email you@example.com --dns timewebcloud -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
TIMEWEBCLOUD_AUTH_TOKEN |
Authentication token |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
TIMEWEBCLOUD_HTTP_TIMEOUT |
API request timeout in seconds (Default: 10) |
TIMEWEBCLOUD_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
TIMEWEBCLOUD_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 60) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for TransIP.
transipHere is an example bash command using the TransIP provider:
TRANSIP_ACCOUNT_NAME = "Account name" \
TRANSIP_PRIVATE_KEY_PATH = "transip.key" \
lego --email you@example.com --dns transip -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
TRANSIP_ACCOUNT_NAME |
Account name |
TRANSIP_PRIVATE_KEY_PATH |
Private key path |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
TRANSIP_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
TRANSIP_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 10) |
TRANSIP_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 600) |
TRANSIP_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 10) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for Ultradns.
ultradnsHere is an example bash command using the Ultradns provider:
ULTRADNS_USERNAME=username \
ULTRADNS_PASSWORD=password \
lego --email you@example.com --dns ultradns -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
ULTRADNS_PASSWORD |
API Password |
ULTRADNS_USERNAME |
API Username |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
ULTRADNS_ENDPOINT |
API endpoint URL, defaults to https://api.ultradns.com/ |
ULTRADNS_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 4) |
ULTRADNS_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 120) |
ULTRADNS_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 120) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for Variomedia.
variomediaHere is an example bash command using the Variomedia provider:
VARIOMEDIA_API_TOKEN=xxxx \
lego --email you@example.com --dns variomedia -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
VARIOMEDIA_API_TOKEN |
API token |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
VARIOMEDIA_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
VARIOMEDIA_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
VARIOMEDIA_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 60) |
VARIOMEDIA_SEQUENCE_INTERVAL |
Time between sequential requests in seconds (Default: 60) |
VARIOMEDIA_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 300) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for VegaDNS.
vegadnsPlease contribute by adding a CLI example.
| Environment Variable Name | Description |
|---|---|
SECRET_VEGADNS_KEY |
API key |
SECRET_VEGADNS_SECRET |
API secret |
VEGADNS_URL |
API endpoint URL |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
VEGADNS_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 60) |
VEGADNS_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 720) |
VEGADNS_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 10) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for Vercel.
vercelHere is an example bash command using the Vercel provider:
VERCEL_API_TOKEN=xxxxxx \
lego --email you@example.com --dns vercel -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
VERCEL_API_TOKEN |
Authentication token |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
VERCEL_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
VERCEL_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 5) |
VERCEL_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 60) |
VERCEL_TEAM_ID |
Team ID (ex: team_xxxxxxxxxxxxxxxxxxxxxxxx) |
VERCEL_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 60) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for Versio.[nl|eu|uk].
versioHere is an example bash command using the Versio.[nl|eu|uk] provider:
VERSIO_USERNAME=<your login> \
VERSIO_PASSWORD=<your password> \
lego --email you@example.com --dns versio -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
VERSIO_PASSWORD |
Basic authentication password |
VERSIO_USERNAME |
Basic authentication username |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
VERSIO_ENDPOINT |
The endpoint URL of the API Server |
VERSIO_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
VERSIO_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 5) |
VERSIO_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 60) |
VERSIO_SEQUENCE_INTERVAL |
Time between sequential requests in seconds (Default: 60) |
VERSIO_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 300) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
To test with the sandbox environment set VERSIO_ENDPOINT=https://www.versio.nl/testapi/v1/
Configuration for VinylDNS.
vinyldnsHere is an example bash command using the VinylDNS provider:
VINYLDNS_ACCESS_KEY=xxxxxx \
VINYLDNS_SECRET_KEY=yyyyy \
VINYLDNS_HOST=https://api.vinyldns.example.org:9443 \
lego --email you@example.com --dns vinyldns -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
VINYLDNS_ACCESS_KEY |
The VinylDNS API key |
VINYLDNS_HOST |
The VinylDNS API URL |
VINYLDNS_SECRET_KEY |
The VinylDNS API Secret key |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
VINYLDNS_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
VINYLDNS_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 4) |
VINYLDNS_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 120) |
VINYLDNS_QUOTE_VALUE |
Adds quotes around the TXT record value (Default: false) |
VINYLDNS_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 30) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
The vinyldns integration makes use of dotted hostnames to ease permission management. Users are required to have DELETE ACL level or zone admin permissions on the VinylDNS zone containing the target host.
Configuration for VK Cloud.
vkcloudHere is an example bash command using the VK Cloud provider:
VK_CLOUD_PROJECT_ID="<your_project_id>" \
VK_CLOUD_USERNAME="<your_email>" \
VK_CLOUD_PASSWORD="<your_password>" \
lego --email you@example.com --dns vkcloud -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
VK_CLOUD_PASSWORD |
Password for VK Cloud account |
VK_CLOUD_PROJECT_ID |
String ID of project in VK Cloud |
VK_CLOUD_USERNAME |
Email of VK Cloud account |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
VK_CLOUD_DNS_ENDPOINT |
URL of DNS API. Defaults to https://mcs.mail.ru/public-dns but can be changed for usage with private clouds |
VK_CLOUD_DOMAIN_NAME |
Openstack users domain name. Defaults to users but can be changed for usage with private clouds |
VK_CLOUD_IDENTITY_ENDPOINT |
URL of OpenStack Auth API, Defaults to https://infra.mail.ru:35357/v3/ but can be changed for usage with private clouds |
VK_CLOUD_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
VK_CLOUD_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 60) |
VK_CLOUD_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 60) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
You can find all required and additional information on “Project/Keys” page of your cloud.
| ENV Variable | Parameter from page |
|---|---|
| VK_CLOUD_PROJECT_ID | Project ID |
| VK_CLOUD_USERNAME | Username |
| VK_CLOUD_DOMAIN_NAME | User Domain Name |
| VK_CLOUD_IDENTITY_ENDPOINT | Identity endpoint |
Configuration for Volcano Engine/火山引擎.
volcengineHere is an example bash command using the Volcano Engine/火山引擎 provider:
VOLC_ACCESSKEY=xxx \
VOLC_SECRETKEY=yyy \
lego --email you@example.com --dns volcengine -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
VOLC_ACCESSKEY |
Access Key ID (AK) |
VOLC_SECRETKEY |
Secret Access Key (SK) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
VOLC_HOST |
API host |
VOLC_HTTP_TIMEOUT |
API request timeout in seconds (Default: 15) |
VOLC_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 10) |
VOLC_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 240) |
VOLC_REGION |
Region |
VOLC_SCHEME |
API scheme |
VOLC_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 600) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for Vscale.
vscaleHere is an example bash command using the Vscale provider:
VSCALE_API_TOKEN=xxxxx \
lego --email you@example.com --dns vscale -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
VSCALE_API_TOKEN |
API token |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
VSCALE_BASE_URL |
API endpoint URL |
VSCALE_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
VSCALE_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
VSCALE_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 120) |
VSCALE_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 60) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for Vultr.
vultrHere is an example bash command using the Vultr provider:
VULTR_API_KEY=xxxxx \
lego --email you@example.com --dns vultr -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
VULTR_API_KEY |
API key |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
VULTR_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
VULTR_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
VULTR_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 60) |
VULTR_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 120) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for webnames.ru.
webnamesHere is an example bash command using the webnames.ru provider:
WEBNAMESRU_API_KEY=xxxxxx \
lego --email you@example.com --dns webnamesru -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
WEBNAMESRU_API_KEY |
Domain API key |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
WEBNAMESRU_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
WEBNAMESRU_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
WEBNAMESRU_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 60) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
To obtain the key, you need to change the DNS server to *.nameself.com: Personal account / My domains and services / Select the required domain / DNS servers
The API key can be found: Personal account / My domains and services / Select the required domain / Zone management / acme.sh or certbot settings
Configuration for webnames.ca.
webnamescaHere is an example bash command using the webnames.ca provider:
WEBNAMESCA_API_USER="xxx" \
WEBNAMESCA_API_KEY="yyy" \
lego --email you@example.com --dns webnamesca -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
WEBNAMESCA_API_KEY |
API key |
WEBNAMESCA_API_USER |
API username |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
WEBNAMESCA_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
WEBNAMESCA_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
WEBNAMESCA_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 60) |
WEBNAMESCA_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 120) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for Websupport.
websupportHere is an example bash command using the Websupport provider:
WEBSUPPORT_API_KEY="xxxxxxxxxxxxxxxxxxxxx" \
WEBSUPPORT_SECRET="yyyyyyyyyyyyyyyyyyyyy" \
lego --email you@example.com --dns websupport -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
WEBSUPPORT_API_KEY |
API key |
WEBSUPPORT_SECRET |
API secret |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
WEBSUPPORT_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
WEBSUPPORT_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
WEBSUPPORT_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 60) |
WEBSUPPORT_SEQUENCE_INTERVAL |
Time between sequential requests in seconds (Default: 60) |
WEBSUPPORT_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 600) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for WEDOS.
wedosHere is an example bash command using the WEDOS provider:
WEDOS_USERNAME=xxxxxxxx \
WEDOS_WAPI_PASSWORD=xxxxxxxx \
lego --email you@example.com --dns wedos -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
WEDOS_USERNAME |
Username is the same as for the admin account |
WEDOS_WAPI_PASSWORD |
Password needs to be generated and IP allowed in the admin interface |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
WEDOS_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
WEDOS_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 10) |
WEDOS_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 600) |
WEDOS_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 300) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for West.cn/西部数码.
westcnHere is an example bash command using the West.cn/西部数码 provider:
WESTCN_USERNAME="xxx" \
WESTCN_PASSWORD="yyy" \
lego --email you@example.com --dns westcn -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
WESTCN_PASSWORD |
API password |
WESTCN_USERNAME |
Username |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
WESTCN_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
WESTCN_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 10) |
WESTCN_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 120) |
WESTCN_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 60) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for Yandex PDD.
yandexHere is an example bash command using the Yandex PDD provider:
YANDEX_PDD_TOKEN=<your PDD Token> \
lego --email you@example.com --dns yandex -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
YANDEX_PDD_TOKEN |
Basic authentication username |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
YANDEX_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
YANDEX_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
YANDEX_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 60) |
YANDEX_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 21600) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for Yandex 360.
yandex360Here is an example bash command using the Yandex 360 provider:
YANDEX360_OAUTH_TOKEN=<your OAuth Token> \
YANDEX360_ORG_ID=<your organization ID> \
lego --email you@example.com --dns yandex360 -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
YANDEX360_OAUTH_TOKEN |
The OAuth Token |
YANDEX360_ORG_ID |
The organization ID |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
YANDEX360_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
YANDEX360_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
YANDEX360_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 60) |
YANDEX360_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 21600) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for Yandex Cloud.
yandexcloudHere is an example bash command using the Yandex Cloud provider:
YANDEX_CLOUD_IAM_TOKEN=<base64_IAM_token> \
YANDEX_CLOUD_FOLDER_ID=<folder/project_id> \
lego --email you@example.com --dns yandexcloud -d '*.example.com' -d example.com run
# ---
YANDEX_CLOUD_IAM_TOKEN=$(echo '{ \
"id": "<string id>", \
"service_account_id": "<string id>", \
"created_at": "<datetime>", \
"key_algorithm": "RSA_2048", \
"public_key": "-----BEGIN PUBLIC KEY-----<rsa public key>-----END PUBLIC KEY-----", \
"private_key": "-----BEGIN PRIVATE KEY-----<rsa private key>-----END PRIVATE KEY-----" \
}' | base64) \
YANDEX_CLOUD_FOLDER_ID=<yandex cloud folder(project) id> \
lego --email you@example.com --dns yandexcloud -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
YANDEX_CLOUD_FOLDER_ID |
The string id of folder (aka project) in Yandex Cloud |
YANDEX_CLOUD_IAM_TOKEN |
The base64 encoded json which contains information about iam token of service account with dns.admin permissions |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
YANDEX_CLOUD_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
YANDEX_CLOUD_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 60) |
YANDEX_CLOUD_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 60) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
The simplest way to retrieve IAM access token is usage of yc-cli, follow docs to get it
yc iam key create --service-account-name my-robot --output key.json
cat key.json | base64Configuration for ZoneEdit.
zoneeditHere is an example bash command using the ZoneEdit provider:
ZONEEDIT_USER="xxxxxxxxxxxxxxxxxxxxx" \
ZONEEDIT_AUTH_TOKEN="xxxxxxxxxxxxxxxxxxxxx" \
lego --email you@example.com --dns zoneedit -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
ZONEEDIT_AUTH_TOKEN |
Authentication token |
ZONEEDIT_USER |
User ID |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
ZONEEDIT_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
ZONEEDIT_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
ZONEEDIT_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 60) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for Zone.ee.
zoneeeHere is an example bash command using the Zone.ee provider:
ZONEEE_API_USER=xxxxx \
ZONEEE_API_KEY=yyyyy \
lego --email you@example.com --dns zoneee -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
ZONEEE_API_KEY |
API key |
ZONEEE_API_USER |
API user |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
ZONEEE_ENDPOINT |
API endpoint URL |
ZONEEE_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
ZONEEE_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 5) |
ZONEEE_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 300) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
Configuration for Zonomi.
zonomiHere is an example bash command using the Zonomi provider:
ZONOMI_API_KEY=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx \
lego --email you@example.com --dns zonomi -d '*.example.com' -d example.com run| Environment Variable Name | Description |
|---|---|
ZONOMI_API_KEY |
User API key |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.
| Environment Variable Name | Description |
|---|---|
ZONOMI_HTTP_TIMEOUT |
API request timeout in seconds (Default: 30) |
ZONOMI_POLLING_INTERVAL |
Time between DNS propagation check in seconds (Default: 2) |
ZONOMI_PROPAGATION_TIMEOUT |
Maximum waiting time for DNS propagation in seconds (Default: 60) |
ZONOMI_TTL |
The TTL of the TXT record used for the DNS challenge in seconds (Default: 3600) |
The environment variable names can be suffixed by _FILE to reference a file instead of a value.
More information here.