1cloud.ru

Configuration for 1cloud.ru.

• Code: onecloudru
• Since: v4.34.0

Here is an example bash command using the 1cloud.ru provider:

ONECLOUDRU_TOKEN="xxxxxxxxxxxxxxxxxxxxx" \
lego run --dns onecloudru -d '*.example.com' -d example.com

Credentials

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

Additional Configuration

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

More information

• API documentation

35.com/三五互联

Configuration for 35.com/三五互联.

• Code: com35
• Since: v4.31.0

Here is an example bash command using the 35.com/三五互联 provider:

COM35_USERNAME="xxx" \
COM35_PASSWORD="yyy" \
lego run --dns com35 -d '*.example.com' -d example.com

Credentials

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

Additional Configuration

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

More information

• API documentation

51DNS

Configuration for 51DNS.

• Code: dns51
• Since: v5.0.0

Here is an example bash command using the 51DNS provider:

DNS51_API_KEY="xxx" \
DNS51_API_SECRET="yyy" \
lego run --dns dns51 -d '*.example.com' -d example.com

Credentials

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

Additional Configuration

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

More information

• API documentation

Abion

Configuration for Abion.

• Code: abion
• Since: v5.0.0

Here is an example bash command using the Abion provider:

ABION_API_KEY="xxxxxxxxxxxx" \
lego run --dns abion -d '*.example.com' -d example.com

Credentials

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

Additional Configuration

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

More information

• API documentation

Active24

Configuration for Active24.

• Code: active24
• Since: v4.23.0

Here is an example bash command using the Active24 provider:

ACTIVE24_API_KEY="xxx" \
ACTIVE24_SECRET="yyy" \
lego run --dns active24 -d '*.example.com' -d example.com

Credentials

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

Additional Configuration

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

More information

• API documentation

Akamai EdgeDNS

Akamai edgedns supersedes FastDNS; implementing a DNS provider for solving the DNS-01 challenge using Akamai EdgeDNS

• Code: edgedns
• Since: v3.9.0

Here is an example bash command using the Akamai EdgeDNS provider:

AKAMAI_CLIENT_SECRET=abcdefghijklmnopqrstuvwxyz1234567890ABCDEFG= \
AKAMAI_CLIENT_TOKEN=akab-mnbvcxzlkjhgfdsapoiuytrewq1234567 \
AKAMAI_HOST=akab-aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.luna.akamaiapis.net \
AKAMAI_ACCESS_TOKEN=akab-1234567890qwerty-asdfghjklzxcvtnu \
lego run --dns edgedns -d '*.example.com' -d example.com

Credentials

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

Additional Configuration

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

Akamai’s credentials are automatically detected in the following locations and prioritized in the following order:

1. Section-specific environment variables (where {SECTION} is specified using AKAMAI_EDGERC_SECTION):

• AKAMAI_{SECTION}_HOST
• AKAMAI_{SECTION}_ACCESS_TOKEN
• AKAMAI_{SECTION}_CLIENT_TOKEN
• AKAMAI_{SECTION}_CLIENT_SECRET

2. If AKAMAI_EDGERC_SECTION is not defined or is set to default, environment variables:

• AKAMAI_HOST
• AKAMAI_ACCESS_TOKEN
• AKAMAI_CLIENT_TOKEN
• AKAMAI_CLIENT_SECRET

3. .edgerc file located at AKAMAI_EDGERC

• defaults to ~/.edgerc, sections can be specified using AKAMAI_EDGERC_SECTION

4. Default environment variables:

• AKAMAI_HOST
• AKAMAI_ACCESS_TOKEN
• AKAMAI_CLIENT_TOKEN
• AKAMAI_CLIENT_SECRET

See also:

• Setting up Akamai credentials
• .edgerc Format
• API Client Authentication
• Config from Env
• Manage many accounts

More information

• API documentation
• Go client

Alibaba Cloud DNS

Configuration for Alibaba Cloud DNS.

• Code: alidns
• Since: v1.1.0

Here is an example bash command using the Alibaba Cloud DNS provider:

# Setup using instance RAM role
ALICLOUD_RAM_ROLE=lego \
lego run --dns alidns -d '*.example.com' -d example.com

# Or, using credentials
ALICLOUD_ACCESS_KEY=abcdefghijklmnopqrstuvwx \
ALICLOUD_SECRET_KEY=your-secret-key \
ALICLOUD_SECURITY_TOKEN=your-sts-token \
lego run --dns alidns - -d '*.example.com' -d example.com

Credentials

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

Additional Configuration

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

More information

• API documentation
• Go client

AlibabaCloud ESA

Configuration for AlibabaCloud ESA.

• Code: aliesa
• Since: v4.29.0

Here is an example bash command using the AlibabaCloud ESA provider:

# Setup using instance RAM role
ALIESA_RAM_ROLE=lego \
lego run --dns aliesa -d '*.example.com' -d example.com

# Or, using credentials
ALIESA_ACCESS_KEY=abcdefghijklmnopqrstuvwx \
ALIESA_SECRET_KEY=your-secret-key \
ALIESA_SECURITY_TOKEN=your-sts-token \
lego run --dns aliesa - -d '*.example.com' -d example.com

Credentials

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

Additional Configuration

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

More information

• API documentation
• Go client

all-inkl

Configuration for all-inkl.

• Code: allinkl
• Since: v4.5.0

Here is an example bash command using the all-inkl provider:

ALL_INKL_LOGIN=xxxxxxxxxxxxxxxxxxxxxxxxxx \
ALL_INKL_PASSWORD=yyyyyyyyyyyyyyyyyyyyyyyyyy \
lego run --dns allinkl -d '*.example.com' -d example.com

Credentials

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

Additional Configuration

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

More information

• API documentation

Alwaysdata

Configuration for Alwaysdata.

• Code: alwaysdata
• Since: v4.31.0

Here is an example bash command using the Alwaysdata provider:

ALWAYSDATA_API_KEY="xxxxxxxxxxxxxxxxxxxxx" \
lego run --dns alwaysdata -d '*.example.com' -d example.com

Credentials

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

Additional Configuration

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

More information

• API documentation

Amazon Lightsail

Configuration for Amazon Lightsail.

• Code: lightsail
• Since: v0.5.0

Credentials

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

Additional Configuration

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

Description

AWS Credentials are automatically detected in the following locations and prioritized in the following order:

1. Environment variables: AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, [AWS_SESSION_TOKEN]
2. Shared credentials file (defaults to ~/.aws/credentials, profiles can be specified using AWS_PROFILE)
3. Amazon EC2 IAM role

AWS region is not required to set as the Lightsail DNS zone is in global (us-east-1) region.

Policy

The following AWS IAM policy document describes the minimum permissions required for lego to complete the DNS challenge.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "lightsail:DeleteDomainEntry",
        "lightsail:CreateDomainEntry"
      ],
      "Resource": "<Lightsail DNS zone ARN>"
    }
  ]
}

Replace the Resource value with your Lightsail DNS zone ARN. You can retrieve the ARN using aws cli by running aws lightsail get-domains --region us-east-1 (Lightsail web console does not show the ARN, unfortunately). It should be in the format of arn:aws:lightsail:global:<ACCOUNT ID>:Domain/<DOMAIN ID>. You also need to replace the region in the ARN to us-east-1 (instead of global).

Alternatively, you can also set the Resource to * (wildcard), which allow to access all domain, but this is not recommended.

More information

• Go client

Amazon Route 53

Configuration for Amazon Route 53.

• Code: route53
• Since: v0.3.0

Here is an example bash command using the Amazon Route 53 provider:

AWS_ACCESS_KEY_ID=your_key_id \
AWS_SECRET_ACCESS_KEY=your_secret_access_key \
AWS_REGION=aws-region \
AWS_HOSTED_ZONE_ID=your_hosted_zone_id \
lego run --dns route53 -d '*.example.com' -d example.com

Credentials

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

Additional Configuration

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

Description

AWS Credentials are automatically detected in the following locations and prioritized in the following order:

1. Environment variables: AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, [AWS_SESSION_TOKEN]
2. Shared credentials file (defaults to ~/.aws/credentials, profiles can be specified using AWS_PROFILE)
3. Amazon EC2 IAM role

The AWS Region is automatically detected in the following locations and prioritized in the following order:

1. Environment variables: AWS_REGION
2. Shared configuration file if AWS_SDK_LOAD_CONFIG is set (defaults to ~/.aws/config, profiles can be specified using AWS_PROFILE)

If AWS_HOSTED_ZONE_ID is not set, Lego tries to determine the correct public hosted zone via the FQDN.

See also:

• sessions
• Setting AWS Credentials
• Setting AWS Region

IAM Policy Examples

Broad privileges for testing purposes

The following IAM policy document grants access to the required APIs needed by lego to complete the DNS challenge. A word of caution: These permissions grant write access to any DNS record in any hosted zone, so it is recommended to narrow them down as much as possible if you are using this policy in production.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "route53:GetChange",
        "route53:ChangeResourceRecordSets",
        "route53:ListResourceRecordSets"
      ],
      "Resource": [
        "arn:aws:route53:::hostedzone/*",
        "arn:aws:route53:::change/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": "route53:ListHostedZonesByName",
      "Resource": "*"
    }
  ]
}

Least privilege policy for production purposes

The following AWS IAM policy document describes the least privilege permissions required for lego to complete the DNS challenge. Write access is limited to a specified hosted zone’s DNS TXT records with a key of _acme-challenge.example.com. Replace Z11111112222222333333 with your hosted zone ID and example.com with your domain name to use this policy.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "route53:GetChange",
      "Resource": "arn:aws:route53:::change/*"
    },
    {
      "Effect": "Allow",
      "Action": "route53:ListHostedZonesByName",
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "route53:ListResourceRecordSets"
      ],
      "Resource": [
        "arn:aws:route53:::hostedzone/Z11111112222222333333"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "route53:ChangeResourceRecordSets"
      ],
      "Resource": [
        "arn:aws:route53:::hostedzone/Z11111112222222333333"
      ],
      "Condition": {
        "ForAllValues:StringEquals": {
          "route53:ChangeResourceRecordSetsNormalizedRecordNames": [
            "_acme-challenge.example.com"
          ],
          "route53:ChangeResourceRecordSetsRecordTypes": [
            "TXT"
          ]
        }
      }
    }
  ]
}

More information

• API documentation
• Go client

Anexia CloudDNS

Configuration for Anexia CloudDNS.

• Code: anexia
• Since: v4.28.0

Here is an example bash command using the Anexia CloudDNS provider:

ANEXIA_TOKEN=xxx \
lego run --dns anexia -d '*.example.com' -d example.com

Credentials

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

Additional Configuration

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

Description

You need to create an API token in the Anexia Engine.

The token must have permissions to manage DNS zones and records.

More information

• API documentation

ANS SafeDNS

Configuration for ANS SafeDNS.

• Code: safedns
• Since: v4.6.0

Here is an example bash command using the ANS SafeDNS provider:

SAFEDNS_AUTH_TOKEN=xxxxxx \
lego run --dns safedns -d '*.example.com' -d example.com

Credentials

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

Additional Configuration

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

More information

• API documentation

ArtFiles

Configuration for ArtFiles.

• Code: artfiles
• Since: v4.32.0

Here is an example bash command using the ArtFiles provider:

ARTFILES_USERNAME="xxx" \
ARTFILES_PASSWORD="yyy" \
lego run --dns artfiles -d '*.example.com' -d example.com

Credentials

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

Additional Configuration

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

More information

• API documentation

ArvanCloud

Configuration for ArvanCloud.

• Code: arvancloud
• Since: v3.8.0

Here is an example bash command using the ArvanCloud provider:

ARVANCLOUD_API_KEY="Apikey xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" \
lego run --dns arvancloud -d '*.example.com' -d example.com

Credentials

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

Additional Configuration

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

More information

• API documentation

Aurora DNS

Configuration for Aurora DNS.

• Code: auroradns
• Since: v0.4.0

Here is an example bash command using the Aurora DNS provider:

AURORA_API_KEY=xxxxx \
AURORA_SECRET=yyyyyy \
lego run --dns auroradns -d '*.example.com' -d example.com

Credentials

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

Additional Configuration

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

More information

• API documentation
• Go client

Autodns

Configuration for Autodns.

• Code: autodns
• Since: v3.2.0

Here is an example bash command using the Autodns provider:

AUTODNS_API_USER=username \
AUTODNS_API_PASSWORD=supersecretpassword \
lego run --dns autodns -d '*.example.com' -d example.com

Credentials

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

Additional Configuration

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

More information

• API documentation

Axelname

Configuration for Axelname.

• Code: axelname
• Since: v4.23.0

Here is an example bash command using the Axelname provider:

AXELNAME_NICKNAME="yyy" \
AXELNAME_TOKEN="xxx" \
lego run --dns axelname -d '*.example.com' -d example.com

Credentials

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

Additional Configuration

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

More information

• API documentation

Azion

Configuration for Azion.

• Code: azion
• Since: v4.24.0

Here is an example bash command using the Azion provider:

AZION_PERSONAL_TOKEN=xxxxxxxxxxxxxxxxxxxxxxxxxx \
lego run --dns azion -d '*.example.com' -d example.com

Credentials

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

Additional Configuration

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

More information

• API documentation
• Go client

Azure DNS

Configuration for Azure DNS.

• Code: azuredns
• Since: v4.13.0

Here is an example bash command using the Azure DNS provider:

### Using client secret

AZURE_CLIENT_ID=<your service principal client ID> \
AZURE_TENANT_ID=<your service principal tenant ID> \
AZURE_CLIENT_SECRET=<your service principal client secret> \
lego run --dns azuredns -d '*.example.com' -d example.com

### Using client certificate

AZURE_CLIENT_ID=<your service principal client ID> \
AZURE_TENANT_ID=<your service principal tenant ID> \
AZURE_CLIENT_CERTIFICATE_PATH=<your service principal certificate path> \
lego run --dns azuredns -d '*.example.com' -d example.com

### Using Azure CLI

az login \
lego run --dns azuredns -d '*.example.com' -d example.com

### Using Managed Identity (Azure VM)

AZURE_TENANT_ID=<your service principal tenant ID> \
AZURE_RESOURCE_GROUP=<your target zone resource group name> \
lego run --dns azuredns -d '*.example.com' -d example.com

### Using Managed Identity (Azure Arc)

AZURE_TENANT_ID=<your service principal tenant ID> \
IMDS_ENDPOINT=http://localhost:40342 \
IDENTITY_ENDPOINT=http://localhost:40342/metadata/identity/oauth2/token \
lego run --dns azuredns -d '*.example.com' -d example.com

Credentials

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

Additional Configuration

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

Description

Several authentication methods can be used to authenticate against Azure DNS API.

Default Azure Credentials (default option)

Default Azure Credentials automatically detects in the following locations and prioritized in the following order:

1. Environment variables for client secret: AZURE_CLIENT_ID, AZURE_TENANT_ID, AZURE_CLIENT_SECRET
2. Environment variables for client certificate: AZURE_CLIENT_ID, AZURE_TENANT_ID, AZURE_CLIENT_CERTIFICATE_PATH
3. Workload identity for resources hosted in Azure environment (see below)
4. Shared credentials (defaults to ~/.azure folder), used by Azure CLI

Link:

• Azure Authentication

Environment variables

Service Discovery

Lego automatically finds all visible Azure (private) DNS zones using Azure ResourceGraph query. This can be limited by specifying environment variable AZURE_SUBSCRIPTION_ID and/or AZURE_RESOURCE_GROUP which limits the DNS zones to only a subscription or to one resourceGroup.

Additionally environment variable AZURE_SERVICEDISCOVERY_FILTER can be used to filter DNS zones with an addition Kusto filter eg:

resources
| where type =~ "microsoft.network/dnszones"
| ${AZURE_SERVICEDISCOVERY_FILTER}
| project subscriptionId, resourceGroup, name

Client secret

The Azure Credentials can be configured using the following environment variables:

• AZURE_CLIENT_ID = “Client ID”
• AZURE_CLIENT_SECRET = “Client secret”
• AZURE_TENANT_ID = “Tenant ID”

This authentication method can be specifically used by setting the AZURE_AUTH_METHOD environment variable to env.

Client certificate

The Azure Credentials can be configured using the following environment variables:

• AZURE_CLIENT_ID = “Client ID”
• AZURE_CLIENT_CERTIFICATE_PATH = “Client certificate path”
• AZURE_TENANT_ID = “Tenant ID”

This authentication method can be specifically used by setting the AZURE_AUTH_METHOD environment variable to env.

Workload identity

Workload identity allows workloads running Azure Kubernetes Services (AKS) clusters to authenticate as an Azure AD application identity using federated credentials.

This must be configured in kubernetes workload deployment in one hand and on the Azure AD application registration in the other hand.

Here is a summary of the steps to follow to use it :

• create a ServiceAccount resource, add following annotations to reference the targeted Azure AD application registration : azure.workload.identity/client-id and azure.workload.identity/tenant-id.
• on the Deployment resource you must reference the previous ServiceAccount and add the following label : azure.workload.identity/use: "true".
• create a federated credentials of type Kubernetes accessing Azure resources, add the cluster issuer URL and add the namespace and name of your kubernetes service account.

Link :

• Azure AD Workload identity

This authentication method can be specifically used by setting the AZURE_AUTH_METHOD environment variable to wli.

Azure Managed Identity

Azure Managed Identity (with Azure workload)

The Azure Managed Identity service allows linking Azure AD identities to Azure resources, without needing to manually manage client IDs and secrets.

Workloads with a Managed Identity can manage their own certificates, with permissions on specific domain names set using IAM assignments. For this to work, the Managed Identity requires the Reader role on the target DNS Zone, and the DNS Zone Contributor on the relevant _acme-challenge TXT records.

For example, to allow a Managed Identity to create a certificate for “fw01.lab.example.com”, using Azure CLI:

export AZURE_SUBSCRIPTION_ID="00000000-0000-0000-0000-000000000000"
export AZURE_RESOURCE_GROUP="rg1"
export SERVICE_PRINCIPAL_ID="00000000-0000-0000-0000-000000000000"

export AZURE_DNS_ZONE="lab.example.com"
export AZ_HOSTNAME="fw01"
export AZ_RECORD_SET="_acme-challenge.${AZ_HOSTNAME}"

az role assignment create \
--assignee "${SERVICE_PRINCIPAL_ID}" \
--role "Reader" \
--scope "/subscriptions/${AZURE_SUBSCRIPTION_ID}/resourceGroups/${AZURE_RESOURCE_GROUP}/providers/Microsoft.Network/dnszones/${AZURE_DNS_ZONE}"

az role assignment create \
--assignee "${SERVICE_PRINCIPAL_ID}" \
--role "DNS Zone Contributor" \
--scope "/subscriptions/${AZURE_SUBSCRIPTION_ID}/resourceGroups/${AZURE_RESOURCE_GROUP}/providers/Microsoft.Network/dnszones/${AZURE_DNS_ZONE}/TXT/${AZ_RECORD_SET}"

A timeout wrapper is configured for this authentication method. The duration can be configured by setting the AZURE_AUTH_MSI_TIMEOUT. The default timeout is 2 seconds. This authentication method can be specifically used by setting the AZURE_AUTH_METHOD environment variable to msi.

Azure Managed Identity (with Azure Arc)

The Azure Arc agent provides the ability to use a Managed Identity on resources hosted outside of Azure (such as on-prem virtual machines, or VMs in another cloud provider).

While the upstream azidentity SDK will try to automatically identify and use the Azure Arc metadata service, if you get azuredns: DefaultAzureCredential: failed to acquire a token. error messages, you may need to set the environment variables:

• IMDS_ENDPOINT=http://localhost:40342
• IDENTITY_ENDPOINT=http://localhost:40342/metadata/identity/oauth2/token

A timeout wrapper is configured for this authentication method. The duration can be configured by setting the AZURE_AUTH_MSI_TIMEOUT. The default timeout is 2 seconds. This authentication method can be specifically used by setting the AZURE_AUTH_METHOD environment variable to msi.

Azure CLI

The Azure CLI is a command-line tool provided by Microsoft to interact with Azure resources. It provides an easy way to authenticate by simply running az login command. The generated token will be cached by default in the ~/.azure folder.

This authentication method can be specifically used by setting the AZURE_AUTH_METHOD environment variable to cli.

Open ID Connect

Open ID Connect is a mechanism that establish a trust relationship between a running environment and the Azure AD identity provider. It can be enabled by setting the AZURE_AUTH_METHOD environment variable to oidc.

Azure DevOps Pipelines

It can be enabled by setting the AZURE_AUTH_METHOD environment variable to pipeline.

More information

• API documentation
• Go client

Baidu Cloud

Configuration for Baidu Cloud.

• Code: baiducloud
• Since: v4.23.0

Here is an example bash command using the Baidu Cloud provider:

BAIDUCLOUD_ACCESS_KEY_ID="xxx" \
BAIDUCLOUD_SECRET_ACCESS_KEY="yyy" \
lego run --dns baiducloud -d '*.example.com' -d example.com

Credentials

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

Additional Configuration

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

More information

• API documentation
• Go client

Beget.com

Configuration for Beget.com.

• Code: beget
• Since: v4.27.0

Here is an example bash command using the Beget.com provider:

BEGET_USERNAME=xxxxxx \
BEGET_PASSWORD=yyyyyy \
lego run --dns beget -d '*.example.com' -d example.com

Credentials

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

Additional Configuration

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

More information

• API documentation

Binary Lane

Configuration for Binary Lane.

• Code: binarylane
• Since: v4.26.0

Here is an example bash command using the Binary Lane provider:

BINARYLANE_API_TOKEN="xxxxxxxxxxxxxxxxxxxxx" \
lego run --dns binarylane -d '*.example.com' -d example.com

Credentials

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

Additional Configuration

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

More information

• API documentation

Bindman

Configuration for Bindman.

• Code: bindman
• Since: v2.6.0

Here is an example bash command using the Bindman provider:

BINDMAN_MANAGER_ADDRESS=<your bindman manager address> \
lego run --dns bindman -d '*.example.com' -d example.com

Credentials

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

Additional Configuration

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

More information

• API documentation
• Go client

Bluecat

Configuration for Bluecat.

• Code: bluecat
• Since: v0.5.0

Here is an example bash command using the Bluecat provider:

BLUECAT_PASSWORD=mypassword \
BLUECAT_DNS_VIEW=myview \
BLUECAT_USER_NAME=myusername \
BLUECAT_CONFIG_NAME=myconfig \
BLUECAT_SERVER_URL=https://bam.example.com \
BLUECAT_TTL=30 \
lego run --dns bluecat -d '*.example.com' -d example.com

Credentials

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

Additional Configuration

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

More information

• API documentation

Bluecat v2

Configuration for Bluecat v2.

• Code: bluecatv2
• Since: v4.32.0

Here is an example bash command using the Bluecat v2 provider:

BLUECATV2_SERVER_URL="https://example.com" \
BLUECATV2_USERNAME="xxx" \
BLUECATV2_PASSWORD="yyy" \
BLUECATV2_CONFIG_NAME="myConfiguration" \
BLUECATV2_VIEW_NAME="myView" \
lego run --dns bluecatv2 -d '*.example.com' -d example.com

Credentials

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

Additional Configuration

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

More information

• API documentation

BookMyName

Configuration for BookMyName.

• Code: bookmyname
• Since: v4.23.0

Here is an example bash command using the BookMyName provider:

BOOKMYNAME_USERNAME="xxx" \
BOOKMYNAME_PASSWORD="yyy" \
lego run --dns bookmyname -d '*.example.com' -d example.com

Credentials

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

Additional Configuration

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

More information

• API documentation

Bunny

Configuration for Bunny.

• Code: bunny
• Since: v4.11.0

Here is an example bash command using the Bunny provider:

BUNNY_API_KEY=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxxxxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx \
lego run --dns bunny -d '*.example.com' -d example.com

Credentials

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

Additional Configuration

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

More information

• API documentation

Checkdomain

Configuration for Checkdomain.

• Code: checkdomain
• Since: v3.3.0

Here is an example bash command using the Checkdomain provider:

CHECKDOMAIN_TOKEN=yoursecrettoken \
lego run --dns checkdomain -d '*.example.com' -d example.com

Credentials

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

Additional Configuration

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

More information

• API documentation

Civo

Configuration for Civo.

• Code: civo
• Since: v4.9.0

Here is an example bash command using the Civo provider:

CIVO_TOKEN=xxxxxx \
lego run --dns civo -d '*.example.com' -d example.com

Credentials

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

Additional Configuration

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

More information

• API documentation

Cloud.ru

Configuration for Cloud.ru.

• Code: cloudru
• Since: v4.14.0

Here is an example bash command using the Cloud.ru provider:

CLOUDRU_SERVICE_INSTANCE_ID=ppp \
CLOUDRU_KEY_ID=xxx \
CLOUDRU_SECRET=yyy \
lego run --dns cloudru -d '*.example.com' -d example.com

Credentials

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

Additional Configuration

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

More information

• API documentation

CloudDNS

Configuration for CloudDNS.

• Code: clouddns
• Since: v3.6.0

Here is an example bash command using the CloudDNS provider:

CLOUDDNS_CLIENT_ID=bLsdFAks23429841238feb177a572aX \
CLOUDDNS_EMAIL=you@example.com \
CLOUDDNS_PASSWORD=b9841238feb177a84330f \
lego run --dns clouddns -d '*.example.com' -d example.com

Credentials

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

Additional Configuration

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

More information

• API documentation

Cloudflare

Configuration for Cloudflare.

• Code: cloudflare
• Since: v0.3.0

Here is an example bash command using the Cloudflare provider:

CLOUDFLARE_EMAIL=you@example.com \
CLOUDFLARE_API_KEY=b9841238feb177a84330febba8a83208921177bffe733 \
lego run --dns cloudflare -d '*.example.com' -d example.com

# or

CLOUDFLARE_DNS_API_TOKEN=1234567890abcdefghijklmnopqrstuvwxyz \
lego run --dns cloudflare -d '*.example.com' -d example.com

Credentials

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

Additional Configuration

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

Description

You may use CF_API_EMAIL and CF_API_KEY to authenticate, or CF_DNS_API_TOKEN, or CF_DNS_API_TOKEN and CF_ZONE_API_TOKEN.

API keys

If using API keys (CF_API_EMAIL and CF_API_KEY), the Global API Key needs to be used, not the Origin CA Key.

Please be aware, that this in principle allows Lego to read and change everything related to this account.

API tokens

With API tokens (CF_DNS_API_TOKEN, and optionally CF_ZONE_API_TOKEN), very specific access can be granted to your resources at Cloudflare. See this Cloudflare announcement for details.

The main resources Lego cares for are the DNS entries for your Zones. It also needs to resolve a domain name to an internal Zone ID in order to manipulate DNS entries.

Hence, you should create an API token with the following permissions:

• Zone / Zone / Read
• Zone / DNS / Edit

You also need to scope the access to all your domains for this to work. Then pass the API token as CF_DNS_API_TOKEN to Lego.

Alternatively, if you prefer a more strict set of privileges, you can split the access tokens:

• Create one with Zone / Zone / Read permissions and scope it to all your zones or just the individual zone you need to edit. This is needed to resolve domain names to Zone IDs and can be shared among multiple Lego installations. Pass this API token as CF_ZONE_API_TOKEN to Lego.
• Create another API token with Zone / DNS / Edit permissions and set the scope to the domains you want to manage with a single Lego installation. Pass this token as CF_DNS_API_TOKEN to Lego.
• Repeat the previous step for each host you want to run Lego on.
• It is possible to use the same api token for both variables if it is given Zone:Read and DNS:Edit permission for the zone.

This “paranoid” setup is mainly interesting for users who manage many zones/domains with a single Cloudflare account. It follows the principle of least privilege and limits the possible damage, should one of the hosts become compromised.

More information

• API documentation
• Go client

ClouDNS

Configuration for ClouDNS.

• Code: cloudns
• Since: v2.3.0

Here is an example bash command using the ClouDNS provider:

CLOUDNS_AUTH_ID=xxxx \
CLOUDNS_AUTH_PASSWORD=yyyy \
lego run --dns cloudns -d '*.example.com' -d example.com

Credentials

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

Additional Configuration

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

More information

• API documentation

ConoHa v2

Configuration for ConoHa v2.

• Code: conoha
• Since: v1.2.0

Here is an example bash command using the ConoHa v2 provider:

CONOHA_TENANT_ID=487727e3921d44e3bfe7ebb337bf085e \
CONOHA_API_USERNAME=xxxx \
CONOHA_API_PASSWORD=yyyy \
lego run --dns conoha -d '*.example.com' -d example.com

Credentials

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

Additional Configuration

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

More information

• API documentation

ConoHa v3

Configuration for ConoHa v3.

• Code: conohav3
• Since: v4.24.0

Here is an example bash command using the ConoHa v3 provider:

CONOHAV3_TENANT_ID=487727e3921d44e3bfe7ebb337bf085e \
CONOHAV3_API_USER_ID=xxxx \
CONOHAV3_API_PASSWORD=yyyy \
lego run --dns conohav3 -d '*.example.com' -d example.com

Credentials

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

Additional Configuration

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

More information

• API documentation

Constellix

Configuration for Constellix.

• Code: constellix
• Since: v3.4.0

Here is an example bash command using the Constellix provider:

CONSTELLIX_API_KEY=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx \
CONSTELLIX_SECRET_KEY=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx \
lego run --dns constellix -d '*.example.com' -d example.com

Credentials

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

Additional Configuration

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

More information

• API documentation

Core-Networks

Configuration for Core-Networks.

• Code: corenetworks
• Since: v4.20.0

Here is an example bash command using the Core-Networks provider:

CORENETWORKS_LOGIN="xxxx" \
CORENETWORKS_PASSWORD="yyyy" \
lego run --dns corenetworks -d '*.example.com' -d example.com

Credentials

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

Additional Configuration

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

More information

• API documentation

CPanel/WHM

Configuration for CPanel/WHM.

• Code: cpanel
• Since: v4.16.0

Here is an example bash command using the CPanel/WHM provider:

### CPANEL (default)

CPANEL_USERNAME="yyyy" \
CPANEL_TOKEN="xxxx" \
CPANEL_BASE_URL="https://example.com:2083" \
lego run --dns cpanel -d '*.example.com' -d example.com

## WHM

CPANEL_MODE=whm \
CPANEL_USERNAME="yyyy" \
CPANEL_TOKEN="xxxx" \
CPANEL_BASE_URL="https://example.com:2087" \
lego run --dns cpanel -d '*.example.com' -d example.com

Credentials

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

Additional Configuration

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

More information

Curanet

Configuration for Curanet.

• Code: curanet
• Since: v5.0.0

Here is an example bash command using the Curanet provider:

CURANET_API_KEY="xxxxxxxxxxxxxxxxxxxxx" \
lego run --dns curanet -d '*.example.com' -d example.com

Credentials

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

Additional Configuration

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

More information

• API documentation

Czechia

Configuration for Czechia.

• Code: czechia
• Since: v4.33.0

Here is an example bash command using the Czechia provider:

CZECHIA_TOKEN="xxxxxxxxxxxxxxxxxxxxx" \
lego run --dns czechia -d '*.example.com' -d example.com

Credentials

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

Additional Configuration

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

More information

• API documentation

DanDomain

Configuration for DanDomain.

• Code: dandomain
• Since: v5.0.0

Here is an example bash command using the DanDomain provider:

DANDOMAIN_API_KEY="xxxxxxxxxxxxxxxxxxxxx" \
lego run --dns dandomain -d '*.example.com' -d example.com

Credentials

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

Additional Configuration

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

More information

• API documentation

DDnss (DynDNS Service)

Configuration for DDnss (DynDNS Service).

• Code: ddnss
• Since: v4.32.0

Here is an example bash command using the DDnss (DynDNS Service) provider:

DDNSS_KEY="xxxxxxxxxxxxxxxxxxxxx" \
lego run --dns ddnss -d '*.example.com' -d example.com

Credentials

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

Additional Configuration

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

More information

• API documentation

Derak Cloud

Configuration for Derak Cloud.

• Code: derak
• Since: v4.12.0

Here is an example bash command using the Derak Cloud provider:

DERAK_API_KEY="xxxxxxxxxxxxxxxxxxxxx" \
lego run --dns derak -d '*.example.com' -d example.com

Credentials

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

Additional Configuration

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

deSEC.io

Configuration for deSEC.io.

• Code: desec
• Since: v3.7.0

Here is an example bash command using the deSEC.io provider:

DESEC_TOKEN=x-xxxxxxxxxxxxxxxxxxxxxxxxxx \
lego run --dns desec -d '*.example.com' -d example.com

Credentials

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

Additional Configuration

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

More information

• API documentation

Designate DNSaaS for Openstack

Configuration for Designate DNSaaS for Openstack.

• Code: designate
• Since: v2.2.0

Here is an example bash command using the Designate DNSaaS for Openstack provider:

# With a `clouds.yaml`
OS_CLOUD=my_openstack \
lego run --dns designate -d '*.example.com' -d example.com

# or

OS_AUTH_URL=https://openstack.example.org \
OS_REGION_NAME=RegionOne \
OS_PROJECT_ID=23d4522a987d4ab529f722a007c27846
OS_USERNAME=myuser \
OS_PASSWORD=passw0rd \
lego run --dns designate -d '*.example.com' -d example.com

# or

OS_AUTH_URL=https://openstack.example.org \
OS_REGION_NAME=RegionOne \
OS_AUTH_TYPE=v3applicationcredential \
OS_APPLICATION_CREDENTIAL_ID=imn74uq0or7dyzz20dwo1ytls4me8dry \
OS_APPLICATION_CREDENTIAL_SECRET=68FuSPSdQqkFQYH5X1OoriEIJOwyLtQ8QSqXZOc9XxFK1A9tzZT6He2PfPw0OMja \
lego run --dns designate -d '*.example.com' -d example.com

Credentials

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

Additional Configuration

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

Description

There are three main ways of authenticating with Designate:

1. The first one is by using the OS_CLOUD environment variable and a clouds.yaml file.
2. The second one is using your username and password, via the OS_USERNAME, OS_PASSWORD and OS_PROJECT_NAME environment variables.
3. The third one is by using an application credential, via the OS_APPLICATION_CREDENTIAL_* and OS_USER_ID environment variables.

For the username/password and application methods, the OS_AUTH_URL and OS_REGION_NAME environment variables are required.

For more information, you can read about the different methods of authentication with OpenStack in the Keystone’s documentation and the gophercloud documentation:

• Keystone username/password
• Keystone application credentials

Public cloud providers with support for Designate:

• Fuga Cloud

More information

• API documentation
• Go client

Digital Ocean

Configuration for Digital Ocean.

• Code: digitalocean
• Since: v0.3.0

Here is an example bash command using the Digital Ocean provider:

DO_AUTH_TOKEN=xxxxxx \
lego run --dns digitalocean -d '*.example.com' -d example.com

Credentials

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

Additional Configuration

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

More information

• API documentation

Dinahosting

Configuration for Dinahosting.

• Code: dinahosting
• Since: v5.0.0

Here is an example bash command using the Dinahosting provider:

DINAHOSTING_USERNAME="xxx" \
DINAHOSTING_PASSWORD="yyy" \
lego run --dns dinahosting -d '*.example.com' -d example.com

Credentials

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

Additional Configuration

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

More information

• API documentation

DirectAdmin

Configuration for DirectAdmin.

• Code: directadmin
• Since: v4.18.0

Here is an example bash command using the DirectAdmin provider:

DIRECTADMIN_API_URL="http://example.com:2222" \
DIRECTADMIN_USERNAME=xxxx \
DIRECTADMIN_PASSWORD=yyy \
lego run --dns directadmin -d '*.example.com' -d example.com

Credentials

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

Additional Configuration

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

More information

• API documentation

DNS Made Easy

Configuration for DNS Made Easy.

• Code: dnsmadeeasy
• Since: v0.4.0

Here is an example bash command using the DNS Made Easy provider:

DNSMADEEASY_API_KEY=xxxxxx \
DNSMADEEASY_API_SECRET=yyyyy \
lego run --dns dnsmadeeasy -d '*.example.com' -d example.com

Credentials

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

Additional Configuration

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

More information

• API documentation

DNS Update (RFC2136)

Configuration for DNS Update (RFC2136).

• Code: dnsupdate
• Since: v0.3.0

Here is an example bash command using the DNS Update (RFC2136) provider:

DNSUPDATE_NAMESERVER=127.0.0.1 \
DNSUPDATE_TSIG_KEY=example.com \
DNSUPDATE_TSIG_ALGORITHM=hmac-sha256. \
DNSUPDATE_TSIG_SECRET=YWJjZGVmZGdoaWprbG1ub3BxcnN0dXZ3eHl6MTIzNDU= \
lego run --dns dnsupdate -d '*.example.com' -d example.com

## ---

keyname=example.com; keyfile=example.com.key; tsig-keygen $keyname > $keyfile

DNSUPDATE_NAMESERVER=127.0.0.1 \
DNSUPDATE_TSIG_FILE="$keyfile" \
lego run --dns dnsupdate -d '*.example.com' -d example.com

## --- TSIG-GSS / RFC3645 / Kerberos

DNSUPDATE_NAMESERVER=127.0.0.1 \
DNSUPDATE_TSIG_ALGORITHM=gss-tsig. \
DNSUPDATE_TSIG_GSS_REALM=realm.example
DNSUPDATE_TSIG_GSS_USERNAME='xxx'
DNSUPDATE_TSIG_GSS_PASSWORD='yyy'
lego run --dns dnsupdate -d '*.example.com' -d example.com

## --- TSIG-GSS / RFC3645 / Kerberos (keytab)

DNSUPDATE_NAMESERVER="127.0.0.1" \
DNSUPDATE_TSIG_ALGORITHM=gss-tsig. \
DNSUPDATE_TSIG_GSS_REALM=realm.example \
DNSUPDATE_TSIG_GSS_USERNAME='xxx' \
DNSUPDATE_TSIG_GSS_KEYTAB_FILE="/path/to/my.keytab" \
lego run --dns dnsupdate -d '*.example.com' -d example.com

Credentials

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

Additional Configuration

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

TSIG-GSS / RFC3645 / Kerberos

To ease the usage of DNS Update in some environments, lego provides some aliases for RFC3645.

• DNSUPDATE_RFC3645_REALM is an alias on DNSUPDATE_TSIG_GSS_REALM
• DNSUPDATE_RFC3645_USERNAME is an alias on DNSUPDATE_TSIG_GSS_USERNAME
• DNSUPDATE_RFC3645_PASSWORD is an alias on DNSUPDATE_TSIG_GSS_PASSWORD
• DNSUPDATE_RFC3645_KEYTAB_FILE is an alias on DNSUPDATE_TSIG_GSS_KEYTAB_FILE

Examples

# Using password

DNSUPDATE_NAMESERVER=127.0.0.1 \
DNSUPDATE_TSIG_ALGORITHM=gss-tsig. \
DNSUPDATE_RFC3645_REALM=realm.example
DNSUPDATE_RFC3645_USERNAME='xxx'
DNSUPDATE_RFC3645_PASSWORD='yyy'
lego run --dns dnsupdate -d '*.example.com' -d example.com

# Using a keytab file.

DNSUPDATE_NAMESERVER="127.0.0.1" \
DNSUPDATE_TSIG_ALGORITHM=gss-tsig. \
DNSUPDATE_RFC3645_REALM=realm.example \
DNSUPDATE_RFC3645_USERNAME='xxx' \
DNSUPDATE_RFC3645_KEYTAB_FILE="/path/to/my.keytab" \
lego run --dns dnsupdate -d '*.example.com' -d example.com

More information

• API documentation

dns.la

Configuration for dns.la.

• Code: dnsla
• Since: v5.0.0

Here is an example bash command using the dns.la provider:

DNSLA_API_SECRET="xxx" \
DNSLA_API_SECRET="yyy" \
lego run --dns dnsla -d '*.example.com' -d example.com

Credentials

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

Additional Configuration

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

More information

• API documentation

DNS.services

Configuration for DNS.services.

• Code: dnsservices
• Since: v5.0.0

Here is an example bash command using the DNS.services provider:

DNSSERVICES_USERNAME="xxxxxxxxxxxxxxxxxxxxx" \
DNSSERVICES_PASSWORD="xxxxxxxxxxxxxxxxxxxxx" \
lego run --dns dnsservices -d '*.example.com' -d example.com

Credentials

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

Additional Configuration

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

More information

• API documentation

DNScale

Configuration for DNScale.

• Code: dnscale
• Since: v5.0.0

Here is an example bash command using the DNScale provider:

DNSCALE_API_TOKEN="xxx" \
lego run --dns dnscale -d '*.example.com' -d example.com

Credentials

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

Additional Configuration

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

More information

• API documentation

DNSExit

Configuration for DNSExit.

• Code: dnsexit
• Since: v4.32.0

Here is an example bash command using the DNSExit provider:

DNSEXIT_API_KEY="xxxxxxxxxxxxxxxxxxxxx" \
lego run --dns dnsexit -d '*.example.com' -d example.com

Credentials

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

Additional Configuration

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

More information

• API documentation

dnsHome.de

Configuration for dnsHome.de.

• Code: dnshomede
• Since: v4.10.0

Here is an example bash command using the dnsHome.de provider:

DNSHOMEDE_CREDENTIALS=example.org:password \
lego run --dns dnshomede -d '*.example.com' -d example.com

DNSHOMEDE_CREDENTIALS=my.example.org:password1,demo.example.org:password2 \
lego run --dns dnshomede -d my.example.org -d demo.example.org

Credentials

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

Additional Configuration

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

DNSimple

Configuration for DNSimple.

• Code: dnsimple
• Since: v0.3.0

Here is an example bash command using the DNSimple provider:

DNSIMPLE_OAUTH_TOKEN=1234567890abcdefghijklmnopqrstuvwxyz \
lego run --dns dnsimple -d '*.example.com' -d example.com

Credentials

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

Additional Configuration

The environment variable names can be suffixed by _FILE to reference a file instead of a value. More information here.

Description

DNSIMPLE_BASE_URL is optional and must be set to production (https://api.dnsimple.com). if DNSIMPLE_BASE_URL is not defined or empty, the production URL is used by default.

While you can manage DNS records in the DNSimple Sandbox environment, DNS records will not resolve, and you will not be able to satisfy the ACME DNS challenge.

To authenticate you need to provide a valid API token. HTTP Basic Authentication is intentionally not supported.

API tokens

You can generate a new API token from your account page. Only Account API tokens are supported, if you try to use a User API token you will receive an error message.

More information