FAQ
Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform

English

Türkçe

English

Türkçe

Appearance

Advanced

Which DNS providers are supported for the ACME DNS challenge? ​

Short answer

On the Certificates & PKI → ACME DNS Providers screen, there are ready-made provider types for Cloudflare, Amazon Route 53 and Azure DNS. Other providers are used with the Generic (acme.sh dnsapi) type: a provider is selected from the catalog of 171 providers, or the name of an acme.sh plugin that is not in the catalog is written. GoDaddy, OVH, DigitalOcean, Hetzner, Gandi LiveDNS, Infoblox, PowerDNS, nsupdate (RFC 2136) and acme-dns are among them. The defined profile is selected in the DNS Provider field when Challenge Type = DNS-01 is selected in the ACME.SH certificate.

Provider Types ​

Provider TypeRequired information
CloudflareAPI Token (required); Account ID and Zone ID optional
Amazon Route 53Access Key ID and Secret Access Key
Azure DNSSubscription ID, Tenant ID, Application (client) ID and Client Secret
Generic (acme.sh dnsapi)A provider from the DNS Provider (Catalog) list, or, with Not in the list / custom plugin selected, a plugin name starting with dns_; the Environment Variables that the provider requires (variable name and value)

In the Generic type, when a provider is selected from the catalog, the variable names documented by the plugin are added to the Environment Variables list automatically; only the values are filled in.

Examples from the Catalog ​

GoDaddy, OVH, DigitalOcean, Hetzner, Gandi LiveDNS, Oracle Cloud Infrastructure, IONOS, Linode, Vultr, Namecheap, Porkbun, Infoblox, PowerDNS, nsupdate (RFC 2136), acme-dns, cPanel, Plesk, DirectAdmin, Technitium, Akamai Edge DNS, NS1, UltraDNS, Alibaba Cloud, Tencent Cloud, Huawei Cloud and others (DNS Provider Catalog). An acme.sh plugin that is not in the catalog can also be used by writing its name; the plugin must be present on the device.

In TR7 ​

1
Adım 1 Open the provider form

On the Certificates & PKI → ACME DNS Providers screen, Add is clicked (how to add).

2
Adım 2 Define the provider

Provider Name is entered, Provider Type is selected, and the credentials that appear according to the type are filled in.

3
Adım 3 Save

Add is clicked; the profile is added to the list. The credentials are not tested during saving; whether they are correct becomes clear at the first certificate request.

The profile is selected in the DNS Provider field that appears when Challenge Type = DNS-01 is selected in the form of the ACME.SH certificate; with the add icon next to the field, a profile can also be created without leaving the certificate form (Can I get certificates automatically with Let's Encrypt / ACME?). The WEB-CLI equivalent is the lb acme-dns-provider command (provider types).

Common Misconceptions ​

  • "The credentials are tested when saving." There is no test operation in the form; incorrect information is seen at the first request in the console output in the ACME.SH tab of the certificate.
  • "The Cloudflare type works with the Global API Key." This type takes only an API Token; to work with the Global API Key, the Cloudflare plugin is selected in the Generic (acme.sh dnsapi) type and its variables are entered.
  • "If my provider is not in the list, I cannot use DNS-01." If the organization's own DNS server supports RFC 2136, it can be used with nsupdate, otherwise with the acme-dns plugin.
  • "For internal domain names (e.g. .local), a certificate is also obtained from a public CA." Public ACME authorities issue certificates only for domain names in public DNS; for internal domain names, the internal CA of TR7 is used (Can I use TR7 as an internal CA to issue, automatically renew and revoke certificates?).

How it is done in the documentation

Related questions