Skip to content


Switch branches/tags

Name already in use

A tag already exists with the provided branch name. Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. Are you sure you want to create this branch?

Latest commit


Git stats


Failed to load latest commit information.
Latest commit message
Commit time
March 15, 2018 13:25


An example Certbot client hook for acme-dns.

This authentication hook automatically registers acme-dns accounts and prompts the user to manually add the CNAME records to their main DNS zone on initial run. Subsequent automatic renewals by Certbot cron job / systemd timer run in the background non-interactively.

Requires Certbot >= 0.10, Python requests library.


  1. Install Certbot using instructions at

  2. Make sure you have the python-requests library installed.

  3. Download the authentication hook script and make it executable:

$ curl -o /etc/letsencrypt/
$ chmod 0700 /etc/letsencrypt/
  1. Configure the variables in the beginning of the hook script file to point to your acme-dns instance. The only value that you must change is the ACMEDNS_URL, other values are optional.
### EDIT THESE: Configuration values ###

# URL to acme-dns instance
# Path for acme-dns credential storage
STORAGE_PATH = "/etc/letsencrypt/acmedns.json"
# Whitelist for address ranges to allow the updates from
# Example: ALLOW_FROM = ["", "::1/128"]
# Force re-registration. Overwrites the already existing acme-dns accounts.


On initial run:

$ certbot certonly --manual --manual-auth-hook /etc/letsencrypt/ \
   --preferred-challenges dns --debug-challenges                                 \
   -d -d \*

Note that the --debug-challenges is mandatory here to pause the Certbot execution before asking Let's Encrypt to validate the records and let you to manually add the CNAME records to your main DNS zone.

After adding the prompted CNAME records to your zone(s), wait for a bit for the changes to propagate over the main DNS zone name servers. This takes anywhere from few seconds up to a few minutes, depending on the DNS service provider software and configuration. Hit enter to continue as prompted to ask Let's Encrypt to validate the records.

After the initial run, Certbot is able to automatically renew your certificates using the stored per-domain acme-dns credentials.