Certbot Domain Chief plugin

This plugin enables DNS verification with Certbot when using Domain Chief.

Installation

If you installed certbot as a snap, then you have to install this plugin as a snap as well:

snap install certbot-dns-domainchief
snap set certbot trust-plugin-with-root=ok
snap connect certbot:plugin certbot-dns-domainchief

and can be upgraded using the refresh command:

snap refresh certbot-dns-domainchief

Alternatively this package can be installed with pip:

pip install certbot-dns-domainchief

and can be upgraded using the --upgrade flag

pip install --upgrade certbot-dns-domainchief

Credentials

You need to supply Certbot with a Domain Chief API key, this is an example of how a credentials file can look:

# Domain Chief API credentials used by Certbot
dns_domainchief_api_key = ctp_...

You can create a new API key here, ensure it has only the domainchief:acme:write scope and has the correct team selected.

The domainchief:acme:write scope only allows publishing and deleting TXT records on _acme-challenge names, it cannot read your domains or change any other DNS record. Keep in mind that the credentials file should still be readable only by the user running Certbot, because anyone holding the key can complete DNS-01 challenges and obtain certificates for the domains in your team.

Examples

Simple example for a single domain:

certbot certonly \
  --authenticator dns-domainchief \
  --dns-domainchief-credentials ~/.secrets/domainchief.ini \
  -d example.com

Simple example for wildcard domain:

certbot certonly \
  --authenticator dns-domainchief \
  --dns-domainchief-credentials ~/.secrets/domainchief.ini \
  -d example.com \
  -d *.example.com

Example changing the propagation delay, although you should not have to adjust it normally:

certbot certonly \
  --authenticator dns-domainchief \
  --dns-domainchief-credentials ~/.secrets/domainchief.ini \
  --dns-domainchief-propagation-seconds 120 \
  -d example.com

Security Vulnerabilities

If you discover a security vulnerability, please send an e-mail to us at hello@chief.app. All security vulnerabilities will be swiftly addressed.