certbot-dns-kas 1.0.0

All-Inkl KAS DNS Authenticator plugin for Certbot

certbot-dns-kas

A Certbot DNS authenticator plugin for All-Inkl (KAS). It solves dns-01 ACME challenges by creating and removing the required _acme-challenge TXT records through the All-Inkl KAS API — so you can issue and auto-renew certificates (including wildcards) for domains hosted at All-Inkl without any manual DNS edits.

It talks to the KAS SOAP API directly using only requests; there is no dependency on kasserver, zeep or lxml.

Highlights

• Wildcard + apex in one certificate — example.com and *.example.com together work correctly (two TXT records with the same name coexist).
• Correct zone detection for every TLD depth — resolves the hosted zone from your account's domain list, so multi-label public suffixes like .or.at, .co.uk or .com.au work out of the box.
• Safe cleanup — removes exactly the challenge record it created, matched by name, type and content; no leftover _acme-challenge records.
• Lightweight & self-contained — pure requests + the Python standard library. No SOAP framework, no runtime schema downloads.

Requirements

• Python ≥ 3.9
• Certbot ≥ 2.0
• An All-Inkl account with KAS API access enabled, and a KAS login whose API permissions include reading and writing DNS records.

Installation

pip install certbot-dns-kas

Make sure you install it into the same Python environment as Certbot.

Credentials

Create an INI file, e.g. kas-credentials.ini:

dns_kas_user     = your_kas_login
dns_kas_password = your_kas_password

Protect it, since it contains your KAS password:

chmod 600 kas-credentials.ini

Usage

certbot certonly \
  --authenticator dns-kas \
  --dns-kas-credentials /path/to/kas-credentials.ini \
  --dns-kas-propagation-seconds 120 \
  -d example.com -d "*.example.com"

Argument	Description	Default
--dns-kas-credentials	Path to the KAS credentials INI file	—
--dns-kas-propagation-seconds	Seconds to wait for DNS propagation before validation	120

If validation fails with "Incorrect TXT record found", the record usually just needs more time to propagate — raise --dns-kas-propagation-seconds (e.g. to 240).

Nginx Proxy Manager

All-Inkl (KAS) is available as a DNS provider in Nginx Proxy Manager. NPM ships its own pinned list of DNS plugins, so to use this version make sure the kas entry in NPM's dns-plugins.json points at a current release:

"kas": {
    "name": "All-Inkl",
    "package_name": "certbot-dns-kas",
    "version": "~=1.0",
    "dependencies": "",
    "full_plugin_name": "dns-kas",
    "credentials": "dns_kas_user = your_kas_user\ndns_kas_password = your_kas_password"
}

Then add an SSL certificate in NPM, choose All-Inkl as the DNS provider, enter your KAS credentials, and enable wildcard if you need *.example.com.

How it works

For each challenge the plugin:

1. resolves the hosted DNS zone for the validation name by matching it against your account's domains (get_domains), choosing the longest matching zone;
2. creates the _acme-challenge TXT record via add_dns_settings (always an add, never an overwrite, so multiple challenges for the same name coexist);
3. after validation, deletes that exact record by its KAS record id.

KAS flood protection is handled automatically with bounded retries.

Development

pip install -e .
pip install pytest
python -m pytest

The test suite validates the SOAP response parser against real captured KAS responses and covers zone resolution, flood-protection retries, idempotent record creation and cleanup.

License

Apache License 2.0 — see LICENSE.