Certificate Automation (ACME DNS-01)

Wildcard certificates such as *.example.ch can only be validated with the ACME DNS-01 challenge: on every issue and renewal, your certificate tool publishes a TXT record at _acme-challenge.example.ch and removes it afterwards. Certificates are getting shorter-lived (47 days from 2029), so this has to happen without anyone editing records by hand.

YWT DNS accepts these changes as standard RFC 2136 dynamic updates signed with a TSIG key. certbot, acme.sh and lego support this out of the box, so there is nothing extra to install from us.

What a key can do

• Add and remove TXT records at _acme-challenge names of the domain it was made for: _acme-challenge.example.ch, _acme-challenge.www.example.ch and so on.
• Nothing else. It cannot change other records, other names or other domains. Anything else in an update is ignored.
• A domain can have up to 10 keys, each with its own label, and you can revoke each one on its own.
• Keys are deleted when the domain is deleted or transferred to another registrar.

Create a key

The panel shows everything your tool needs:

Set up your tool

The examples request a certificate for example.ch and *.example.ch. Replace the key name, secret and server address with the values from the panel; the panel fills them in for you.

dns_rfc2136_server = <IP address of ns1.ywt.ch>
dns_rfc2136_port = 53
dns_rfc2136_name = acme-0123456789.example.ch.
dns_rfc2136_secret = <secret>
dns_rfc2136_algorithm = HMAC-SHA256

certbot certonly --dns-rfc2136 --dns-rfc2136-credentials /etc/letsencrypt/ywt-example.ch.ini -d example.ch -d '*.example.ch'

key "acme-0123456789.example.ch." {
  algorithm hmac-sha256;
  secret "<secret>";
};

NSUPDATE_SERVER=ns1.ywt.ch NSUPDATE_ZONE=example.ch NSUPDATE_KEY=/etc/acme-ywt-example.ch.key \
  acme.sh --issue --dns dns_nsupdate -d example.ch -d '*.example.ch'

RFC2136_NAMESERVER=<IP address of ns1.ywt.ch> \
RFC2136_TSIG_ALGORITHM=hmac-sha256. \
RFC2136_TSIG_KEY=acme-0123456789.example.ch. \
RFC2136_TSIG_SECRET='<secret>' \
  lego --email you@example.com --dns rfc2136 -d example.ch -d '*.example.ch' run

Troubleshooting

• update failed: REFUSED or NOTAUTH: the key name or secret is wrong, the key was revoked, or _acme-challenge is a CNAME (see above).
• The update succeeds but no record appears: the tool tried to write something other than a TXT record at an _acme-challenge name. Only those are accepted; the rest of an update is skipped.
• Validation fails right after the update: the record needs a few seconds to reach both nameservers. The tools wait for this by default (certbot 60 seconds); check with dig TXT _acme-challenge.example.ch @ns2.ywt.ch.

Revoke a key

Click Revoke next to the key. Tools that still use it can no longer update DNS, so their next renewal fails until they get a new key. Revoke a key whenever a server that holds it is retired or may be compromised.