lb acme-dns-provider

The lb acme-dns-provider command defines over which DNS provider the DNS-01 verification will be done in the ACME certificates. In the DNS-01 verification TR7 writes a temporary value into the DNS record of the domain name; for this it needs the API credentials of the provider. Its panel equivalent is the ACME DNS Providers screen.

The first fields written are name and providerType

Without the provider type being selected, the credential fields are not listed; every type has its own fields.

Command Summary

TR7 WEB-CLI · lb acme-dns-provider

# Tab after the command

admin@TR7LBWAF01> lb acme-dns-provider

add delete list show update

 

admin@TR7LBWAF01> lb acme-dns-provider list # list all of them

admin@TR7LBWAF01> lb acme-dns-provider show <id> # show one

admin@TR7LBWAF01> lb acme-dns-provider add name <name> providerType <type> …

admin@TR7LBWAF01> lb acme-dns-provider update id <id> …

admin@TR7LBWAF01> lb acme-dns-provider delete <id>

admin@TR7LBWAF01>  

Required Fields

Order	Field	Status	What it does	What is written after it
1	name	Required	Gives a name to the provider record	The name of the record; it must be unique in the collection
2	providerType	Required	Selects which DNS provider will be used	cloudflare · route53 · azure · generic
3	cfToken	Conditionally required	Only cloudflare; the API token that has the permission to write a record	The Cloudflare API token
3 · 4	awsAccessKeyId · awsSecretAccessKey	Conditionally required	Only route53; the access key	The key id and its secret value
3–6	azureSubscriptionId · azureTenantId · azureAppId · azureClientSecret	Conditionally required	Only azure; the subscription, tenant and application id	The id values and the client secret
3	dnsApiName	Conditionally required	Only generic; the acme.sh DNS plugin that will be used	The plugin name

The required fields specific to the provider are written without a prefix if there is no field starting with -- in the line, and with the -- prefix if there is.

The Provider Types

cloudflare

Field	What it does	What is written after it
--cfToken	Carries the API token that has the permission to write the DNS record	The Cloudflare API token. It is required (see The Required Fields)
--cfAccountId	States the account	The account id
--cfZoneId	States the zone in which the record will be written	The zone id

route53

Field	What it does	What is written after it
--awsAccessKeyId	Carries the id of the access key	The access key id. It is required (see The Required Fields)
--awsSecretAccessKey	Carries the secret value of the access key	The secret key. It is required (see The Required Fields)

azure

Field	What it does	What is written after it
--azureSubscriptionId	States the subscription	The subscription id. It is required (see The Required Fields)
--azureTenantId	States the tenant	The tenant id. It is required (see The Required Fields)
--azureAppId	Carries the application (client) id	The application id. It is required (see The Required Fields)
--azureClientSecret	Carries the secret key of the application	The client secret. It is required (see The Required Fields)

generic

Field	What it does	What is written after it
--dnsApiName	Determines which acme.sh DNS plugin will be used	The plugin name. It is required (see The Required Fields)

The Environment Variables

It can be written in every type; it carries the additional values that the provider plugin expects.

Field	What it does	What is written after it
--envVars.N.key	Determines the name of the variable	The variable name
--envVars.N.value	Determines the value of the variable	The value of the variable

Especially in the generic type, all the values that the plugin asks for are given with these pairs.

Examples

TR7 WEB-CLI · defining and using a provider

admin@TR7LBWAF01> lb acme-dns-provider add name cf-org providerType cloudflare \

--cfToken <token> --cfZoneId <zone>

 

admin@TR7LBWAF01> lb acme-dns-provider add name generic-dns providerType generic \

--dnsApiName <plugin> --envVars.0.key <variable> --envVars.0.value <value>

 

# it is selected in the DNS-01 verification

admin@TR7LBWAF01> lb certificate add type acmeSh name wildcard-cert \

--acmeShChallengeType dns01 acmeShDnsProviderId <provider> --acmeShDomains.0.domain "*.kurum.com.tr"

admin@TR7LBWAF01>  

Things to Know

• The provider is used only in DNS-01. In the lb certificate command, when --acmeShChallengeType dns01 is selected, the acmeShDnsProviderId field becomes required; since the certificate type is a discriminator, this field is written without a prefix even if there is a -- in the line.
• Wildcard certificates require DNS verification. The certificates in the *.domainname form cannot be taken with HTTP-01.
• The credential fields depend on the type. When the type is changed, the fields of the previous type drop from the list and the fields of the new type open.
• The permission should be kept narrow. It is recommended to use a token on the provider that has only the permission to write the verification record.
• The name is unique. A second provider record with the same name cannot be created.