Using DNS Validation With AutoInstall SSL

Cloudflare

Use these arguments with the AutoInstall SSL install certificate command to complete DNS validation using Cloudflare:

Argument	Value
–validationtype	dns
–validationprovider	cloudflare
–cloudflareapitoken	Your Cloudflare API token (see below)

Example commands:

Windows:

                                    AutoInstallSSL.exe installcertificate --token [AutoInstall SSL Token] --validationtype dns --validationprovider cloudflare --cloudflareapitoken [APIToken]
                                

Linux:

                                    sudo runautoinstallssl.sh installcertificate --token [AutoInstall SSL Token] --validationtype dns --validationprovider cloudflare --cloudflareapitoken [APIToken]
                                

How to setup API credentials in your Cloudflare account:

1. Go to your account profile page
2. Click on API Tokens
3. Click Create Token
4. Next to “Edit zone DNS” click Use template
5. Under Zone Resources, select “All zones”
6. Under Permissions, click Add more and select User + User Details + Read.
7. Click Continue to summary
8. Click Create Token
9. Copy the token

Note: the above permissions are required so that AutoInstall SSL can enumerate the zones in your account and choose the correct zone for a parent or sub-domain.

DNS Made Easy

Use these arguments with the AutoInstall SSL installcertificate command to complete DNS validation using DNS Made Easy:

Argument	Value
–validationtype	dns
–validationprovider	dnsmadeeasy
–apikey	Your DNS Made Easy API key (see below)
–apisecret	Your DNS Made Easy API secret key (see below)

Example commands:

Windows:

                                    AutoInstallSSL.exe installcertificate --token [AutoInstall SSL Token] --validationtype dns --validationprovider dnsmadeeasy --apikey [APIKey] --apisecret [APISecret]
                                

Linux:

                                    sudo runautoinstallssl.sh installcertificate --token [AutoInstall SSL Token] --validationtype dns --validationprovider dnsmadeeasy --apikey [APIKey] --apisecret [APISecret]
                                

How to setup API credentials in your DNS Made Easy account:

• Log into https://cp.dnsmadeeasy.com and go to Config > Account Information.
• You must be the primary user on the account to be able to see API keys.
• If you’ve already generated API credentials, they’ll be displayed. If the credentials are not displayed, check the box to “Generate New API Credentials” and click Save.

Microsoft Azure DNS

Use these arguments with the AutoInstall SSL installcertificate command to complete DNS validation using Microsoft Azure DNS:

Argument	Value
–validationtype	dns
–validationprovider	azure
–azuretenantid	Your Tenant ID in Microsoft Entra ID
–azureclientid	The Application (client) ID for your AutoInstall SSL application in Microsoft Entra ID
–azuresecret	The Secret for your AutoInstall SSL application in Microsoft Entra ID
–azuresubscriptionid	The Azure Subscription ID associated with your domain’s DNS zone
–azureresourcegroupname	The Resource group name associated with your domain’s DNS zone
–azurehostedzone	Azurehostedzone Name

Example commands:

Windows:

                                    AutoInstallSSL.exe installcertificate --token [AutoInstall SSL Token] --validationtype dns --validationprovider azure --azuretenantid [TenantId] --azureclientid [ClientID] --azuresecret [Secret] --azuresubscriptionid [SubscriptionID] --azureresourcegroupname [ResourceGroupName] --azurehostedzone [HostedZone]
                                

Linux:

                                    sudo runautoinstallssl.sh installcertificate --token [AutoInstall SSL Token] --validationtype dns --validationprovider azure --azuretenantid [TenantId] --azureclientid [ClientID] --azuresecret [Secret] --azuresubscriptionid [SubscriptionID] --azureresourcegroupname [ResourceGroupName] --azurehostedzone [HostedZone]
                                

How to setup API credentials in your Azure portal:

• In Microsoft Entra ID, click on App Registration and create a new application named “AutoInstall SSL”. Redirect URI can be blank.
• Give the new application DNS Zone Contributor level access to the subscription your domain’s DNS zone is in.

AWS Route 53

Use these arguments with the AutoInstall SSL installcertificate command to complete DNS validation using AWS Route 53:

Argument	Value
–validationtype	dns
–validationprovider	route53
–route53accesskeyid	Your AWS Access key (see below)
–route53secretaccesskey	Your AWS Secret access key (see below)

Example commands:

Windows:

                                    AutoInstallSSL.exe installcertificate --token [AutoInstall SSL Token] --validationtype dns --validationprovider route53 --route53accesskeyid [AccessKeyID] --route53secretaccesskey [SecretAccessKey]
                                

Linux:

                                    sudo runautoinstallssl.sh installcertificate --token [AutoInstall SSL Token] --validationtype dns --validationprovider route53 --route53accesskeyid [AccessKeyID] --route53secretaccesskey [SecretAccessKey]
                                

How to setup API credentials in your AWS console:

• Go to the AWS management console
• Click on your profile name at the top right, then click on Security credentials
• Under Access Keys, select Create New Access Key
• Click Show Access Key and save/download your credentials
• Updating DNS Credentials

If your DNS provider credentials change, you can update the credentials used by AutoInstall SSL:

1. Run the main AutoInstall SSL command:
2. Linux: sudo runautoinstallssl.sh
3. Windows: AutoInstallSSL.exe
4. Select menu option 4, Settings & Credentials
5. Select Manage DNS provider credentials

Digital Ocean

Use these arguments with AutoInstall SSL to complete DNS validation using Digital Ocean:

Argument	Value
–validationtype	dns
–validationprovider	digitalocean
–digitaloceantoken	Your DigitalOcean API token

Example commands:

Windows:

                                   AutoInstallSSL.exe installcertificate --token [AutoInstall SSL Token] --validationtype dns --validationprovider digitalocean --digitaloceantoken [APIToken]
                                

Linux:

                                    sudo runautoinstallssl.sh installcertificate --token [AutoInstall SSL Token] --validationtype dns --validationprovider digitalocean --digitaloceantoken [APIToken]
                                

How to set up API credentials in DigitalOcean

1. Log in to your DigitalOcean account.
2. From the left-hand navigation, click API.
3. Under Personal Access Tokens, click Generate New Token.
4. Enter a name for the token (for example: AutoInstallSSL).
5. Select Custom Scopes
6. Select all the options from within the “Domain” resource type (create, read, update and delete).
7. Click Generate Token.
8. Copy the token and store it securely, you will not be able to view it again.

Google Cloud DNS

Use these arguments with the AutoInstall SSL installcertificate command to complete DNS validation using Google Cloud DNS:

Argument	Value
–validationtype	gcpdns
–serviceaccountkey	The local path of the JSON key on your server
–projectid	Google Cloud Project ID

Example commands:

Windows:

                                    AutoInstallSSL.exe installcertificate --token [AutoInstall SSL Token] --validationtype dns --validationprovider gcpdns --serviceaccountkey [Path of SERVICEACCOUNTKEY in Double quote] --projectid [PROJECTID]
                                

Linux:

                                    sudo runautoinstallssl.sh installcertificate --token [AutoInstall SSL Token] --validationtype dns --validationprovider gcpdns --serviceaccountkey [Path of SERVICEACCOUNTKEY in Double quote] --projectid [PROJECTID]
                                

How to set up API credentials in Google Cloud DNS

1. Log in to Google Cloud Console.
2. Select the project that hosts your Cloud DNS zone.
3. Go to “IAM & Admin” → “Service Accounts”.
4. Click “Create service account”.
5. Enter a name for the service account and click “Create and continue”.
6. Under Permissions, assign the role “DNS Administrator”, then click “Continue” → “Done”.
7. Locate the newly created service account, click the three-dot menu, and select “Manage”.
8. Click “Add key” → “Create new key”, then choose “JSON” (A JSON file will be downloaded to your computer).
9. Upload the JSON file to your server and note its local file path, this path is used for the –serviceaccountkey.The Project ID is shown in the Google Cloud project selector.

Understanding Service Accounts: Service Account Overview

Name.com

Use these arguments with the AutoInstall SSL installcertificate command to complete DNS validation using Name.com:

Argument	Value
–validationtype	namecom
–apikey	Your Name.com username
–apisecret	Your Name.com API token

Example commands:

Windows:

                                    AutoInstallSSL.exe installcertificate --token [AutoInstall SSL Token] --validationtype dns --validationprovider namecom --username [USERNAME] --apitoken [APITOKEN]
                                

Linux:

                                    sudo runautoinstallssl.sh installcertificate --token [AutoInstall SSL Token] --validationtype dns --validationprovider namecom --username [USERNAME] --apitoken [APITOKEN]
                                

How to set up API credentials in Name.com

1. Copy the Username and Token into the command above
2. Log in to Name.com
3. Go to Account Settings
4. Open API Tokens
5. Create a Production API Token

Namecheap

Use these arguments with the AutoInstall SSL installcertificate command to complete DNS validation using Namecheap:

Argument	Value
–validationtype	namecheap
–apiuser	Your API Namecheap username
–username	Namecheap Username
––apikey	API Key
–clientip	Client IP

Example commands:

Windows:

                                    AutoInstallSSL.exe installcertificate --token [AutoInstall SSL Token] --validationtype dns --validationprovider namecheap  --apiuser [APIUSER] --username [USERNAME] --apikey [APIKEY] --clientip [CLIENTIP]
                                

Linux:

                                    sudo runautoinstallssl.sh installcertificate --token [AutoInstall SSL Token] --validationtype dns --validationprovider namecheap --apiuser [APIUSER] --username [USERNAME] --apikey [APIKEY] --clientip [CLIENTIP]
                                

How to set up API credentials in Namecheap

1. Log in to Namecheap
2. Go to Profile → Tools
3. Open Namecheap API Access
4. Scroll down to Namecheap API and click on “Manage”
5. Enabling API access will allocate you an API Key.
6. Copy your API key
7. Whitelist your public IPv4 address that will be using the API Key within namecheap.com.
8. Your Namecheap account username will also act as the API username.

OVH

Use these arguments with the AutoInstall SSL installcertificate command to complete DNS validation using OVH:

Argument	Value
–validationtype	ovh
–applicationkey	OVH Application Key
–applicationsecret	OVH Application Secret
–consumerkey	OVH Consumer Key
–origin	Origin is the OVH API region your account belongs to. For example: ovh-eu

Example commands:

Windows:

                                    AutoInstallSSL.exe installcertificate –token [AutoInstall SSL Token] --validationtype dns --validationprovider ovh  --applicationkey [APPLICATIONKEY] --applicationsecret [APPLICATIONSECRET] --consumerkey [CONSUMERKEY] --origin [ORIGIN]
                                

Linux:

                                    sudo runautoinstallssl.sh installcertificate --token [AutoInstall SSL Token] --validationtype dns --validationprovider ovh  --applicationkey [APPLICATIONKEY] --applicationsecret [APPLICATIONSECRET] --consumerkey [CONSUMERKEY] --origin [ORIGIN]
                                

How to set up API credentials in OVH

1. Log in to OVHcloud Manager.
2. Go to Identity, Security & Operations > API Keys.
3. Click on “Create an API Key”
4. Enter the name of the API Key
5. Set validity to “Unlimited”
6. Enter the following set of rights for that API key:
   • GET = /domain/zone/*
   • GET = /domain/zone/*/record
   • POST = /domain/zone/*/record
   • POST = /domain/zone/*/refresh
7. Create the API Key.
8. Copy and securely store all three values (They will not be shown again):
   • Application Key
   • Application Secret
   • Consumer Key

RFC2136 (BIND on Linux, including AlmaLinux and Amazon Linux 2)

Use these arguments within the AutoInstall SSL install certificate command to complete DNS validation using RFC2136 dynamic updates:

Argument	What it is	Where it comes from
–serverhost	Authoritative DNS server that accepts dynamic updates	DNS provider documentation, DNS administrator, or DNS server configuration
–serverport	Port the DNS server listens on for updates (usually 53)	DNS server configuration (optional if default)
–tsigkeyname	Name of the TSIG key used to authenticate updates	Provided when the TSIG key was created
–tsigkeysecret	Shared secret for the TSIG key	Provided when the TSIG key was created
–tsigkeyalgorithm	Algorithm used by the TSIG key (for example HMAC-SHA256)	DNS server configuration or key details

Example commands:

Windows:

                                    AutoInstallSSL.exe installcertificate --token [AutoInstall SSL Token] --validationtype dns --validationprovider rfc2136  --serverhost [SERVERHOST] --serverport [SERVERPORT] --tsigkeyname [TSIGKEYNAME] --tsigkeysecret [TSIGKEYSECRET] --tsigkeyalgorithm [TSIGKEYALGORITHM]
                                

Linux:

                                    sudo runautoinstallssl.sh installcertificate --token [AutoInstall SSL Token] --validationtype dns --validationprovider rfc2136  --serverhost [SERVERHOST] --serverport [SERVERPORT] --tsigkeyname [TSIGKEYNAME] --tsigkeysecret [TSIGKEYSECRET] --tsigkeyalgorithm [TSIGKEYALGORITHM]
                                

To use RFC2136 for DNS-based certificate validation, you must provide details for an existing DNS server that supports RFC2136 dynamic updates.

AutoInstallSSL uses this information to securely create and remove DNS TXT records during certificate validation and reissues.

What each value is used for

1. Server host / portIdentifies where AutoInstallSSL sends DNS update requests.
2. TSIG key name, secret, and algorithmAuthenticate the request so only authorized systems can modify DNS records.

Example values (for reference only)

Argument	Example
–serverhost	dns1.example.com
–serverport	53
–tsigkeyname	rfc2136-key
–tsigkeysecret	AbCdEfGhIjKlMnOpQrStUvWxYz1234567890=
–tsigkeyalgorithm	hmac-sha256

These examples are illustrative only. Your actual values will differ.