Nomadns

Documentation

DNS-01 certificates

The certificate authority (Let’s Encrypt, for example) checks that you control a name by reading a TXT record. Nomadns publishes that record for your ACME client: no port needs to be opened.

For a Nomadns subdomain

  • On the subdomain page, create a “Certificates (ACME, DNS-01)” token and copy the identifier and secret.
  • Export the variables, then request the certificate:
export ACMEDNS_BASE_URL=https://api.nomadns.net
export ACMEDNS_USERNAME=acme-identifier
export ACMEDNS_PASSWORD='secret'
export ACMEDNS_SUBDOMAIN=home
acme.sh --issue --dns dns_acmedns -d home.nomadns.net -d '*.home.nomadns.net'

ACMEDNS_BASE_URL is required: without it, acme.sh sends the identifier and secret to the public auth.acme-dns.io service.

What Nomadns does

  • The value is published at _acme-challenge.home.nomadns.net.
  • The reply waits until all three name servers serve the value, 20 seconds at most.
  • The last two values are kept (name and *.name), each removed after one hour.

For your own domain

Delegate the challenge to Nomadns with a CNAME in your domain’s zone, then run acme.sh with your domain:

_acme-challenge.example.org. CNAME _acme-challenge.home.nomadns.net.

The ACME token of home then works for example.org. Other acme-dns compatible clients (lego, Traefik, cert-manager…) have not been tested; only acme.sh has.