Skip to main content

Certbot: Issue and install certificate for NGINX using DNS-01 domain validation

Before you begin

To install the certificate, ensure you have the following ACME details:

  • ACME directory URL:

    For CertCentral accounts, use the region-specific URL (See Inbound IP addresses and URLs by environment and region).

    Base URL:https://one.digicert.com/mpki/api/v1/acme/v2/directory>.

    Region-specific URLs:

    EU region:https://one.nl.digicert.com orhttps://one.ch.digicert.com
    Japan region:https://one.digicert.co.jp
    US region:https://one.us.digicert.com

  • The external account binding (EAB) credentials from DigiCert:

    • The EAB key identifier (KID). For CertCentral. accounts, use ACME credentialsi.

      Sample KID:zcwmKf9sCnDUZsbCOgnv1ijy46l6UeEYCavSQQirl-g

    • The external account binding HMAC key from your ACME credentials.

      Sample HMAC: RHZraHBXQUxWTEFGdFhndjRVNmV3S3F6c2VNZDM1QzRURGhjdHF3S1NublJjN3dhVUFObzA0SXJwVHBnU2xnR

Issue and install the certificate using DNS-01 method

  1. Copy the following command to the command-line prompt:

    sudo certbot --nginx --register-unsafely-without-email --eab-kid {MY-KEY-IDENTIFIER} --eab-hmac-key {MY-HMAC-KEY} --server {ACME-URL} --config-dir {MY-CONFIG-DIR} -d {FQDN} --manual --preferred-challenges dns

  3. To request DNS-01 validation, use --preferred-challenges dns option.

    This applies to DV certificates and OV/EV certificates that are not prevalidated.

  4. To manually add a DNS record to your domain, use the --manual option to complete the validation challenge.

    When run in manual mode, the command is interactive: Certbot provides the DNS validation parameters to decide how the validation gets carried out. For example:

    _acme-challenge.example.com. 300 IN TXT "mJ9ffxp9pX...f0EDcZZ_klG5wWD1"

  5. To complete the process, run the command.

What's next

The certificate is validated, issued, and installed successfully.

The domains are validated, and the certificate is issued and installed on your NGINX server.

To renew, reissue, or duplicate the certificate, see Certbot: Renew, reissue, or duplicate certificate using ACME URL query parametersCertbot: Renew, reissue, or duplicate certificate using ACME URL query parameters

In this section: