Skip to main content

Certbot: Issue and install certificate for NGINX using DNS-01 domain validation

At the command-line prompt, use the below command syntax to issue and install a public DV/OV/EV certificate for the NGINX web server, requesting domain control validation via DNS-01:

sudo certbot --nginx --register-unsafely-without-email --eab-kid {MY-KEY-IDENTIFIER} --eab-hmac-key {MY-HMAC-KEY} --server {ACME-URL} --config-dir {MY-CONFIG-DIR} -d {FQDN} --manual --preferred-challenges dns

Note the following:

  • For DV certificates, domain control validation checks always get handled dynamically by the ACME protocol.

  • For OV/EV certificates, domain validation checks only get handled by the ACME protocol if the domain is not already prevalidated in CertCentral. If the domain is prevalidated, then CertCentral validates the domain itself, out-of-band and independent of the ACME protocol.

  • The --preferred-challenges option specifies the preferred form of domain validation. Enter dns here to request DNS-01 validation.

  • The --manual option means you will manually add a DNS record to your domain for the validation challenge.

  • This command runs interactively. Certbot supplies the required DNS validation parameters, which must be added as a TXT DNS record. For example:

    _acme-challenge.example.com. 300 IN TXT "mJ9ffxp9pX...f0EDcZZ_klG5wWD1"

  • After the TXT DNS record is in place, the command completes, and the certificate is validated, issued, and installed.

  • If the requested certificate matches an existing order, CertCentral applies the default automation action for that order (see ACME automation actions). If there is no matching order, or if the ACME URL includes ?action=enroll, CertCentral treats it as a new order and enrolls the new certificate for you.

Example command:

sudo certbot --nginx --register-unsafely-without-email --eab-kid zcskpf8sCnHGBsbCOgnv1ijy00l6UeEYCavSSSirl-k --eab-hmac-key DDDraHBXQUxWTEFGdFhndjRVNmV4t4F6c2VNZDM1QzRURGhjdHF3S1NublJjN0dhVUFObzA0SXJwVHBnU2yyUH --server https://one.digicert.com/mpki/api/v1/acme/v2/directory --config-dir /usr/local/certbot/my_public_webserver_config/ -d example.com -d www.example.com --manual --preferred-challenges dns
本节内容如下: