The DNS-01 challenge proves you control a domain with a TXT record instead of a web page. It is the only way to get a wildcard certificate, and it works for servers that are not reachable from the internet. This hook lets certbot publish that record through the NameOcean API.
POST /ssl/example.com). Use this guide when your server should get and renew its own certificate.dns:read and dns:write. Limit it to the server's IP address if you can.# curl -fsSL https://nameocean.net/install.sh | sh # curl -fsSL https://nameocean.net/developers/guides/letsencrypt-dns-01/nameocean-hook.sh \ -o /etc/letsencrypt/nameocean-hook.sh # chmod 700 /etc/letsencrypt/nameocean-hook.sh # echo 'NAMEOCEAN_API_KEY=no_live_…' > /etc/letsencrypt/nameocean.env # chmod 600 /etc/letsencrypt/nameocean.env
The key stays in a file only root can read; certbot's saved renewal settings never contain it.
# certbot certonly --manual --preferred-challenges dns \
--manual-auth-hook "/etc/letsencrypt/nameocean-hook.sh auth" \
--manual-cleanup-hook "/etc/letsencrypt/nameocean-hook.sh cleanup" \
-d example.com -d "*.example.com"
For each name, the hook finds the zone it belongs to among your NameOcean zones, adds _acme-challenge as a TXT record, and waits until all four nameservers answer with it, usually within ten seconds. After the check, the cleanup step deletes exactly the record it added. example.com and *.example.com both use _acme-challenge.example.com; the two values are published side by side.
certbot stores the hooks with the certificate, so its timer renews it the same way. Test that once:
# certbot renew --dry-run
Every record the hook adds and deletes is in Dashboard → Activity with the key that did it, and sends dns.record.created and dns.record.deleted webhook events.
Read it before you run it as root. It only calls the nameocean CLI and dig.
#!/bin/sh
# certbot DNS-01 hooks for NameOcean DNS:
# --manual-auth-hook "/etc/letsencrypt/nameocean-hook.sh auth"
# --manual-cleanup-hook "/etc/letsencrypt/nameocean-hook.sh cleanup"
# Needs the nameocean CLI and an API key with dns:write, in /etc/letsencrypt/nameocean.env:
# NAMEOCEAN_API_KEY=no_live_...
set -e
[ -f /etc/letsencrypt/nameocean.env ] && . /etc/letsencrypt/nameocean.env && export NAMEOCEAN_API_KEY
# the zone CERTBOT_DOMAIN is in: the longest of your zones it ends with
zone="$NAMEOCEAN_ZONE"
if [ -z "$zone" ]; then
for z in $(nameocean dns ls --json | sed -n 's/.*"name": *"\([^"]*\)".*/\1/p'); do
case "$CERTBOT_DOMAIN" in "$z" | *".$z") [ ${#z} -gt ${#zone} ] && zone="$z" ;; esac
done
fi
[ -n "$zone" ] || { echo "no NameOcean DNS zone for $CERTBOT_DOMAIN" >&2; exit 1; }
name="_acme-challenge"
[ "$CERTBOT_DOMAIN" = "$zone" ] || name="_acme-challenge.${CERTBOT_DOMAIN%.$zone}"
case "$1" in
auth)
id=$(nameocean dns add "$zone" TXT "$name" "$CERTBOT_VALIDATION" --ttl 5m --json \
| sed -n 's/.*"id": *\([0-9][0-9]*\).*/\1/p' | head -n 1)
[ -n "$id" ] || { echo "could not add the TXT record" >&2; exit 1; }
echo "$id" # certbot passes this to the cleanup hook as CERTBOT_AUTH_OUTPUT
# wait until all four nameservers answer with it (usually a few seconds)
for i in $(seq 1 60); do
n=0
for ns in ns1 ns2 ns3 ns4; do
dig +short TXT "$name.$zone" "@$ns.nameocean.net" | grep -q -- "$CERTBOT_VALIDATION" && n=$((n + 1))
done
[ "$n" -eq 4 ] && exit 0
sleep 2
done
echo "the TXT record is not on every nameserver after 2 minutes" >&2
exit 1
;;
cleanup)
[ -z "$CERTBOT_AUTH_OUTPUT" ] || nameocean dns rm "$zone" TXT "$CERTBOT_AUTH_OUTPUT"
;;
*)
echo "usage: $0 auth|cleanup" >&2
exit 2
;;
esac
The hook makes two API calls you can make from any ACME client or language:
$ curl -X POST https://nameocean.net/api/v1/dns/example.com/records \ -H "Authorization: Bearer $NAMEOCEAN_API_KEY" -H "Content-Type: application/json" \ -d '{"type": "TXT", "hostname": "_acme-challenge", "text": "<validation>", "ttl": "5m"}' {"id": 4190, "type": "TXT", "hostname": "_acme-challenge", …} $ curl -X DELETE https://nameocean.net/api/v1/dns/example.com/records/TXT/4190 \ -H "Authorization: Bearer $NAMEOCEAN_API_KEY"