DNS-01 through their API — which provider, RackNerd themselves?
Never mind, saw the code. That's not RackNerd's API, that's a third-party DNS provider. RackNerd doesn't run DNS for your domains unless you bought it through them. So you're hitting Cloudflare or something else with that key format.
Which means if their API hiccups, your whole automation dies. I had this with Namecheap's sandbox going read-only once. Took me two days to notice because the cron just kept exiting 0.
Member OP
It's Cloudflare yeah. Should have specified. The "dh_live_" prefix is theirs, not RackNerd's.
And yeah the exit 0 thing is real. Script "succeeds" because acme.sh returns 0 even when it didn't actually issue, just reused cached cert. My 14-day check catches that at least, but still.
Member
Cloudflare API key in plain text in /etc/ssl/? You have other users on this VPS? Because if yes, this is bad. If no, still not great.
I use token with Zone:Read and DNS:Edit only, scoped to one zone. Not global API key. Also store in systemd credential or at least root-only file outside web path.
Your script also has "For" with capital F, this is not valid bash. You paste from Windows?
The capital F is killing me. This script never ran. Or it ran on a case-insensitive filesystem somehow? No, that is not possible. Or you retyped it for the forum and introduced the error.
I am guessing you retyped it. Please do not retype code. Paste. We cannot debug your memory.
Member OP
Yeah I retyped it, the original is on the VPS and I was on my phone. The actual script has proper for. Sorry.
The API key is in a file with 600 perms, owned root:root. No other users on this VPS, it's a $18/year RackNerd thing, I don't share. But point taken about scoped tokens.
$18/year? Which location? I got a 2GB KVM in LA for $16.95 from them last Black Friday. If you're paying $18 for whatever you have, might be time to migrate.
Also their New York datacenter had some routing weirdness to Europe in January. Not an outage, just 40% more latency to DE for like a week. Check your ping if your clients are EU-heavy.
Member
Acme.sh still king
But I moved to dehydrated for wildcard stuff. acme.sh upstream drama last year made me nervous. Same author situation as always. Dehydrated is in apt, no curl-to-bash install.
Your script is fine though. The notification gap is the real problem. I use a simple webhook to ntfy.sh, free tier, no account needed. Push to my phone. Took ten minutes.
Member
Ntfy.sh? I check this out wey. I use telegram bot right now but sometimes I don't see it because too many group chats.
Also marcus_qc you say "no more letsencrypt manual runs" but you still doing dns-01 manual? Or you have API, I confuse. If API, is not manual. If no API, how you automate? I used https://letsencrypt.org for that.
Member OP
It's automated via API, not manual. I meant I used to do certbot --manual with DNS verification, copy-pasting TXT records. Took 20 minutes per domain. Now it's zero touch.
The "dh_live_" key is from Cloudflare's API tokens, I create one per zone. The script reads it, does the DNS challenge, cleans up the record after.
Member
This distinction between manual and automated is precisely what eIDAS 2.0 will scrutinize. A qualified certificate issuance process must demonstrate consistent adherence to the certificate policy.
Your automation, while efficient, should be documented as part of your technical organizational measures under GDPR Article 32. The API token lifecycle — creation, rotation, revocation — needs an audit trail. I am not suggesting this is insufficient, merely that "it works" is not the same as "it is demonstrably compliant" under harmonized frameworks.
