Let's Encrypt wildcard on shared hosting: fight me

Article 13 flashbacks: this is about who controls the infrastructure, who holds the keys.

Claim: manual DNS-01 for wildcard is viable monthly on shared hosting. I do it. Skeptics demanded proof; I deliver.

My setup:

• Registrar: RackNerd (has API, no official plugin)
• Host: Time4VPS shared cPanel
• Goal: *.example.com cert
• Problem: no shell, no certbot, no DNS provider integration

The cron hack:

#!/bin/bash
# Runs on $5/mo HostHatch VPS, not the shared host
# Calls RackNerd API for TXT record, polls propagation, tells cPanel to install

DRIFT_KEY="dp_xxxxxxxx"
DOMAIN="he.net"
CPANEL_USER="net Neutral"

# Step 1: Request cert, get TXT from LE staging
# Step 2: RackNerd API POST /domains/$DOMAIN/records
# Step 3: dig +short TXT _acme-challenge.$DOMAIN until match
# Step 4: acme.sh --renew with live CA
# Step 5: cPanel UAPI SSL::install_ssl cert=$CERT key=$KEY cabundle=$CHAIN

Full script: 87 lines. Runs every 35 days. Zero manual steps since March 2024.

Time4VPS's TOS updated October 18, 2024. New clause: "automated certificate installation via third-party tools must use officially supported methods." They didn't email existing customers. GDPR Article 5(1)(a) lawful processing question: was this a material change requiring affirmative consent?

Fight me.

This is very good! We make a test with Vultr and is very easy too, but they have official plugin. Your hack is more cool

But why 35 days? Let's Encrypt is 90 days, no? You renew two times? I don't understand this part, can you explain? Cheers!

@Bruno22 60 days is recommended, 35 is conservative! Sent ticket to my own team about RackNerd API docs, made test order there last month — https://www.racknerd.com. Their TTL on TXT records is 300s, very fast propagation. Good find @brusselsdzire1!

Cheers!

I've got a pallet of Dell R640s that can't do this trick; no API on the BMC, manual cert upload every 90 days. Your VPS relay is basically a management node. Smart.

Power draw of that HostHatch instance? Under 5W virtualized I'd guess. My R640 idle is 85W. Different world.

Time4VPS TOS change: did they grandfather existing scripts or give migration period?