Let's Encrypt with InfraNest DNS

Get certificates for any domain whose DNS is in InfraNest, including wildcards, without opening a port. Your ACME client asks InfraNest to add one TXT record, waits for it to be checked, then removes it.

Runnable code: the code on this page, ready to clone and run, is in infranest-examples/examples/acme-dns-01. CI runs it against the sandbox.

The token

Make a token with DNS → Write only. It can change records and nothing else: it can't delete the zone, move it, or touch your servers.

Add the challenge record

Find the zone's ID with GET /organizations/{organization}/dns-zones, then:

curl -X POST https://api.infranest.io/api/organizations/42/dns-zones/318/dns-records \
  -H "Authorization: Bearer $INFRANEST_TOKEN" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: acme-$CERTBOT_DOMAIN-$CERTBOT_VALIDATION" \
  -d '{"type":"TXT","name":"_acme-challenge","value":"'"$CERTBOT_VALIDATION"'","ttl":60}'

Keep the id from the response. You need it to remove the record. The Idempotency-Key means a hook that retries after a timeout adds the record once, not twice. See Retries and dry runs.

Remove it afterwards

curl -X DELETE https://api.infranest.io/api/organizations/42/dns-zones/318/dns-records/9021 \
  -H "Authorization: Bearer $INFRANEST_TOKEN"

Every change appears in the zone's history in InfraNest and can be undone from there.

Coming

• Ready-made providers for lego and acme.sh, so you won't need a hook script at all.