Step 6 of 8
6. Prove the domain is yours
Copy link to the page “6. Prove the domain is yours”Prepare your domain so certificates can be issued and renewed automatically.
What you need
Copy link to the section “What you need”- The names the certificate should cover, such as
www.example.com. - Access to create DNS records at your DNS provider.
Prepare the domain once
Copy link to the section “Prepare the domain once”Use AutoDNS (CNAME). It works with every DNS provider and requires no API key for your DNS. Validation runs through sslbrain Cloud (EU).
Create the DNS record
Copy link to the section “Create the DNS record”-
Open Issuance › Domains and click Make ready beside the domain. If it is missing, use Add domain.
-
Copy the record name and value with Copy. Create the CNAME record at your DNS provider:
_acme-challenge.example.com. 3600 IN CNAME <CNAME-target>Use one record per name. The same record covers
example.comand*.example.com. If the DNS panel adds the domain itself, enter only_acme-challenge. Leave the record in place. -
Enter the names in Domain, address or names in the domain test and click Check domain.
Check that it works
Copy link to the section “Check that it works”The test shows Ready for a certificate. If the record is not visible in DNS yet, use Check again once you have corrected it.
The list under Issuance › Domains shows the status of each name:
- Checking: sslbrain does not yet have a result for the name, or public DNS did not respond. The check runs in the background, and the list updates automatically while it is running.
- Ready: the name can be validated using the method shown. This does not mean a certificate has been issued.
- DNS record missing: the name has no validation method available yet. The CNAME redirection is missing, or no DNS credential covers the name. Correct the record or the credential’s zone bindings, then use Check again. Removing the domain from the list does not fix validation.
Check again checks the name again. It does not add the name to a certificate; change the names on the certificate or installation plan.
Next step
Copy link to the section “Next step”Choose where certificates come from.
If it fails
Copy link to the section “If it fails”- The test shows a wrong CNAME target or a name with the domain added twice → copy the name and value from Make ready and correct the record.
- A TXT record exists at the same name → remove it so the CNAME record can be created. At Cloudflare, set the record to DNS only.
- The test shows that CAA blocks issuance → add the CAA records shown by the test. CAA is a DNS record that says which CAs may issue for the domain. See CAA lookup.
- The appliance cannot reach sslbrain Cloud → check the connection under first-time setup.
- The certificate is waiting for validation → follow Validation fails.
When you want to use your DNS provider’s API
Copy link to the section “When you want to use your DNS provider’s API”Use DNS-API if your provider is on the list and you want the appliance to create records with an API key. An owner creates the credential under Issuance › Domains › DNS providers › Add DNS provider. Select the provider, fill in its fields and domains, then click Test and save. If the test fails, it shows what to correct.
A name uses the credential with the longest matching zone binding, then the default credential if none matches. AutoDNS (CNAME) takes priority when the name has the CNAME record.
When the CA requires another permanent record
Copy link to the section “When the CA requires another permanent record”With DNS-PERSIST-01, create a permanent TXT record for each CA account. Under Make ready › Another way › TXT record (dns-persist), copy the account’s value to _validation-persist.<domain> and leave the record in place. Matching means it is present. For Missing or Different value, correct the record to match the displayed value. The method is described in an IETF draft.
For DigiCert through sslbrain Cloud, the CNAME record _dnsauth.<domain> appears under Another way. Use the displayed record for the selected product.
When you run your own DNS server
Copy link to the section “When you run your own DNS server”See updating your own DNS server.
When validation needs a script
Copy link to the section “When validation needs a script”See a script on the appliance.
When your DNS provider is missing from the list
Copy link to the section “When your DNS provider is missing from the list”Built-in DNS providers
Copy link to the section “Built-in DNS providers”The fields are in English in the form and have the same names here. Fields marked * in the form are required. Azure DNS is not built in. Use AutoDNS (CNAME) for domains in Azure DNS.
Abion API Key, issued by Abion for their Partner Management API.
AWS Route 53
Copy link to the section “AWS Route 53”AWS Access Key ID and AWS Secret Access Key for an IAM user or role with route53:ChangeResourceRecordSets on the zones. AWS Region can be left as us-east-1.
Bunny.net
Copy link to the section “Bunny.net”Bunny.net API Access Key from Account › Preferences › API Access Key.
Cloudflare
Copy link to the section “Cloudflare”Cloudflare API Token: a token with the permissions Zone:Read and DNS:Edit on the zones. A Global API Key cannot be used.
Connbyte API Token, created in the Connbyte portal.
Curanet API Key, created with DNS permissions under API access in Curanet’s control panel.
DanDomain
Copy link to the section “DanDomain”DanDomain API Key, created with DNS permissions under API access in DanDomain’s control panel.
DigitalOcean
Copy link to the section “DigitalOcean”DigitalOcean API Token: a Personal Access Token with Write scope.
DNSimple Account ID, the number in your DNSimple address such as /a/1234, and an account-level DNSimple API Token.
Domeneshop
Copy link to the section “Domeneshop”Domeneshop API Token and Domeneshop API Secret.
Gigahost.no
Copy link to the section “Gigahost.no”Gigahost.no API Key, created under API in Gigahost’s control panel.
GleSYS Project ID, for example CL12345, and GleSYS API Key.
GoDaddy API Key and GoDaddy API Secret. GoDaddy opens its API only to accounts with at least 50 domains or an active discount plan.
Hetzner DNS
Copy link to the section “Hetzner DNS”Hetzner DNS API Token from the Hetzner DNS Console.
HostUp API Token with the scopes read:dns, write:dns and read:domains.
Select nios with a Grid Manager host, WAPI username and password, or uddi with a Universal DDI API key. See Infoblox DNS API for zone-scoped permissions, DNS views, WAPI 2.12/2.13.1/2.14 and a custom CA.
IONOS API Key.
Loopia API Username, which ends in @loopiaapi, and Loopia API Password. The user needs getDomains, getZoneRecords, addZoneRecord, removeZoneRecord and removeSubdomain.
ScanNet API Key, created with DNS permissions under API access in ScanNet’s control panel.
Simply.com
Copy link to the section “Simply.com”Simply.com Account Name, the account number such as S123456, and Simply.com API Key.