Step 6 of 8

6. Prove the domain is yours

Domain validation is the CA checking that you own the domain before it issues a certificate. Once every domain has a CNAME redirect or a DNS API credential, sslbrain handles validation itself on every issuance and renewal.

Before you start

The appliance is connected to sslbrain Cloud (step 2). CNAME delegation works only with that connection.
You can create records in DNS for the domain, or you have an API key from your DNS provider.
Only a user with the Owner role can create a DNS API credential (roles).
The Free licence covers 10 domains per sslbrain Cloud account (the domain limit).

Choose a method for each domain

Open Domain validation under Setup › Certificate issuance. The page has a tab for each method: CNAME delegation (Auto-DNS) and DNS API credentials.

	CNAME delegation	DNS API
What you do	Create the CNAME records once; Check domain shows which	Create a credential in sslbrain with an API key from the DNS provider
Where the key to your DNS is kept	At your DNS provider; sslbrain never gets it	Encrypted in the appliance’s vault
Requires	A connection to sslbrain Cloud	One of the built-in providers, a DNS server with RFC 2136, or a REST API you can describe
Suits	Domains at any DNS provider, including those without an API	Domains at a provider with an API, when you would rather give sslbrain a key than create CNAME records

On every issuance the appliance picks the method for each name itself, and the first one that fits is used:

a CNAME redirect to Auto-DNS on _acme-challenge.<name>;
a DNS API credential, in sslbrain Cloud or on the appliance, whose zone binding covers the name;
the DNS API credential set as the default.

If none of them fits, sslbrain does not order the certificate from the CA, and the certificate shows why.

CNAME delegation

You create a CNAME record once, from _acme-challenge.<domain> to the appliance’s CNAME target at sslbrain Cloud. On every issuance and renewal, sslbrain Cloud publishes the validation value on the target, and the CA follows your CNAME redirect to it. Your own DNS keys never leave the DNS provider.

Open Domain validation and the CNAME delegation (Auto-DNS) tab. The Label and CNAME target card shows the target. Copy it with Copy.
Enter the names for the certificate you need in Domain, address or names under Test a domain, for example www.example.dk or *.example.dk, up to 5 at a time. Click Check domain.
For each missing record, the test shows Name, Full name, Type, Value (destination) and TTL. Create the records at your DNS provider. For example.dk the record looks like this:
```
_acme-challenge.example.dk.  3600  IN  CNAME  <CNAME-target>
```
Most DNS panels add the domain to the name themselves. In that case, enter only _acme-challenge in the name field. The value must be exactly the CNAME target, with nothing after it.
Leave Check domain running. It checks again every 30 seconds for up to 20 minutes, from the domain’s name servers to the CAA records.
When the test reports Ready for a certificate, Create a certificate for … takes you straight to the rule wizard in step 8.

Cloudflare: set the record to “DNS only”. With the proxy on, the name answers with an A record and validation fails.
A TXT record on the same name: delete it. Only the CNAME record may be on _acme-challenge.<domain>.
DigiCert products via sslbrain Cloud use the record _dnsauth.<domain> instead. Check domain checks both names and shows which one your certificate sources read.
The Managed domains card shows the domains the account has set up in sslbrain Cloud, with the status Verified or Awaiting CNAME. Domains are added and removed in sslbrain Cloud. A domain with a working CNAME redirect validates without being on the list.

DNS API

sslbrain signs in to the DNS provider with your API key, creates the TXT record for validation and removes it again after issuance. The key is stored encrypted in the appliance’s vault.

Create an API key at the DNS provider with the permissions listed under the provider.
Open Domain validation, the DNS API credentials tab, and click Add DNS API credential.

Fill in the form. Several fields are shown in Danish only, and they are quoted here as the form shows them:

Field	Value
Name	A name you will recognise the credential by, for example `Cloudflare production`
Type	DNS API (anbefalet til certifikater)
DNS-udbyder	The provider under Built-in providers, or New custom REST DNS provider… (your own REST provider)
The provider’s fields	The keys from step 1
Connection	Direct from the appliance, or Run via sslbrain Cloud proxy if the provider only allows known IP addresses
DCV-tilstand	Automatisk (anbefalet)
Zone-bindinger (en pr. linje, valgfrit)	The zones the credential is for. A name uses the credential with the longest binding that matches
Brug som standard for alle DNS-validering …	Tick it for the first credential

Click Save.
Click Test access, then Fetch zones on the page that opens. The list should contain your domains.

With Run via sslbrain Cloud proxy, sslbrain Cloud calls the provider from a fixed IP address, over HTTPS on port 443 only. The API key is encrypted all the way, and sslbrain Cloud cannot read it. If the proxy refuses the call or cannot be reached, the call fails. It is never sent direct instead.

Built-in DNS providers

sslbrain has 19 built-in providers. The fields are in English in the form and have the same names here. Fields marked * are required.

Azure DNS is not among the built-in providers. Use CNAME delegation for domains in Azure DNS.

Abion

Abion API Key *, issued by Abion for their Partner Management API.

AWS Route 53

AWS Access Key ID * and AWS Secret Access Key * for an IAM user or role with route53:ChangeResourceRecordSets on the zones. AWS Region can be left as us-east-1.

Bunny.net

Bunny.net API Access Key * from Account › Preferences › API Access Key.

Cloudflare

Cloudflare API Token *: a token with the permissions Zone:Read and DNS:Edit on the zones. A Global API Key cannot be used.

Connbyte

Connbyte API Token *, created in the Connbyte portal.

Curanet

Curanet API Key *, created with DNS permissions under API access in Curanet’s control panel.

DanDomain

DanDomain API Key *, created with DNS permissions under API access in DanDomain’s control panel.

DigitalOcean

DigitalOcean API Token *: a Personal Access Token with Write scope.

DNSimple

DNSimple Account ID * (the number in your DNSimple address, for example /a/1234) and an account-level DNSimple API Token *.

Domeneshop

Domeneshop API Token * and Domeneshop API Secret *.

Gigahost.no

Gigahost.no API Key *, created under API in Gigahost’s control panel.

GleSYS

GleSYS Project ID * (for example CL12345) and GleSYS API Key *.

GoDaddy

GoDaddy API Key * and GoDaddy API Secret *. GoDaddy opens its API only to accounts with at least 50 domains or an active discount plan.

Hetzner DNS

Hetzner DNS API Token * from the Hetzner DNS Console.

HostUp

HostUp API Token * with the scopes read:dns, write:dns and read:domains.

IONOS

IONOS API Key *.

Loopia

Loopia API Username *, which ends in @loopiaapi, and Loopia API Password *. The user needs getDomains, getZoneRecords, addZoneRecord, removeZoneRecord and removeSubdomain.

ScanNet

ScanNet API Key *, created with DNS permissions under API access in ScanNet’s control panel.

Simply.com

Simply.com Account Name * (the account number, for example S123456) and Simply.com API Key *.

Your own DNS server

If you run your own DNS server, such as BIND, sslbrain can update it with RFC 2136 (dynamic update) and a TSIG key. The setup is in Domains without a DNS API.

A script instead of a provider

A DNS API credential can run a script on the appliance instead of calling a provider. How it works: Domains without a DNS API.

A provider sslbrain does not know

If your DNS provider has a REST API that sslbrain has no built-in provider for, you can describe the API yourself under New custom REST DNS provider…. The fields are in Domains without a DNS API.

Check that it works

CNAME delegation: Check domain under Test a domain reports Ready for a certificate for every name and shows where the CNAME redirect points. The test measures CNAME redirects only.
A DNS API credential passes Test access, and Fetch zones lists your zones.
In the rule wizard (step 8), the Domain validation panel shows for each name which method covers it.

If it fails

Check domain finds no CNAME redirect, or it points to the wrong place: the test says what is wrong, for example that the DNS panel added the domain twice. Correct the record and let the test run again.
CAA records on the domain block the issuer: the test shows which CAA records to add. See also CAA lookup.
The certificate is left waiting, or issuance fails with a validation error: see Validation fails.