Infoblox DNS API

Use Infoblox for certificate TXT validation with NIOS WAPI or Universal DDI/BloxOne. Select Infoblox under DNS access in sslbrain Cloud or under Domain validation › DNS API credentials on the appliance. Passwords, usernames and API keys are encrypted at rest. Stored secrets are not returned to the form when you edit a credential.

NIOS WAPI

Create a dedicated service account in Grid Manager. Use an admin group with API access only (access_method: ["API"]) and no superuser privileges.
Grant the group read access to the authoritative validation zones and Read/Write on TXT records in those zones and DNS views only. The WAPI permission is permission: "WRITE", resource_type: "TXT", with the zone’s zone_auth reference as object. Do not grant global DNS write access. The zone permission covers its TXT records, including records used for other purposes.
Select nios in Infoblox variant. Enter Grid Manager host, NIOS username and the account password in NIOS password / Universal DDI API key.
Enter the exact view name in DNS view, for example public. It is case-sensitive. An empty field selects default. Select the view whose authoritative DNS servers the certificate issuer can query. Public ACME requires a record visible from the internet; an internal view alone is insufficient.
Save the credential, bind the validation zones and use Test access. Select TXT validation for the zones. The Infoblox credential creates TXT records.

Grid Manager host accepts a hostname or HTTPS address without a path, query or login. An optional port is supported on the appliance. The appliance can reach NIOS on your LAN directly. Credentials stored in sslbrain Cloud, or calls through the Cloud proxy, require a publicly reachable HTTPS address on port 443. Store the credential on the appliance when Grid Manager is accessible only inside your network.

NIOS	WAPI
8.6	2.12
9.0	2.13.1
9.1	2.14

sslbrain discovers the WAPI version through ?_schema and selects the supported version’s path. You do not enter a version. TXT changes require no DNS service restart.

HTTPS and a custom CA

TLS certificate and hostname verification remain enabled. For a Grid Manager certificate issued by your own CA, paste the public CA chain into NIOS CA certificate (PEM). The field accepts multiple PEM certificates, up to 10 KB. A fixed self-signed server certificate can also serve as a trust anchor. The certificate must match the hostname in Grid Manager host. Never paste a private key.

Universal DDI / BloxOne

Select uddi in Infoblox variant. Create a key in Infoblox Portal: User Profile › User API Keys › Create. Set its name and expiry, then paste the new key into NIOS password / Universal DDI API key. Use an account allowed to read the selected authoritative zones and create, read and delete their TXT records.

sslbrain calls https://csp.infoblox.com/api/ddi/v1. Grid Manager host and NIOS username are unused for this variant. DNS view accepts a view ID such as dns/view/<id>; select it when multiple views contain the same zone name. Bind only the zones this credential should validate.

Records and cleanup

sslbrain finds the authoritative zone for the record name, creates one TXT object per validation value and reads it back through the API before reporting creation complete. The usual DNS visibility check follows. Wildcard and base-domain validations can hold separate values on the same name concurrently.

Cleanup deletes only the created object’s WAPI reference or Universal DDI ID. Other records and values on that name remain. If the API returns an ID but readback fails, the ID is retained for cleanup.

Infoblox can also write dns-persist-01 TXT names and values through the appliance’s existing DNS executor. Retention follows the lifecycle requesting the persistent record. The Cloud DNS persist page shows the record you should create and checks it; it does not publish it automatically. Use the value from the relevant CA account and keep the record for as long as validation should remain valid.

Domain validation · Infoblox WAPI · Universal DDI API guide