Step 6 of 8
6. Prove the domain is yours
Copy link to the page “6. Prove the domain is yours”The CA checks that you own the domain before it issues a certificate. Once the domain has a CNAME delegation, sslbrain handles that check itself on every issuance and renewal.
Before you start
Copy link to the section “Before you start”- Access to create records in DNS for the domain.
- For a DNS API credential: an API key from the DNS provider, and the Owner role in sslbrain (roles).
Choose a method
Copy link to the section “Choose a method”Use a CNAME delegation. It works with every DNS provider, and sslbrain never gets a key to your DNS.
Use a DNS API credential if the domain is at one of the built-in providers and you would rather give sslbrain an API key than create CNAME records.
If your CA account uses dns-persist-01, you can instead create one standing TXT record per CA account: dns-persist-01.
CNAME delegation
Copy link to the section “CNAME delegation”You create the record once per domain and do not touch it again.
-
Open Domain validation under Setup › Certificate issuance, and choose the CNAME delegation (Auto-DNS) tab.
-
Enter the names for the certificate in Domain, address or names under Test a domain, for example
www.example.dkor*.example.dk. Up to 5 at a time. Click Check domain. -
The test shows the records that are missing. Create them at your DNS provider. For
example.dkthe record looks like this:_acme-challenge.example.dk. 3600 IN CNAME <CNAME-target>If the DNS panel adds the domain to the name itself, enter only
_acme-challengein the name field. The value is exactly the CNAME target, with nothing after it. -
Leave Check domain running. It checks again every 30 seconds for up to 20 minutes.
-
When the test reports Ready for a certificate, click Create a certificate for …. It opens the rule wizard in step 8.
DigiCert products via sslbrain Cloud use the record _dnsauth.<domain>. Check domain checks both names and shows which one your certificate sources read.
sslbrain creates the validation record at the DNS provider with your API key and removes it again after issuance. The key is stored encrypted in the appliance’s vault.
-
Create an API key at the DNS provider with the permissions listed under the provider.
-
Open Domain validation, the DNS API credentials tab, and click Add DNS API credential.
-
Give the credential a Name, for example
Cloudflare production. Choose DNS API (anbefalet til certifikater) under Type, and the provider under DNS-udbyder. -
Fill in the provider’s fields with the keys from step 1. Choose Direct from the appliance under Connection and Automatisk (anbefalet) under DCV-tilstand.
-
Enter the zones the credential is for in Zone-bindinger (en pr. linje, valgfrit). If this is your first credential, tick Brug som standard for alle DNS-validering ….
-
Click Save. Then click Test access and Fetch zones. The list should show your domains.
A name uses the credential with the longest zone binding that matches, and otherwise the credential set as the default. If the name has a CNAME delegation, that is used before any DNS API credential.
dns-persist-01
Copy link to the section “dns-persist-01”With dns-persist-01 (IETF draft) you create one TXT record on the domain and leave it in place. The record names your account at the CA, and as long as it exists, that account can get certificates for the domain without a DNS change at every renewal. sslbrain does not create the record for you.
Each CA account has its own record. If you use several CAs or accounts, each one needs its record on every domain. The record is named _validation-persist in front of the domain:
_validation-persist.example.com. 3600 IN TXT "<the value from the tab>"-
Open Domain validation and choose the dns-persist-01 tab. The tab shows one card per CA account: Account in sslbrain Cloud or Direct ACME account on this appliance.
-
Click Copy next to Value. The value is ready to paste and must not be changed.
-
Create the TXT record
_validation-persist.<domain>with the value at your DNS provider, and leave it there for as long as you use the account. -
Look at Status for the domain on the card. A domain that is not in the list can be checked under Check a domain.
Which CAs the tab shows a record for:
- Google Trust Services: the value has the form
pki.goog; accounturi=<account URL>; policy=wildcard. Withpolicy=wildcard, one record on the domain covers the domain itself, all its subdomains and wildcard certificates. - DigiCert via sslbrain Cloud: the value has the form
digicert.com; accounturi=<account URL>. sslbrain Cloud fetches it from DigiCert once the account exists, and DigiCert hands it out only when the account has its first domain. Until then, the card says why the value is missing. If sslbrain Cloud cannot show the value for your own DigiCert account, you find it in DigiCert CertCentral. - Other CAs: the tab shows a record only once the CA offers dns-persist-01 in production. Let’s Encrypt does not yet.
If the CA has a notice about the method, it is in the yellow box at the top of the card. Google Trust Services, for example, says that dns-persist-01 is not fully standardized yet and that you may need to update the record when the final specification arrives.
Status per domain:
- Matching: the record is in place. Nothing more to do.
- Different value: there is a record, but with another value. The tab shows the value it found under Found instead. If it says The record exists, but without the expected policy, something like
policy=wildcardis missing. Change the record to the copied value. - Missing: there is no record. Create it as in step 3.
- Not checked: the domain was not read in time. Check it under Check a domain.
If the status says the domain’s CAA records do not allow the CA, the records to add are shown under the status.
For direct ACME accounts on the appliance, the appliance works out the record itself, so they are shown even when the appliance is not connected to sslbrain Cloud or Cloud is down. If sslbrain Cloud cannot be reached, the tab shows the records read last, with the time under The records shown were read. They may have changed since. Click Read again to fetch them anew. If the appliance has no earlier copy, the tab says the records could not be read. That does not mean no records are needed; try again shortly.
Your own DNS server
Copy link to the section “Your own DNS server”A DNS server such as BIND can be updated with RFC 2136 and a TSIG key: Domains without a DNS API.
A script instead of a provider
Copy link to the section “A script instead of a provider”A DNS API credential can run a script on the appliance: Domains without a DNS API.
A provider sslbrain does not know
Copy link to the section “A provider sslbrain does not know”If the DNS provider has a REST API, you can describe it yourself under New custom REST DNS provider…: Domains without a DNS API.
If it fails
Copy link to the section “If it fails”- Check domain finds no CNAME delegation, or it points to the wrong place: the test says what is wrong, for example that the DNS panel added the domain twice. Correct the record and let the test run again.
- The domain is at Cloudflare: set the record to “DNS only”. With the proxy on, the name answers with an A record and validation fails.
- There is a TXT record on
_acme-challenge.<domain>: delete it. Only the CNAME record may be there. - CAA records block the issuer: the test shows which CAA records to add. See CAA lookup.
- The appliance is not connected to sslbrain Cloud: CNAME delegation works only with that connection. Connect the appliance as in step 2.
- Every CNAME delegation stops working at once: the label in the CNAME target has been changed in sslbrain Cloud. Point the records at the target the Label and CNAME target card shows.
- The DNS provider only allows known IP addresses: choose Run via sslbrain Cloud proxy under Connection. sslbrain Cloud then calls the provider from a fixed IP address, over HTTPS on port 443. If the proxy cannot be reached, the call fails. It is never sent direct instead.
- The certificate is not ordered: neither a CNAME delegation nor a DNS API credential covers the name. The certificate shows why.
- The Free licence: it covers 2 domains per sslbrain Cloud account. See the domain limit.
- The certificate is left waiting, or issuance fails with a validation error: see Validation fails.
Built-in DNS providers
Copy link to the section “Built-in DNS providers”The fields are in English in the form and have the same names here. Fields marked * are required. Azure DNS is not built in. Use CNAME delegation for domains in Azure DNS.
Abion API Key *, issued by Abion for their Partner Management API.
AWS Route 53
Copy link to the section “AWS Route 53”AWS Access Key ID * and AWS Secret Access Key * for an IAM user or role with route53:ChangeResourceRecordSets on the zones. AWS Region can be left as us-east-1.
Bunny.net
Copy link to the section “Bunny.net”Bunny.net API Access Key * from Account › Preferences › API Access Key.
Cloudflare
Copy link to the section “Cloudflare”Cloudflare API Token *: a token with the permissions Zone:Read and DNS:Edit on the zones. A Global API Key cannot be used.
Connbyte API Token *, created in the Connbyte portal.
Curanet API Key *, created with DNS permissions under API access in Curanet’s control panel.
DanDomain
Copy link to the section “DanDomain”DanDomain API Key *, created with DNS permissions under API access in DanDomain’s control panel.
DigitalOcean
Copy link to the section “DigitalOcean”DigitalOcean API Token *: a Personal Access Token with Write scope.
DNSimple Account ID *, the number in your DNSimple address such as /a/1234, and an account-level DNSimple API Token *.
Domeneshop
Copy link to the section “Domeneshop”Domeneshop API Token * and Domeneshop API Secret *.
Gigahost.no
Copy link to the section “Gigahost.no”Gigahost.no API Key *, created under API in Gigahost’s control panel.
GleSYS Project ID *, for example CL12345, and GleSYS API Key *.
GoDaddy API Key * and GoDaddy API Secret *. GoDaddy opens its API only to accounts with at least 50 domains or an active discount plan.
Hetzner DNS
Copy link to the section “Hetzner DNS”Hetzner DNS API Token * from the Hetzner DNS Console.
HostUp API Token * with the scopes read:dns, write:dns and read:domains.
Select nios with a Grid Manager host, WAPI username and password, or uddi with a Universal DDI API key. See Infoblox DNS API for zone-scoped permissions, DNS views, WAPI 2.12/2.13.1/2.14 and a custom CA.
IONOS API Key *.
Loopia API Username *, which ends in @loopiaapi, and Loopia API Password *. The user needs getDomains, getZoneRecords, addZoneRecord, removeZoneRecord and removeSubdomain.
ScanNet API Key *, created with DNS permissions under API access in ScanNet’s control panel.
Simply.com
Copy link to the section “Simply.com”Simply.com Account Name *, the account number such as S123456, and Simply.com API Key *.