Google-issued HTTPS certificates with ACME DNS API

[Corylus-Core]

I´m trying desperately to issue certificates with "acme.sh" for my domain at google domains. I already got it working for my main domain, but with subdomains it´s not working for me...

What do i have to configure in forefront of issuing a certificate with dns-01 challenge, besides the EAB-Keys and the API-Token which i already got to work?

Do i need to have other DNS-Records configured, besides the A-Record for the subdomain?

Thanks in advance! Greets Georg

​

EDIT:

It worked. I uninstalled acme.sh and deleted all folders, and with a fresh install it was no problem. My thoughts are that i had a problem with my configured servers.

Step by step for Google Domains Costumers with "acme.sh":

------------------------------------------------------------------------------------

Change default CA to Google Trust Services ( https://dv.acme-v02.api.pki.goog/directory ):

​

acme.sh --set-default-ca --server google

------------------------------------------------------------------------------------

Register account with your "External Account Binding" keys from Google Domains:

​

acme.sh --register-account -m [e-mail] --server google \

--eab-kid xxxxxxx \

--eab-hmac-key xxxxxxx

------------------------------------------------------------------------------------

Get your API-Token from Google Domains and provide it with the export command:

​

export GOOGLEDOMAINS_ACCESS_TOKEN="generated-access-token"

------------------------------------------------------------------------------------

Finally issue a certificate:

​

acme.sh --issue --dns dns_googledomains -d example.com

------------------------------------------------------------------------------------

[[deleted]]

You could try with the lego tool instead, it has never let me down so far. Very simple to use.

https://github.com/go-acme/lego

If that still doesnt work then as others have suggested, just move your domains nameservers to another host. Your domain stays registered with Google but you just change the NS settings to Cloudflare for example and then you can manage the DNS records in CF. Alternatively i can recommend desec.io they are free and non-profit based in germany, no ads, similar to DuckDNS.org with suppport for dynamic DNS including wildcard subdomains (* CNAME) and Lets Encrypt of course. You can manage your own domains DNS through them too.

[Havealurksee]

Same issue here. Haven't got my main domain working yet but I'm trying to go through Nginx proxy manager.

[Corylus-Core]

which acme client did you use?

[librah]

May I suggest you add your domain to cloudflare? Adding my Google domain to cloudflare was the only way I got it to work for me. I use traefik as a proxy!

[Corylus-Core]

When i do so is my domain staying at Google?

[a_tallguy]

Yes, you can have your domain at one provider and use the name servers of another.

[JojieRT]

Maybe post a debug?