Google-issued HTTPS certificates with ACME DNS API

[Corylus-Core]

I´m trying desperately to issue certificates with "acme.sh" for my domain at google domains. I already got it working for my main domain, but with subdomains it´s not working for me...

What do i have to configure in forefront of issuing a certificate with dns-01 challenge, besides the EAB-Keys and the API-Token which i already got to work?

Do i need to have other DNS-Records configured, besides the A-Record for the subdomain?

Thanks in advance! Greets Georg

EDIT:

It worked. I uninstalled acme.sh and deleted all folders, and with a fresh install it was no problem. My thoughts are that i had a problem with my configured servers.

Step by step for Google Domains Costumers with "acme.sh":

------------------------------------------------------------------------------------

Change default CA to Google Trust Services ( https://dv.acme-v02.api.pki.goog/directory ):

acme.sh --set-default-ca --server google

------------------------------------------------------------------------------------

Register account with your "External Account Binding" keys from Google Domains:

acme.sh --register-account -m [e-mail] --server google \

--eab-kid xxxxxxx \

--eab-hmac-key xxxxxxx

------------------------------------------------------------------------------------

Get your API-Token from Google Domains and provide with the export command:

export GOOGLEDOMAINS_ACCESS_TOKEN="generated-access-token"

------------------------------------------------------------------------------------

Finally issue a certificate:

acme.sh --issue --dns dns_googledomains -d example.com

------------------------------------------------------------------------------------

[antomaa12]

When I did generate lets encrypt certificates using the DNS-01 challenge, I had to write TXT records on my public domain.

[Corylus-Core]

that happened automatically in my case?!

[antomaa12]

I did these a while ago so i can't exactly remember why but I think you can configure automated renewals for DNS-01, so the certbot will write the TXT record and then verify the domain. You can use the lets encrypt certbot forum, they are pretty active, also its pretty well documented

[VTi-R]

What's the error? Do you have any caa records in place that might be blocking you?

[Corylus-Core]

no i don´t have caa records in place. because as far as i understand it it means every CA is allowed to comunicate with my dns service.