Automate HTTPS certificates with ACME DNS-01

DNS-01 proves control of a name by temporarily publishing a TXT record. It can validate wildcard certificates and does not require the certificate authority to connect to your web server. You still need to install the resulting certificate on the destination.

Requirements

Use a registered name with uk.app managed DNS, Python 3, acme.sh and the uk.app CLI plus DNS hook. Create an API token with read and write:records. A DDNS token is not sufficient. Keep credentials outside public files and shell history.

Install the helper

Download the integration files. Install ukapp.py as an executable named ukapp, and copy dns_ukapp.sh into acme.sh's dnsapi directory. These are custom integration files; upstream acme.sh does not yet include the provider.

Test with the staging authority

Provide UKAPP_TOKEN securely in the process environment and set UKAPP_CLI if the executable is not on your PATH. Run:

acme.sh --issue --server letsencrypt_test \
  --dns dns_ukapp -d yourname.uk.app --dnssleep 300

Replace the example hostname. A staging certificate is deliberately untrusted by browsers. Once validation works, use the production authority and your certificate client's installation and renewal procedure.

Preserve renewal state

The hook records the exact TXT record it creates under UKAPP_STATE_DIR, defaulting to ~/.cache/ukapp-acme. Keep this directory available to cleanup and renewal jobs. Existing TXT records are preserved. If a request has an uncertain result, inspect DNS before repeating it.

Use lego instead

The download also includes lego_ukapp.sh, an adapter for lego's built-in exec DNS provider. Make the adapter and CLI executable. Keep UKAPP_TOKEN in the environment and use the default exec mode; do not enable EXEC_MODE=RAW. With lego 5:

export UKAPP_CLI=/absolute/path/to/ukapp
export EXEC_PATH=/absolute/path/to/lego_ukapp.sh
export EXEC_PROPAGATION_TIMEOUT=600
lego run --dns exec --server letsencrypt-staging \
  --email you@example.com --accept-tos \
  --domains yourname.uk.app --path /private/path/lego-state

Keep the account, certificate and challenge state directories private and persistent. Use the same environment for scheduled renewal. This adapter does not require a native uk.app provider in lego.

Check the result

Confirm cleanup of the temporary challenge, install the certificate and configure renewal reloads for your server. The registry's wildcard certificate covers its own edge service; it is not copied to your server.

ACME API details · Home server setup