Skip to main content

Get a Let's Encrypt certificate with Certbot

The certbot-dns-gcore plugin automates Let's Encrypt certificate issuance and renewal using the CDB DNS API. To confirm domain ownership, it uses a DNS-01 challenge: a TXT record with a specific value must be present under the domain name. The plugin creates and removes these TXT records automatically when obtaining, renewing, or revoking certificates.

The domain must be delegated to CDB nameservers (ns1.gcorelabs.net and ns2.gcdn.services), and a CDB account is required.

Install the Certbot plugin

All steps run in a terminal on the Linux server where Certbot will be installed. Connect to it via SSH before starting. The commands below apply to Ubuntu 22.04; other Linux distributions may require different package names.

  1. 1

    Update package lists

    sudo apt update
  2. 2

    Install pip3 and the venv module

    sudo apt install python3-pip python3-venv
  3. 3

    Create and activate a virtual environment

    Ubuntu 22.04 and later restrict direct pip installations into the system Python. A virtual environment avoids this restriction:

    python3 -m venv ~/certbot-venv
source ~/certbot-venv/bin/activate

    The shell prompt changes to show (certbot-venv) when the environment is active.

  4. 4

    Install the Certbot plugin

    pip install certbot-dns-gcore

    A successful installation ends with:

    Successfully installed certbot certbot-dns-gcore ...

Create credentials for the Certbot plugin

The plugin authenticates with the CDB DNS API using an API token to create and remove TXT records on behalf of the domain.

  1. 1

    Navigate to the home directory

    cd ~/
  2. 2

    Create the credentials file

    Create a file named gcore.ini in the home directory using any text editor:

    nano gcore.ini
  3. 3

    Add the API token to the file

    dns_gcore_apitoken = 0123456789abcdef...

    Replace 0123456789abcdef... with the actual API token value.

  4. 4

    Restrict file permissions

    chmod 600 gcore.ini

Acquire a certificate

  1. 1

    Run certbot to request the certificate

    certbot certonly --authenticator dns-gcore --dns-gcore-credentials=./gcore.ini --dns-gcore-propagation-seconds=30 -d '*.example.com' --key-type ecdsa --logs-dir=. --config-dir=. --work-dir=.

    The example uses *.example.com to request a wildcard certificate covering all subdomains. To secure a single domain, omit the wildcard prefix: -d 'example.com'.

  2. 2

    Enter an email address and agree to the terms

    Certbot prompts for an email address for renewal notifications and urgent security alerts:

    Enter email address (used for urgent renewal and security notices)
 (Enter 'c' to cancel): user@example.com

Please read the Terms of Service at ...
Do you agree? [Y]es/[N]o: Y

    Enter a valid email address, then type Y to agree. Certificate issuance starts automatically.

  3. 3

    Confirm the certificate was issued

    A successful issuance returns:

    Congratulations! Your certificate and chain have been saved at:
   /path/to/fullchain.pem
Your key file has been saved at:
   /path/to/privkey.pem

    If Some challenges have failed appears, increase the propagation wait time and retry:

    certbot certonly --authenticator dns-gcore --dns-gcore-credentials=./gcore.ini --dns-gcore-propagation-seconds=80 -d '*.example.com' --key-type ecdsa --logs-dir=. --config-dir=. --work-dir=.

    If the error persists, verify that the domain's nameservers point to ns1.gcorelabs.net and ns2.gcdn.services. Nameserver changes can take up to 24 hours to propagate globally.

Renew a certificate

Let's Encrypt certificates expire after 90 days. There are two renewal options:

  • Manual: Run the following commands to renew any previously issued certificate expiring within 30 days:
source ~/certbot-venv/bin/activate
certbot renew
  • Automatic (recommended): Schedule certbot renew as a cron job for automatic background renewal.