Add support for DNS-01 challenge via the TransIP REST API

[ronaldtveen]

I've registered my domain with TransIP, one of the bigger players in the Dutch market when it comes to domain name registration. They have a great API for many of their services, including their DNS.

I have been running a separate docker container with DNSroboCert but would really like to use Nginx Proxy Manager with the DNS-01 challenge so I can keep blocking port 80 on my home router.

The DNS-01 challenge record can be inserted (and removed) via a simple CURL command and a single API key.

The REST API is well documented here:
https://api.transip.nl/rest/docs.html#domains-dns-post

[alexswart]

any news about this i like it to

[chaptergy]

TransIP support was added in #942

[poudenes]

@ronaldtveen Im trying now to use the DNS challange in NPM but Transip don't know what I mean with this:

certbot_dns_transip:dns_transip_key_file = /etc/letsencrypt/transip-rsa.key

How do I set this?

[ronaldtveen]

@poudenes That file is used to identify you when the machine logs in to TransIP to modify the DNS records.

You will need to create a ssh-key on the machine that runs the NginxProxyManager and place those files (private and public) on that machine (choose a logical path yourself), for me that was /ssl/transip-rsa.key since I run NPM as a Home Assistant add-on.
Then change the path to that file in the config you mentioned.

In your TransIP user profile you can go to the SSH keys page/tab and put the contents of the public key in there.

That should be enough to authenticate NPM with TransIP.
Can’t give too much other support though, I’m also just a regular user of this product.

[poudenes]

@poudenes That file is used to identify you when the machine logs in to TransIP to modify the DNS records.

You will need to create a ssh-key on the machine that runs the NginxProxyManager and place those files (private and public) on that machine (choose a logical path yourself), for me that was /ssl/transip-rsa.key since I run NPM as a Home Assistant add-on.
Then change the path to that file in the config you mentioned.

In your TransIP user profile you can go to the SSH keys page/tab and put the contents of the public key in there.

That should be enough to authenticate NPM with TransIP.
Can’t give too much other support though, I’m also just a regular user of this product.

And do you make the SSL for SSH inside the docker or on the machine where the NPM is running in the docker?
I guess the last one....

[ronaldtveen]

Yes, on the machine running NPM and not in the container itself.
The /ssl/letsencrypt dir is where NPM saves its certificates on my machine so I placed the key file one directory up.

[poudenes]

Probably you need a hosting as well. I only have domain names with TransIP. No option for adding the key

[ronaldtveen]

My bad... I checked, and what I believe you should do is go to your Control Panel in TransIP and then go to API under your username profile.
There you should have the option to create a "key pair" by just inputting a description like NPM or whatever.
That returns a key file in plain text. Now copy that to your clipboard and create a /ssl/transip.key file on the server with the copied text.
Check/change the path you mentioned in the NPM config to this file, and you should be golden.
No need to create a ssh rsa key on the server itself like I said earlier... didn't remember how I did it before, but this should work.
Good luck!

[poudenes]

For those who have same trouble here step by step what to do:

1. Login into your TransIP account
2. Goto "My Account" and click on API (upper right corner)
3. You see "Key Pairs" enter name in label field (no spaces or add _ for space)
4. Click green Kay Pair button
5. Important! Copy the key to a save place, you will see this only ONE time!
6. Goto your machine where NPM is running (docker or without docker)
7. i created my key in path "/etc/ssl/private"
8. nano transip.key and paste the key you copied at point 5
9. chmod 600 transip.key

From here you can do the same way you always do to create a SSL.
Only now you enable "Use a DNS Challenge" and select TransIP

certbot_dns_transip:dns_transip_username = <YOUR_TRANSIP_USERNAME>
certbot_dns_transip:dns_transip_key_file = /etc/ssl/private/transip.key

If everything went ok the SSL will created... Remeber the subdomain must be point already to your machine!

[Bart-van-Gorp]

@poudenes Ik heb mijn web server draaien op ubuntu server. Kun je aangeven wat het exacte commando is om het key path aan te maken? Dit vanaf het begin tot het einde. Ik heb momenteel Godaddy wat niet wordt ondersteund met ssl certificaten en wil overstappen naar TransIP.

[poudenes]

@poudenes Ik heb mijn web server draaien op ubuntu server. Kun je aangeven wat het exacte commando is om het key path aan te maken? Dit vanaf het begin tot het einde. Ik heb momenteel Godaddy wat niet wordt ondersteund met ssl certificaten en wil overstappen naar TransIP.

Het werkte even. Daarna niet meer. Ik ben geheel overgestapt op clouflare tunnel. Beste keuze ooit. Geen enkele verwijzing is mijn ip nummer zichtbaar

[Bart-van-Gorp]

Hoef je voor Cloudflare geen poorten open te zetten? Cloudflare stond ook nog op mijn lijstje om te onderzoeken.

[poudenes]

Hoef je voor Cloudflare geen poorten open te zetten? Cloudflare stond ook nog op mijn lijstje om te onderzoeken.

Cloudflare is gratis te gebruiken. Je maakt een tunnel aan en je hebt wel beperkte poorten. Maar ik kan alles benaderen via https en achter de tunnel verwijzen naar alle poorten die de appricaties gebruiken. Ssh poort is te gebruiken.

Ik ben echt onwijs enthousiast.