📋 Prerequisites

An active domain on OnlyDNS.
A TSIG Key generated in the OnlyDNS Portal or via CLI (onlydns tsig create --algo hmac-sha256).
Standard Linux/BSD shell environment with curl or wget and nsupdate (part of bind9-dnsutils / bind-utils).

Install acme.sh

Install acme.sh into your user home directory (~/.acme.sh) with your notification email:

curl https://get.acme.sh | sh -s email=admin@example.com
source ~/.bashrc

Ensure nsupdate is installed on your host: sudo apt install dnsutils (Debian/Ubuntu) or sudo dnf install bind-utils (RHEL/CentOS).

Configure OnlyDNS TSIG Environment Variables

acme.sh automatically persists these variables securely inside ~/.acme.sh/account.conf so you only need to export them once:

# OnlyDNS Primary Anycast Nameserver
export NSUPDATE_SERVER="ns1.onlydns.com"

# TSIG Key Name and Secret from OnlyDNS Portal or CLI
export NSUPDATE_KEYNAME="your-tsig-key-name"
export NSUPDATE_KEYALGO="163"   # 163 represents HMAC-SHA256 in IETF DNSSEC registry
export NSUPDATE_KEYVALUE="YOUR_BASE64_TSIG_SECRET_KEY"

🔒 Least-Privilege Security Tip: In the OnlyDNS Portal or REST API, restrict this TSIG key to only update the _acme_challenge subdomain so acme.sh cannot modify other zone records.

Issue Wildcard SSL Certificate

Request your certificate with --dns dns_nsupdate. Set --dnssleep 10 because OnlyDNS updates propagate rapidly across edge nodes (typically 0.2–5s):

Let's Encrypt / ZeroSSL Command

~/.acme.sh/acme.sh --issue \
  --dns dns_nsupdate \
  --dnssleep 5 \
  -d "example.com" \
  -d "*.example.com"

💡 Tip (Switching CAs): To explicitly issue from Let's Encrypt instead of the ZeroSSL default, simply add --server letsencrypt to the command.

Install Certificate & Enable Auto-Renewal

Do not directly reference files inside ~/.acme.sh/ in your web server config. Use --install-cert to copy them to your production directory and configure your reload daemon:

Install & Reload Nginx Example

~/.acme.sh/acme.sh --install-cert -d "example.com" \
  --key-file       /etc/ssl/private/example.com.key \
  --fullchain-file /etc/ssl/certs/example.com.fullchain.pem \
  --reloadcmd     "systemctl reload nginx"

acme.sh maintains an active cron job (crontab -l) that checks certificate expiration daily and triggers automatic renewal and reload without human intervention.