Automating Wildcard SSL with Certbot and RFC 2136

📋 Prerequisites

• An active domain on OnlyDNS.
• A TSIG Key generated in the OnlyDNS Portal or via CLI (onlydns tsig create --algo hmac-sha256).
• Root or sudo access on your Linux/UNIX server.

Install Certbot along with its official RFC 2136 DNS plugin using your distribution's package manager:

sudo apt update
sudo apt install -y certbot python3-certbot-dns-rfc2136

sudo dnf install -y epel-release
sudo dnf install -y certbot python3-certbot-dns-rfc2136

sudo snap install --classic certbot
sudo snap set certbot trust-plugin-with-root=ok
sudo snap install certbot-dns-rfc2136

Create a credentials file at /etc/letsencrypt/rfc2136.ini containing your TSIG key and OnlyDNS primary Anycast nameserver:

# Target OnlyDNS primary authoritative Anycast nameserver
dns_rfc2136_server = ns1.onlydns.com
dns_rfc2136_port = 53

# Your auto-generated TSIG key name and secret from OnlyDNS Portal or CLI
dns_rfc2136_name = your-tsig-key-name
dns_rfc2136_secret = YOUR_BASE64_TSIG_SECRET_KEY
dns_rfc2136_algorithm = HMAC-SHA256

sudo chmod 600 /etc/letsencrypt/rfc2136.ini

Run Certbot to request a certificate covering both the apex domain (example.com) and all subdomains (*.example.com). Because OnlyDNS synchronizes edge nodes rapidly (typically 0.2 to 5 seconds), a propagation delay of 10 seconds is optimal:

sudo certbot certonly \
  --dns-rfc2136 \
  --dns-rfc2136-credentials /etc/letsencrypt/rfc2136.ini \
  --dns-rfc2136-propagation-seconds 10 \
  --email admin@example.com \
  --agree-tos \
  --no-eff-email \
  -d "example.com" \
  -d "*.example.com"

Certbot will output the paths to your freshly issued certificate files:

• Certificate: /etc/letsencrypt/live/example.com/fullchain.pem
• Private Key: /etc/letsencrypt/live/example.com/privkey.pem

Certbot automatically installs a systemd timer or cron job that runs twice daily. Verify that automatic renewal will succeed by running a dry run:

sudo certbot renew --dry-run

To automatically reload Nginx or Apache whenever a certificate is renewed, add a deploy hook script under /etc/letsencrypt/renewal-hooks/deploy/reload-webserver.sh:

#!/bin/bash
# Reload Nginx / Apache upon successful certificate renewal
systemctl reload nginx 2>/dev/null || systemctl reload apache2 2>/dev/null || true

sudo chmod +x /etc/letsencrypt/renewal-hooks/deploy/reload-webserver.sh

Explore Other ACME Clients