📋 Prerequisites

  • An active domain on OnlyDNS.
  • A TSIG Key generated in the OnlyDNS Portal or via CLI (onlydns tsig create --algo hmac-sha256).
  • Lego binary or Go 1.20+ toolchain.
1

Install Lego CLI

Download the pre-compiled binary for your architecture from GitHub Releases or install via Homebrew / Go: 

# Direct binary download (Linux x86_64)
curl -sL https://github.com/go-acme/lego/releases/latest/download/lego_linux_amd64.tar.gz | tar -xz lego
sudo mv lego /usr/local/bin/

# Verify installation
lego --version
2

Configure RFC 2136 Environment Variables

Lego reads provider configuration directly from standard environment variables: 

export RFC2136_NAMESERVER="ns1.onlydns.com:53"
export RFC2136_TSIG_KEY="your-tsig-key-name"
export RFC2136_TSIG_SECRET="YOUR_BASE64_TSIG_SECRET_KEY"
export RFC2136_TSIG_ALGORITHM="hmac-sha256."
export RFC2136_PROPAGATION_TIMEOUT="10s"
🔒 Least-Privilege Security Tip: In the OnlyDNS Portal or REST API, restrict this TSIG key to only update the _acme_challenge subdomain so Lego only has access to challenge verification records.
3

Issue & Renew Certificates

Run Lego to issue wildcard and apex certificates with Let's Encrypt:

Issuance Command 
lego --email="admin@example.com" \
  --dns="rfc2136" \
  --domains="example.com" \
  --domains="*.example.com" \
  --accept-tos \
  run

To renew existing certificates via cron or systemd timer, simply substitute run with renew: 

lego --email="admin@example.com" --dns="rfc2136" --domains="example.com" --domains="*.example.com" renew --days 30

Message Sent

Thanks for contacting OnlyDNS. We received your message and will follow up shortly.