ACME client plugins¶

CertIntel plugins let an existing ACME client publish and remove DNS-01 challenge TXT values through CertIntel. The source repository records validation for all five clients; compatibility still depends on the host version and your environment. Choose the guide for your client:

Each guide downloads the latest release from its release record and checks the file's SHA-256.

The ACME client continues to own certificate orders, private keys, storage, installation and renewal scheduling. No CertIntel Agent is needed. The plugins handle DNS validation only; add reporting scripts separately if you want check-ins and renewal results in CertIntel. Testing of the five DNS plugins does not imply that every optional reporting wrapper has been tested end-to-end.

Downloads¶

Every plugin release publishes a JSON release record that names the current version, the download URL of each file and its SHA-256. The client guides read the record to download the latest release and check the hash, so no version is hardcoded in the instructions. The current version is the version in each record below.

In each record, version is the current release, url and sha256 describe the client's main file (the DLL, CertIntel.ps1, the wheel or the DNS API script), and files lists every published file with its own sha256. Since 0.1.12 the setup guides are these wiki pages only; a README.md is no longer published in the records. Artifact URLs are versioned and immutable. Legacy direct latest/*.dll, latest/*.ps1, SHA256SUMS and wheel URLs have been removed; always start from the record.

After downloading, compare the file's SHA-256 with the record. On Linux, BSD or WSL:

echo "<sha256 from the record>  <downloaded file>" | sha256sum -c -

On macOS use shasum -a 256 -c -. In PowerShell:

(Get-FileHash .\<downloaded file> -Algorithm SHA256).Hash -eq '<sha256 from the record>'

A mismatch means a corrupt or incomplete download: delete the file and download it again. Windows DLLs and PowerShell scripts are also Authenticode-signed by CN=CertIntel Code Signing, O=CertIntel, thumbprint DD3F69F48412C05A9365E4863B7FFFBE254FE62D. The certificate is self-signed, so Get-AuthenticodeSignature reports Status: UnknownError even for a genuine file; the thumbprint and an intact signature are what matter. Do not import the certificate into a trust store to clear the status. See the source repository's release records page for the full record format.

Before you start¶

1. In Delegated DNS-01, create a delegation for the certificate name. Save its Delegation ID, update secret, CNAME target and API base; the page shows each client's configuration under Use this delegation with….

2. At your DNS provider, create the permanent CNAME supplied by CertIntel:

   _acme-challenge.example.com.  CNAME  YOUR-LABEL.dns01.certin.tel.
   

3. Wait until the CNAME resolves publicly. With Cloudflare, use DNS only.

4. Install the plugin and supply the delegation details using your client's guide. Use the delegation's update secret. Agent and reporting API keys are separate credentials and do not authenticate TXT updates.
5. Test issuance and cleanup against a staging CA, then create a production order and test renewal under the account that will run the scheduler.

The API base defaults to https://api.certin.tel/api/v1. Any override must use HTTPS and include /api/v1.

example.com and *.example.com share one delegation. www.example.com needs its own exact mapping and CNAME. Mapping keys are certificate names without *. or _acme-challenge.; the generated CNAME target is not a certificate name.

Credentials and renewal¶

Keep plugin files and credential paths available to the scheduled account. After rotating a delegation secret, update the corresponding saved credential and test renewal. Rotation does not change the delegation's UUID or permanent CNAME.

Delegation ownership¶

Use one issuing client/host per delegation. The plugins preserve other TXT values and remove their own, but the API replaces the whole TXT set and accepts at most two values. Local locks cannot coordinate another host, a native CertIntel Agent workflow, or dashboard edits. Avoid concurrent issuance against the same delegation, including staging tests during a production renewal.

If a crash leaves stale TXT values, confirm that no issuance is active before removing them in CertIntel and retrying. A CA may reuse valid authorizations, so successful renewal does not always publish a fresh challenge.