// docs · sample configs

Let's Encrypt · DNS-01

A public certificate proven by a DNS TXT record. Works even when the host has no inbound ports open, which makes it the friendliest public option for locked-down machines.

[cert]
hostname = "host.example.com"
key_type = "ec256"

[acme]
ca        = "letsencrypt"
email     = "you@example.com"
challenge = "dns-01"

[acme.dns]
provider = "gandiv5"            # creds via env: GANDIV5_PERSONAL_ACCESS_TOKEN

You need a DNS provider that lego supports, plus its API token in the environment (for Gandi that’s GANDIV5_PERSONAL_ACCESS_TOKEN). Nothing has to be reachable on :80 or :443, so this suits hosts stuck behind NAT or a firewall. If the host’s resolver is split-horizon, sits on a VPN, or is just slow to see public DNS, set propagation_check = "authoritative".

File: letsencrypt-dns-01-gandiv5.toml

The [store], [[distribute]] and [logging] tail is identical in every example; see Sample configs.