Welcome to the acme-dns-tiny project

Tiny ACME client to respond to DNS challenges

Latest Release main branch pipeline status main branch coverage status


acme-dns-tiny is a python 3 script able to ask a Certificate Autority (CA) to provide automatically a X.509 certificate.

To be able to automate the certificate creation, acme-dns-tiny uses the ACME RFC 8555 standard. Indeed, to prove to the CA you are the owner of the domains included in the certificate request, acme-dns-tiny uses the DNS challenges defined by this RFC.

To resolve these challenges, acme-dns-tiny dynamically updates some DNS resources on your DNS service provider.

That's why, to be able to use acme-dns-tiny, you'll have to choose a CA which provides a service following the ACME RFC 8555, like the Let's Encrypt non-profit Certificate Authority.

The main goal of acme-dns-tiny is not to rewrite the official certbot ACME client but to give administrators a simple script easy to integrate in their environment without requiring root privileges and without access to the domain private key.


To run acme-dns-tiny, you'll need a computer with Python 3, the dnspython module, the requests module and the OpenSSL command line available.

Then you have to give access to the non-root user running the script to:

Finally, that computer must be able to access a DNS server allowing dynamic resource updates through TSIG key authentication.

Latest News

Please see our Gitlab page to find the latest release.


acme-dns-tiny is a fork of the acme-tiny project, but it has slightly diverged to:

Code and documentation

Code and documentation are available on Gitlab.
This project is under the MIT license as the original acme-tiny.

A mirror of the code is also available on Github.

You'll find the acme-dns-tiny news on the XMPP community.
To read news from this pubsub link, you can use one instance of the Movim services as the adorsaz.ch Movim pod.
If you want to follow RSS/Atom feed, you can use Movim page too.