acme-dns-tiny is a python 3 script able to ask a Certificate Autority (CA)
to provide automatically a X.509 certificate.
To be able to automate the certificate creation, acme-dns-tiny uses
RFC 8555 standard. Indeed, to prove to the CA you
are the owner of the domains included in the certificate request,
acme-dns-tiny uses the DNS challenges defined by this
To resolve these challenges, acme-dns-tiny dynamically updates some
DNS resources on your DNS
That's why, to be able to use acme-dns-tiny, you'll have to choose a CA
which provides a service following the
ACME RFC 8555,
like the Let's Encrypt non-profit
The main goal of acme-dns-tiny is not to rewrite the official
certbot ACME client but
to give administrators a simple script easy to integrate in their
environment without requiring root privileges and without access to the
domain private key.
To run acme-dns-tiny, you'll need a computer with Python 3, the
the requests module
and the OpenSSL command line available.
Then you have to give access to the non-root user running the script to:
- the ACME account private key used to authenticate with the CA
the Certificate Signing Request (CSR) which will be
used to create the certificate.
Note: the CSR is enough, the user does not
need any access to the linked private domain key.
- a config file containing path of these files and the DNS
secret to manage DNS resources
Finally, that computer must be able to access a DNS server
allowing dynamic resource updates through TSIG key authentication.
2021-06-07: v2.3 has been
Feature fixed on v2.3:
fix compatibility with dnspython 2.0 (
fix issue when trying to apply DNS update on secondary server (thanks Sebastian Koechlin)
fix debug message when CNAME was not found
fix test chain assertion (a chain contains more than 1 certificate)
skip already validated authorization challenge
Continuous Integration improvement:
Debian Stretch tests were using Debian Jessie image
Enable Docker build uses
and the overlay2 filesystem driver
the .gitignore file has been simplified
2020-06-14: v2.2 has been
more robust search of the domain name in the Subject field of the
fixed a bug which required Contact to be filled (thanks
fixed forgotten format for log message (thanks
support of CSR with
SAN extension marked
code style updated to follow the python
simplified regexp used to read the account key
new Gitlab Continuous Integration configuration to build
automatically docker images to run tests with always upto-date
Debian Docker image (including Jessie, Stretch and Buster releases).
2018-12-09: v2.1 has been
with support of ACME draft 16.
2018-05-03: v2.0 has been
with Let's Encrypt v2 API endpoint support.
Please see our Gitlab page to find the latest
acme-dns-tiny is a fork of the acme-tiny
project, but it has slightly diverged to:
- remove http-01 challenge support
- add dns-01 challenge support by automating the DNS resources update
- support only on python 3
- use a configuration INI file instead of arguments
- use the requests module to send HTTP requests to the ACME server
Code and documentation
Code and documentation are available on
This project is under the MIT license as the original acme-tiny.
A mirror of the code is also available on Github.
You'll find the acme-dns-tiny news on the
To read news from this pubsub link, you can use one instance of the Movim
services as the
adorsaz.ch Movim pod.
If you want to follow RSS/Atom feed, you can use Movim page too.