ACME certificates with lego

The ACME client lego obtains certificates from Let’s Encrypt and other ACME providers, using regfish as the DNS provider for validation. Because the challenge runs over DNS rather than the web server, this also works for wildcard certificates, and the server does not have to be reachable from the internet for it.

Prerequisites

An API key with write permission on DNS. lego creates a TXT record for the challenge and removes it afterwards.
A domain whose DNS is hosted at regfish.
Go on the system, or the installation below.

Installing Go

If Go is missing, either through the distribution’s package manager or directly. The current version is listed on go.dev:

curl 'https://go.dev/dl/go1.24.2.linux-amd64.tar.gz' -LO
sudo tar -C /usr/local -xzf go1.24.2.linux-amd64.tar.gz
export PATH=$PATH:/usr/local/go/bin

Installing lego

go install github.com/go-acme/lego/v4/cmd/lego@latest

Setting the API key

export REGFISH_API_KEY='your-api-key'

Issuing the certificate

~/go/bin/lego \
  --email you@example.com \
  --dns regfish \
  -d '*.example.com' \
  -d example.com \
  run

The first entry covers all names on one level, the second the domain itself; a wildcard alone does not include example.com. lego stores certificate and key under ~/.lego/certificates/.

Renewing

Renewal uses renew instead of run, usually daily through cron or a systemd timer. lego only renews when it is actually due:

~/go/bin/lego --email you@example.com --dns regfish \
  -d '*.example.com' -d example.com renew --days 30

Afterwards the web server has to pick up the new files, for example with systemctl reload nginx. How the files are wired in is covered under nginx and Apache.

When certbro is the better fit

lego is a general ACME client that uses regfish as its DNS provider. certbro is the regfish tool and additionally covers the paid certificates including OV validation, which ACME does not offer. For plain Let’s Encrypt certificates either way works.