This guide explains how to generate and automatically renew a wildcard certificate via a DNS challenge using Certbot and the dns-infomaniak plugin.

1. Installing the required tools

The Infomaniak DNS plugin is not included by default. To avoid the error plugin does not appear to be installed, install certbot and its extension by following the official instructions.

Make sure to select the Wildcard tab on the Certbot website after choosing your system.

2. Initial Manual Generation

Run this command to start the first certificate generation:

certbot certonly --manual \
-d *.example.com \
--preferred-challenges dns-01 \
--server {{URL_1}}

3. DNS Challenge Validation (TXT Record)

To prove that you own the domain, go to your Infomaniak Manager and create the following TXT record:

• Name: _acme-challenge
• Value: (the one provided by the Certbot command)

4. Preparing the Infomaniak API

To automate the process, generate an API token with the domain scope in your management interface. This token will allow the script to automatically update your DNS.

5. Authentication script (infomaniak-auth.sh)

Create the /root/infomaniak-auth.sh file. This script will be called by Certbot during renewal:

#!/bin/bash
# API Token for Infomaniak
INFOMANIAK_API_TOKEN="YOUR_API_TOKEN_HERE"
# Update DNS record via Infomaniak API plugin
/usr/bin/certbot \
  --authenticator dns-infomaniak \
  --server {{URL_5}} \
  -d "$CERTBOT_DOMAIN" \
  --agree-tos

Make the script executable:

chmod +x /root/infomaniak-auth.sh

6. Cleanup script (infomaniak-clean.sh)

Create the /root/infomaniak-clean.sh file to complete the procedure:

#!/bin/bash
# Optional: Cleanup operations after challenge
exit 0

Make the script executable:

chmod +x /root/infomaniak-clean.sh

7. Configuring automatic renewal

Edit or create the following configuration file: /etc/letsencrypt/renewal/example.com.conf.

cert = /etc/letsencrypt/live/example.com/cert.pem
privkey = /etc/letsencrypt/live/example.com/privkey.pem
chain = /etc/letsencrypt/live/example.com/chain.pem
fullchain = /etc/letsencrypt/live/example.com/fullchain.pem
[renewalparams]
authenticator = manual
manual_auth_hook = /root/infomaniak-auth.sh
manual_cleanup_hook = /root/infomaniak-clean.sh
server = {{URL_6}}
pref_challs = dns-01
account = YOUR_ACCOUNT_ID
key_type = rsa

8. Testing and Automation (Cron)

Before automating, verify that everything is working correctly with a simulation:

certbot renew --dry-run

If the test is successful, add this Cron task to check for renewal every X days:

0 0 */30 * * /usr/bin/certbot renew --quiet --config /etc/letsencrypt/renewal/example.com.conf

Modify 30 days above according to the desired frequency. The cron will automatically use:

• the domain.tld.conf file
• the infomaniak-auth.sh authentication script
• the dns-infomaniak plugin