Automatically issue/renew HTTPS certificates using Alibaba Cloud ESA DNS + acme.sh (including wildcard *.example.com + example.com), with optional installati...
This skill combines acme.sh + ESA DNS into a single integrated flow, not split into two skills.
Reasons:
If there is significant demand for "DNS-only operations" in the future, a separate
esa-dns-recordshelper skill can be extracted.
Trigger when any of the following apply:
*.atrustdns.com (ESA-hosted DNS)No TXT record found at _acme-challenge...example.com + *.example.com togetherInstall acme.sh from the official project before using this skill, and review the installation method you choose instead of piping remote scripts directly to a shell:
This skill expects acme.sh to be available on PATH. The script also falls back to ~/.acme.sh/acme.sh if present.
Requirements:
ALIYUN_AK / ALIYUN_SK or ALIBABACLOUD_ACCESS_KEY_ID / ALIBABACLOUD_ACCESS_KEY_SECRETALIYUN_SECURITY_TOKEN, ALIBABACLOUD_SECURITY_TOKEN, or --sts-tokenid / secret / token values without env names, treat them as generic Alibaba Cloud AccessKeyId / AccessKeySecret / SecurityToken and pass them to --ak / --sk / --sts-token. Do not block on whether the user said Aliyun or Alibaba Cloud; let the script auto-detect the ESA region/site.Script path: scripts/esa_acme_issue.py
Default behavior (optimized):
--install-cert--dns-timeout defaults to 600 seconds--ensure-a-record host=ip (with authoritative NS propagation check)--confirm-overwrite is passed--lang selects output language (default: en; available languages auto-discovered from scripts/i18n/)--install-cert is used, run on a controlled Linux host with permission to write the target cert paths and reload Nginxexport ALIYUN_AK='YOUR_AK'
export ALIYUN_SK='YOUR_SK'
export ALIYUN_SECURITY_TOKEN='YOUR_STS_TOKEN' # optional but recommended
python3 scripts/esa_acme_issue.py \
-d test.example.com
Equivalent Alibaba Cloud env names are also accepted:
export ALIBABACLOUD_ACCESS_KEY_ID='YOUR_AK'
export ALIBABACLOUD_ACCESS_KEY_SECRET='YOUR_SK'
export ALIBABACLOUD_SECURITY_TOKEN='YOUR_STS_TOKEN' # optional
export ALIYUN_AK='YOUR_AK'
export ALIYUN_SK='YOUR_SK'
python3 scripts/esa_acme_issue.py \
-d example.com \
-d '*.example.com'
python3 scripts/esa_acme_issue.py \
-d '*.example.com'
ssl_certificate /etc/nginx/ssl/example.com.crt;
ssl_certificate_key /etc/nginx/ssl/example.com.key;
Before reporting "record created / DNS ready", both conditions must be met:
ListRecords returns the target RecordName + Type + Value;dig @ns TXT returns the expected token.If only the CreateRecord API returned success (RequestId/RecordId only) without passing both checks above, report "request accepted", not "completed".
InvalidRecordNameSuffix
No TXT record found at _acme-challenge...
--dns-timeout to 300–600.Permission / signature errors after setting AccessKey IP whitelist
curl -s ifconfig.meBefore each execution, remind the user:
ZIP package — ready to use