A warning about Namecheap when using dynamic DNS, Let's Encrypt and DNS challenge reddit / selfhosted ---------------------------------------------------------------------- bem13 · 2023-11-26 17:14 TL;DR: You can't automate Let's Encrypt wildcard cert renewal with a dynamic IP when using Namecheap because you have to manually whitelist your IP to access the API. \--- I spent the better part of the weekend tinkering with getting a Let's Encrypt wildcard cert for my self-hosted stuff. I just wanted to be able to use a nice .eu domain and not have browsers or devices yell at me for having a cert issued by my internal CA. I use AdGuard Home as my DNS server and Nginx Proxy Manager (NPM from here on) as a reverse proxy. Everything is running in Docker containers on an RPi 4. My IP is dynamic and I've been using no-ip to keep track of it, but they don't have an API which Certbot could use to create a TXT record when doing a DNS challenge. So I went to Cloudflare since everyone and their dog seems to use them. Unfortunately, they don't offer .eu domains so I skipped this option. I spotted Namecheap in both my router's dynamic DNS list and Nginx Proxy Manager's DNS challenge list. I've purchased a domain from them before and had no problems, so I read up a little bit on the whole thing and everything seemed cool. They have a dynamic DNS service you can activate for your domain, so you can use a ddns client to update your IP with them. I bought my domain, set up the dynamic DNS part, created a CNAME record, then went to set up Certbot through NPM. Here's where the first kicker came. You need API access to be able to have Certbot create a TXT record and verify your domain through a DNS challenge. To get API access, you need to satisfy at least one of these requirements: * have at least 20 domains under your account; * have at least $50 on your account balance; * have at least $50 spent within the last 2 years. Okay, I thought, $50 kinda stings (yay, Eastern European wages) but I can top up my account with it and forget about renewing my domain for like 10 years, so it's not that bad. I did the top-up, activated my API access and here came the second kicker: you have to manually whitelist the IP address you're accessing the API from. So in the end you still have to keep an eye on your IP and potentially whitelist another IP every \~60 days, because NPM won't be able to access the API otherwise. Now I probably have to live with this setup for at least a year (if I want to keep my domain) or cut my losses, try to get my $50 back and move everything elsewhere, maybe Cloudlfare and a .com domain... I realize I could've done more research before committing myself financially, but even after reading all the docs I haven't seen the IP whitelist part mentioned anywhere, so I thought I'd warn others. ---------------------------------------------------------------------- jusepal · 2023-11-26 18:20 Nothing stopping you to decouple both registrar and dns hosting. Its like people doesn't realize it could be done. Wanting to use cloudflare dns doesn't mean you got to transfer your domain to them, just change nameserver of your domain at whatever registrar you use to cloudflare nameserver. ---------------------------------------------------------------------- lesigh · 2023-11-26 18:31 Change the domains nameservers to cloudflare, add eu domain in their dashboard. Ez ---------------------------------------------------------------------- bm401 · 2023-11-26 18:34 I have nginx with legltsencrypt on dynamic DNS from namecheap. Works flawlessly. I'm using certbot in standalone mode though, with the http01-acme-challenge. It may not work for you this method obviously doesn't support wildcard certificates. ---------------------------------------------------------------------- RedditSlayer2020 · 2023-11-26 18:37 You missed the 'wildcard' DNS part. ---------------------------------------------------------------------- RedditSlayer2020 · 2023-11-26 18:38 put your own locally hosted authorities DNS Server in the name cheap panel, Write 2 small scripts for the the LE wildcard DNS challenge. thank me later ---------------------------------------------------------------------- ElevenNotes · 2023-11-26 18:45 Not even a single like of code [needed](https://hub.docker.com/r/11notes/certbot) ---------------------------------------------------------------------- bm401 · 2023-11-26 18:45 I didn't miss it. It's just that OP didn't specify why he needs a wildcard certificate. This is a discussion, not an exam. Maybe I can change OPs thoughts about his requirement and save some money. ---------------------------------------------------------------------- bem13 · 2023-11-26 19:04 I need a wildcard cert because I'd like to access my internal services via subdomains using that cert. ---------------------------------------------------------------------- bem13 · 2023-11-26 19:15 Thank you so much! Yup, I actually didn't realize I didn't have to transfer my domain to Cloudflare and I could simply use their servers. I managed to add the domain to Cloudflare, changed the DNS servers to Cloudflare's servers on Namecheap's interface and successfully got a cert from LE using my Cloudflare API key, so I think it's good now? Just need to set up a ddns client since my router's client (OpenWRT) doesn't seem to support updating Cloudflare. Also, now I need to get my $50 back... ---------------------------------------------------------------------- amcco1 · 2023-11-26 19:23 Technically you don't have to use your router for updating DDNS, though it is the most reliable. [Here's](https://youtu.be/rI- XxnyWFnM?si=NlGcHdaT31ZMg8X_) a video doing it with a raspberry pi. There's also a guide somewhere to do it on Windows with a powershell script that runs as a service, but I don't remember where that guide is, you might be able to search for it and find if you want. ---------------------------------------------------------------------- bem13 · 2023-11-26 19:25 Thank you, I think I'm gonna go with [docker- ddns](https://github.com/linuxserver/docker-ddclient). ---------------------------------------------------------------------- geo38 · 2023-11-26 20:00 docker is the best piece of software I've come across in the past 10 years. ---------------------------------------------------------------------- bem13 · 2023-11-26 20:12 That kinda sounds like reinventing the wheel while also having to expose my internal DNS server to the world. I'd rather not script anything myself when NPM can already do what I want. ---------------------------------------------------------------------- cspotme2 · 2023-11-26 20:18 My let's encrypt renewed by itself okay via certbot using the manual txt entry I had set months ago in cloudflare and I'm on dynamic dns. I only realized it renewed because my vaultwarden cert was outdated because my app wouldn't connect. That's when I realized I need to set a cronjob for docker to restart the vw instance once a month. ---------------------------------------------------------------------- RedditSlayer2020 · 2023-11-26 20:20 why do you even ask then? Looks like you know the answer already. ---------------------------------------------------------------------- chin_waghing · 2023-11-26 20:22 I moved from namecheap to CF for a similar issue ---------------------------------------------------------------------- bem13 · 2023-11-26 20:25 Sorry if I came across as rude. I wanted the post to serve as a warning and kind of documentation for others on the same path, since Google brought me here a lot when researching information. ---------------------------------------------------------------------- RedditSlayer2020 · 2023-11-26 20:48 Apology accepted. Thank you for sharing your experience and help others to avoid mistakes ♥ ---------------------------------------------------------------------- ZaxLofful · 2023-11-26 20:54 I actually wrote a Stack Overflow answer about this! Its so awesome and it’s actually a good idea; just in case the registrar ever has temporary issues with uptime. ---------------------------------------------------------------------- F1DNA · 2023-11-26 22:17 I have namecheap DDNS with a wildcard cert being handled by nginx proxy manager. I haven't even looked at any of it in a few years. It just works. ---------------------------------------------------------------------- bem13 · 2023-11-26 23:07 I don't know how that's possible. Maybe it's a legacy thing? ---------------------------------------------------------------------- F1DNA · 2023-11-26 23:09 I mean, I guess I could go look at everything to find out but I set this up 2 or 3 years ago and haven't had to touch it since. ---------------------------------------------------------------------- bem13 · 2023-11-26 23:12 Nah, definitely don't mess up your setup because of me 🤣 I managed to settle on a setup that seemingly works now so it doesn't really matter either, but thanks for your input anyways. ---------------------------------------------------------------------- BillGoats · 2023-11-26 23:49 I highly recommend [timothyjmiller/cloudflare- ddns](https://github.com/timothymiller/cloudflare-ddns). ---------------------------------------------------------------------- isogoniccloverleaf · 2023-11-27 00:42 Yeah me too. OPs set up seems very complex. DDND on NC, add your records, then have your server update the IPs using the _dynamicdns.park-your-domain.com/update_ API when you get a new IP. Certbot cares not about your IP - should not be messing with your DNS records. ---------------------------------------------------------------------- whattteva · 2023-11-27 02:03 This is why I use Caddy server. I never have to think of certs anymore. It's so painless. ---------------------------------------------------------------------- lemtrees · 2023-12-11 21:28 I appreciate it, thank you. I'm encountering a wildcard cert issue with namecheap and was about to pay to transfer to cloudflare, and found this post. I'm currently reading through it to try to learn how to configure my cloudflare host entries, but learning other things as well. Thank you! ---------------------------------------------------------------------- bem13 · 2023-12-11 23:15 You're welcome, glad to help! Yeah, there really isn't much concise information on this I think. Tell me if you want to see my settings, maybe they can be helpful. ---------------------------------------------------------------------- lemtrees · 2023-12-12 21:25 I think I sorted it out, thank you! For anyone in the future who finds this, I ended up using Cosmos (https://github.com/azukaar/Cosmos-Server/) for my reverse proxy. My domain is registered at Namecheap, but I set up an account at cloudflare and use them for my DNS, pointing namecheap at cloudflare's DNS servers (per instructions provided by namecheap). At cloudflare, I have three DNS records, Type A, www, @, *. All point to my IP address, and are updated via dynamic DNS using DDClient. As for DDClient, I ended up needing to use a cronjob to run it every 5 minutes as I couldn't get the daemon to work. My /etc/ddclient/ddclient.conf looks like this: > daemon=300 # check every 300 seconds > syslog=yes # log update msgs to syslog > pid=/var/run/ddclient.pid # record PID in file > ssl=yes # use TLS > use=web # get IP with website below > web='https://cloudflare.com/cdn-cgi/trace' > web-skip='ip=' # IP address above is after 'ip=' > protocol=cloudflare, \ > zone=mydomain.com, \ > ttl=1, > password='myactualAPIpassword', > *,www ---------------------------------------------------------------------- bem13 · 2023-12-12 23:02 Good job and thanks for sharing your solution! Yeah, my setup is pretty similar, except I use Nginx Proxy Manager, different types of DNS records and that I run ddclient in Docker. My config for ddclient is this: #How offten to check ip address daemon=1800 #Tell ddclient to get real ip address use=web web='https://cloudflare.com/cdn-cgi/trace' web-skip='ip=' # IP address above is after 'ip=' ssl=yes protocol=cloudflare, \ zone=mydomain.eu, \ ttl=1, \ login=token, \ password=mypassword \ mydomain.eu We must've "borrowed" the config from the same place based on some comments in it 😁 ---------------------------------------------------------------------- lemtrees · 2023-12-12 23:14 It does look familiar! In my adventures in setting this up, I feel like half of my final working solutions are because of some random post on Reddit or elsewhere, so I'm doing my best to leave solutions for other people in the future. It's good to be good internet people :) ---------------------------------------------------------------------- _shir_ · 2023-12-13 12:57 I wish I found this post before meeting the same issue. But comments are very useful.