{"id":24199334,"url":"https://github.com/nixigaj/cf-tlsa-acmesh","last_synced_at":"2025-09-21T23:31:43.940Z","repository":{"id":219385913,"uuid":"729963734","full_name":"nixigaj/cf-tlsa-acmesh","owner":"nixigaj","description":"A simple Go program that lets you automate the updating of TLSA DNS records with the Cloudflare v4 API from acme.sh generated keys, including a rollover (next) key.","archived":false,"fork":false,"pushed_at":"2024-04-11T10:32:36.000Z","size":8,"stargazers_count":11,"open_issues_count":0,"forks_count":1,"subscribers_count":1,"default_branch":"master","last_synced_at":"2024-04-11T11:27:31.565Z","etag":null,"topics":["acme-sh","automation","cloudflare","dane","dns","email","go","golang","rollover","tlsa"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/nixigaj.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null}},"created_at":"2023-12-10T22:00:33.000Z","updated_at":"2024-04-11T11:27:32.013Z","dependencies_parsed_at":null,"dependency_job_id":"3298b35b-6951-4f41-ac7c-95575ff1fd0a","html_url":"https://github.com/nixigaj/cf-tlsa-acmesh","commit_stats":null,"previous_names":["nixigaj/cf-tlsa-acmesh"],"tags_count":2,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nixigaj%2Fcf-tlsa-acmesh","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nixigaj%2Fcf-tlsa-acmesh/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nixigaj%2Fcf-tlsa-acmesh/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nixigaj%2Fcf-tlsa-acmesh/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/nixigaj","download_url":"https://codeload.github.com/nixigaj/cf-tlsa-acmesh/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":233806648,"owners_count":18733228,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["acme-sh","automation","cloudflare","dane","dns","email","go","golang","rollover","tlsa"],"created_at":"2025-01-13T20:35:45.117Z","updated_at":"2025-09-21T23:31:38.647Z","avatar_url":"https://github.com/nixigaj.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# cf-tlsa-acmesh\n\nThis is a simple Go program that lets you automate the updating of TLSA DNS records with the Cloudflare v4 API from [acme.sh](https://github.com/acmesh-official/acme.sh) generated keys, including the rollover (next) key generated by passing `--force-new-domain-key` to `acme.sh`. This is useful for configuring [DANE](https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Named_Entities) when setting up an SMTP server.\n\nI use this together with the [Maddy Mail Server](https://maddy.email/) to self-host my email with good deliverability.\n\n\u003e **NOTE:** This program is hardcoded to use port 25 and TCP as the protocol for the record name, but this can easily be changed by modifying the `port` and `protocol` variable in the source code.\n\n## Usage\n\n### Installation\n\n#### Linux x86-64\nThis requires curl.\n\nRun this command with elevated privileges (for example, with the help of Sudo):\n```shell\nsudo sh -c 'curl -LJ https://github.com/nixigaj/cf-tlsa-acmesh/releases/latest/download/cf-tlsa-acmesh-x86-64 -o /usr/local/bin/cf-tlsa-acmesh \u0026\u0026 chmod +x /usr/local/bin/cf-tlsa-acmesh'\n```\n\n#### Linux arm64\nThis requires curl.\n\nRun this command with elevated privileges (for example, with the help of Sudo):\n```shell\nsudo sh -c 'curl -LJ https://github.com/nixigaj/cf-tlsa-acmesh/releases/latest/download/cf-tlsa-acmesh-arm64 -o /usr/local/bin/cf-tlsa-acmesh \u0026\u0026 chmod +x /usr/local/bin/cf-tlsa-acmesh'\n```\n\n#### Other UNIX-like systems\nThis requires Git and Go.\n\n```shell\ngit clone https://github.com/nixigaj/cf-tlsa-acmesh\ncd cf-tlsa-acmesh\ngo build -ldflags=\"-s -w\" -o cf-tlsa-acmesh\n```\n\nInstall the generated executable by copying it to `/usr/local/bin/cf-tlsa-acmesh` (this requires elevated privileges).\n\n```shell\ncp ./cf-tlsa-acmesh /usr/local/bin/cf-tlsa-acmesh\n```\n\n### Example setup with acme.sh\n\n1. Go to Cloudflare and obtain your zone ID for the domain. Generate a user API token with the Zone.DNS permissions.\n\n2. Create a short shell script for the acme.sh `--reloadcmd` parameter, such as `~/.acme.sh/scripts/reloadcmd-mx1-example-com.sh`, and set the necessary environment variables:\n\n\t```shell\n\t#!/bin/sh\n\n\t# Set environment variables\n\texport KEY_FILE=~/.acme.sh/mx1.example.com_ecc/mx1.example.com.key\n\texport KEY_FILE_NEXT=~/.acme.sh/mx1.example.com_ecc/mx1.example.com.key.next\n\texport ZONE_ID=\u003cZONE_ID\u003e\n\texport API_TOKEN=\u003cAPI_TOKEN\u003e\n\texport DOMAIN=mx1.example.com\n\n\t# Execute the command\n\t/usr/local/bin/cf-tlsa-acmesh\n\t```\n\n3. Issue an acme.sh certificate with the following command:\n\n\t```shell\n\tenv \\\n\tCF_Token=\u003cTOKEN\u003e \\\n\tCF_Account_ID=\u003cACCOUNT_ID\u003e \\\n\tCF_Zone_ID=\u003cZONE_ID\u003e \\\n\t~/.acme.sh/acme.sh \\\n\t--issue \\\n\t--server letsencrypt \\\n\t--force \\\n\t--always-force-new-domain-key \\\n\t--dns dns_cf \\\n\t--reloadcmd '/bin/sh ~/.acme.sh/scripts/reloadcmd-mx1-example-com.sh' \\\n\t-d mx1.example.com\n\t```\n\n\tEnsure that you include `--always-force-new-domain-key` to generate a rollover (next) key. Confirm that the `--reloadcmd` parameter points to the correct script.\n\n4. Run the `~/.acme.sh/scripts/reloadcmd-mx1-example-com.sh` script manually once to generate the initial DNS records and verify that everything works. You can run the script multiple times; it only updates DNS records when necessary and is self-healing provided the `ZONE_ID`, `API_TOKEN` and `DOMAIN` environment variables are set correctly.\n\n5. For testing, use [Internet.nl's email test](https://internet.nl/test-mail/) to ensure that DANE and its rollover scheme are set up correctly, as you can see below.\n\n\t![Screenshot from Internet.nl](https://nixigaj.github.io/media/cf-tlsa-acmesh/internet-nl-screenshot.png)\n\n## License\nAll files in this repository are licensed under the [MIT License](LICENSE).\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnixigaj%2Fcf-tlsa-acmesh","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fnixigaj%2Fcf-tlsa-acmesh","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnixigaj%2Fcf-tlsa-acmesh/lists"}