### Complete Production Example with AWS Integration

Source: https://context7.com/vancluever/terraform-provider-acme/llms.txt

This comprehensive example illustrates a production-ready Terraform configuration using the ACME provider to obtain a certificate and deploy it to AWS Certificate Manager (ACM). It includes provider configurations for ACME and AWS, ACME account registration, certificate resource, ACM import, and ALB listener configuration.

```hcl
terraform {
  required_providers {
    acme = {
      source  = "vancluever/acme"
      version = "~> 2.0"
    }
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
}

provider "acme" {
  server_url = "https://acme-v02.api.letsencrypt.org/directory"
}

provider "aws" {
  region = "us-east-1"
}

# ACME Account
resource "acme_registration" "reg" {
  account_key_algorithm   = "ECDSA"
  account_key_ecdsa_curve = "P384"
}

# Certificate with wildcard
resource "acme_certificate" "cert" {
  account_key_pem           = acme_registration.reg.account_key_pem
  common_name               = "example.com"
  subject_alternative_names = ["*.example.com"]

  key_type           = "P384"
  min_days_remaining = 30

  dns_challenge {
    provider = "route53"
  }
}

# Import to AWS Certificate Manager
resource "aws_acm_certificate" "cert" {
  private_key       = acme_certificate.cert.private_key_pem
  certificate_body  = acme_certificate.cert.certificate_pem
  certificate_chain = acme_certificate.cert.issuer_pem

  lifecycle {
    create_before_destroy = true
  }
}

# Use with Application Load Balancer
resource "aws_lb_listener" "https" {
  load_balancer_arn = aws_lb.main.arn
  port              = "443"
  protocol          = "HTTPS"
  ssl_policy        = "ELBSecurityPolicy-TLS13-1-2-2021-06"
  certificate_arn   = aws_acm_certificate.cert.arn

  default_action {
    type             = "forward"
    target_group_arn = aws_lb_target_group.main.arn
  }
}

output "certificate_expiry" {
  value = acme_certificate.cert.certificate_not_after
}
```

--------------------------------

### Run lego CLI with Manual DNS Provider

Source: https://github.com/vancluever/terraform-provider-acme/blob/main/docs/guides/dns-providers-manual.md

This example demonstrates how to initiate the lego CLI with the 'manual' DNS provider. It uses the `--dns manual` flag and specifies a domain for certificate acquisition.

```bash
$ lego --dns manual -d example.com run
```

--------------------------------

### Create ACME Registration (Basic)

Source: https://github.com/vancluever/terraform-provider-acme/blob/main/docs/resources/registration.md

This example demonstrates the most basic usage of the acme_registration resource, where the private key for the account is managed automatically by the provider. It requires the ACME server URL to be configured.

```hcl
provider "acme" {
  server_url = "https://acme-staging-v02.api.letsencrypt.org/directory"
}

resource "acme_registration" "reg" {}
```

--------------------------------

### ACME Certificate Resource with Exec DNS Challenge (HCL)

Source: https://github.com/vancluever/terraform-provider-acme/blob/main/docs/guides/dns-providers-exec.md

Example of configuring the 'acme_certificate' resource to use the 'exec' DNS challenge provider. This snippet demonstrates the basic setup within a Terraform configuration.

```hcl
resource "acme_certificate" "certificate" {
  ...

  dns_challenge {
    provider = "exec"
  }
}
```

--------------------------------

### Retrieve CA Server URL with acme_server_url Data Source (HCL)

Source: https://github.com/vancluever/terraform-provider-acme/blob/main/docs/data-sources/server_url.md

This example demonstrates how to configure the Acme provider and then use the `acme_server_url` data source to retrieve the currently configured CA server URL. The retrieved URL is then outputted. This requires the Terraform Acme provider to be installed and configured.

```hcl
provider "acme" {
  server_url = "https://acme-staging-v02.api.letsencrypt.org/directory"
}

data "acme_server_url" "url" {}

output "server_url" {
  value = data.acme_server_url.url.server_url
}
```

--------------------------------

### Executing External DNS Update Script (Bash)

Source: https://github.com/vancluever/terraform-provider-acme/blob/main/docs/guides/dns-providers-exec.md

Demonstrates how to execute an external DNS update script using the 'lego' command-line tool with the 'exec' DNS provider. This example shows the environment variables and command structure for presenting a DNS record.

```bash
EXEC_PATH=./update-dns.sh \
lego --dns exec --d my.example.org run
```

--------------------------------

### Create ACME Registration with Pre-Existing Private Key

Source: https://github.com/vancluever/terraform-provider-acme/blob/main/docs/resources/registration.md

This example shows how to use a pre-existing private key with the acme_registration resource. The private key is generated using the tls_private_key resource and then passed to the account_key_pem argument. This requires the TLS provider to be configured.

```hcl
provider "acme" {
  server_url = "https://acme-staging-v02.api.letsencrypt.org/directory"
}

resource "tls_private_key" "private_key" {
  algorithm = "RSA"
}

resource "acme_registration" "reg" {
  account_key_pem = tls_private_key.private_key.private_key_pem
}
```

--------------------------------

### Exoscale DNS Challenge Configuration Example

Source: https://github.com/vancluever/terraform-provider-acme/blob/main/docs/guides/dns-providers-exoscale.md

This code snippet demonstrates how to configure the Exoscale DNS challenge provider within the `acme_certificate` resource in Terraform. It specifies 'exoscale' as the DNS provider.

```hcl
resource "acme_certificate" "certificate" {
  ...

  dns_challenge {
    provider = "exoscale"
  }
}
```

--------------------------------

### Configure allinkl DNS Challenge for acme_certificate

Source: https://github.com/vancluever/terraform-provider-acme/blob/main/docs/guides/dns-providers-allinkl.md

This example demonstrates how to configure the allinkl DNS challenge provider for the acme_certificate resource. It specifies 'allinkl' as the provider and can be extended with environment variables or a config block for authentication and timeouts.

```hcl
resource "acme_certificate" "certificate" {
  ...

  dns_challenge {
    provider = "allinkl"
  }
}
```

--------------------------------

### Configure Multiple DNS Providers for Domains

Source: https://context7.com/vancluever/terraform-provider-acme/llms.txt

Demonstrates how to use multiple DNS providers within a single certificate resource when domains are managed across different DNS services. This example shows Route 53, Google Cloud DNS, and Azure DNS.

```hcl
resource "acme_certificate" "certificate" {
  account_key_pem           = acme_registration.reg.account_key_pem
  common_name               = "www.example.com"
  subject_alternative_names = ["api.example.org", "cdn.example.net"]

  # Route 53 for example.com
  dns_challenge {
    provider = "route53"
  }

  # Google Cloud DNS for example.org
  dns_challenge {
    provider = "gcloud"

    config = {
      GCE_PROJECT = "my-project"
    }
  }

  # Azure DNS for example.net
  dns_challenge {
    provider = "azuredns"

    config = {
      AZURE_SUBSCRIPTION_ID = var.azure_subscription_id
      AZURE_RESOURCE_GROUP  = "dns-rg"
    }
  }
}
```

--------------------------------

### Infomaniak DNS Challenge Configuration Example (HCL)

Source: https://github.com/vancluever/terraform-provider-acme/blob/main/docs/guides/dns-providers-infomaniak.md

This snippet demonstrates how to configure the Infomaniak DNS challenge provider within the `acme_certificate` resource in Terraform. It specifies the provider name and can be extended with additional configuration arguments.

```hcl
resource "acme_certificate" "certificate" {
  ...

  dns_challenge {
    provider = "infomaniak"
  }
}
```

--------------------------------

### Configure NS1 DNS Challenge for acme_certificate

Source: https://github.com/vancluever/terraform-provider-acme/blob/main/docs/guides/dns-providers-ns1.md

Example of how to configure the NS1 DNS challenge provider within the acme_certificate resource block. This specifies 'ns1' as the provider for handling DNS challenges.

```hcl
resource "acme_certificate" "certificate" {
  ...

  dns_challenge {
    provider = "ns1"
  }
}
```

--------------------------------

### httpreq DNS Challenge Payload Formats

Source: https://github.com/vancluever/terraform-provider-acme/blob/main/docs/guides/dns-providers-httpreq.md

These JSON examples illustrate the different payload formats expected by the httpreq DNS challenge provider based on the HTTPREQ_MODE. The default mode expects 'fqdn' and 'value', while the 'RAW' mode expects 'domain', 'token', and 'keyAuth'.

```json
{
  "fqdn": "_acme-challenge.domain.",
  "value": "LHDhK3oGRvkiefQnx7OOczTY5Tic_xZ6HcMOc_gmtoM"
}
```

```json
{
  "domain": "domain",
  "token": "token",
  "keyAuth": "key"
}
```

--------------------------------

### Azure DNS Service Discovery Filter Example

Source: https://github.com/vancluever/terraform-provider-acme/blob/main/docs/guides/dns-providers-azuredns.md

Illustrates how to use the AZURE_SERVICEDISCOVERY_FILTER environment variable to refine the search for Azure DNS zones using a Kusto query. This is useful for limiting the scope of service discovery.

```hcl
resources
| where type =~ "microsoft.network/dnszones"
| ${AZURE_SERVICEDISCOVERY_FILTER}
| project subscriptionId, resourceGroup, name
```

--------------------------------

### Configure FusionLayer NameSurfer DNS Challenge

Source: https://github.com/vancluever/terraform-provider-acme/blob/main/docs/guides/dns-providers-namesurfer.md

This example demonstrates how to configure the FusionLayer NameSurfer DNS challenge provider for the `acme_certificate` resource in Terraform. It specifies the provider name and can be extended with additional configuration arguments.

```hcl
resource "acme_certificate" "certificate" {
  ...

  dns_challenge {
    provider = "namesurfer"
  }
}
```

--------------------------------

### ISPConfig DNS Challenge Configuration Example (HCL)

Source: https://github.com/vancluever/terraform-provider-acme/blob/main/docs/guides/dns-providers-ispconfig.md

This HCL code snippet demonstrates how to configure the ISPConfig DNS challenge provider within an acme_certificate resource block. It specifies the provider name and can be extended with additional configuration options.

```hcl
resource "acme_certificate" "certificate" {
  ...

  dns_challenge {
    provider = "ispconfig"
  }
}
```

--------------------------------

### Request TLS Certificates with DNS Challenge using Terraform

Source: https://context7.com/vancluever/terraform-provider-acme/llms.txt

Shows how to use the `acme_certificate` resource to request TLS certificates via DNS-01 challenges. This method supports wildcard certificates and does not require inbound network access. Examples include configuration for AWS Route 53 and wildcard certificate requests. Outputs provide certificate details like PEM, private key, and expiration date.

```hcl
# Complete example with AWS Route 53
provider "acme" {
  server_url = "https://acme-staging-v02.api.letsencrypt.org/directory"
}

resource "acme_registration" "reg" {}

resource "acme_certificate" "certificate" {
  account_key_pem           = acme_registration.reg.account_key_pem
  common_name               = "www.example.com"
  subject_alternative_names = ["www2.example.com", "blog.example.com"]

  dns_challenge {
    provider = "route53"

    config = {
      AWS_ACCESS_KEY_ID     = var.aws_access_key
      AWS_SECRET_ACCESS_KEY = var.aws_secret_key
      AWS_DEFAULT_REGION    = "us-east-1"
    }
  }
}

# Wildcard certificate example
resource "acme_certificate" "wildcard" {
  account_key_pem           = acme_registration.reg.account_key_pem
  common_name               = "*.example.com"
  subject_alternative_names = ["example.com"]

  dns_challenge {
    provider = "route53"
  }
}

# Output certificate details
output "certificate_pem" {
  value     = acme_certificate.certificate.certificate_pem
  sensitive = true
}

output "private_key_pem" {
  value     = acme_certificate.certificate.private_key_pem
  sensitive = true
}

output "issuer_pem" {
  value     = acme_certificate.certificate.issuer_pem
  sensitive = true
}

output "certificate_url" {
  value = acme_certificate.certificate.certificate_url
}

output "certificate_not_after" {
  value = acme_certificate.certificate.certificate_not_after
}

# Full chain for web servers
output "full_chain_pem" {
  value     = "${acme_certificate.certificate.certificate_pem}${acme_certificate.certificate.issuer_pem}"
  sensitive = true
}
```

--------------------------------

### Configure Rackspace DNS Challenge - Terraform HCL

Source: https://github.com/vancluever/terraform-provider-acme/blob/main/docs/guides/dns-providers-rackspace.md

Example of how to configure the Rackspace DNS challenge provider within the acme_certificate resource in Terraform. This snippet demonstrates the basic structure for setting up a DNS challenge.

```hcl
resource "acme_certificate" "certificate" {
  ...

  dns_challenge {
    provider = "rackspace"
  }
}
```

--------------------------------

### Format SELFHOSTDE_RECORDS_MAPPING for SelfHost.(de|eu) DNS Challenge

Source: https://github.com/vancluever/terraform-provider-acme/blob/main/docs/guides/dns-providers-selfhostde.md

This example shows the correct format for the SELFHOSTDE_RECORDS_MAPPING environment variable, which is required when using the SelfHost.(de|eu) DNS challenge provider. It maps domains to their corresponding TXT record IDs.

```text
SELFHOSTDE_RECORDS_MAPPING=my.example.com:123:456,other.example.com:789
```

--------------------------------

### Sakura Cloud DNS Challenge Configuration Example (HCL)

Source: https://github.com/vancluever/terraform-provider-acme/blob/main/docs/guides/dns-providers-sakuracloud.md

This HCL code snippet demonstrates how to configure the Sakura Cloud DNS challenge provider within the acme_certificate resource in Terraform. It specifies the provider name and can include additional DNS challenge configurations.

```hcl
resource "acme_certificate" "certificate" {
  ...

  dns_challenge {
    provider = "sakuracloud"
  }
}
```

--------------------------------

### Configure ACME DNS Challenge with File-Based Credentials

Source: https://github.com/vancluever/terraform-provider-acme/blob/main/docs/resources/certificate.md

This example demonstrates configuring the ACME provider for Route53 DNS challenges using file paths for AWS credentials. This approach is useful for managing secrets in local files instead of directly in the configuration or environment.

```hcl
resource "acme_certificate" "certificate" {
  #...

  dns_challenge {
    provider = "route53"

    config = {
      AWS_ACCESS_KEY_ID_FILE     = "/data/secrets/aws_access_key_id"
      AWS_SECRET_ACCESS_KEY_FILE = "/data/secrets/aws_secret_access_key"
      AWS_DEFAULT_REGION         = "us-east-1"
    }
  }

  #...
}
```

--------------------------------

### Infoblox DNS Challenge Configuration Example

Source: https://github.com/vancluever/terraform-provider-acme/blob/main/docs/guides/dns-providers-infoblox.md

This HCL code snippet demonstrates how to configure the Infoblox DNS challenge provider within the `acme_certificate` resource in Terraform. It specifies the provider name as 'infoblox' for the DNS challenge.

```hcl
resource "acme_certificate" "certificate" {
  ...

  dns_challenge {
    provider = "infoblox"
  }
}
```

--------------------------------

### Timeweb Cloud DNS Challenge Configuration Example (HCL)

Source: https://github.com/vancluever/terraform-provider-acme/blob/main/docs/guides/dns-providers-timewebcloud.md

This HCL code snippet demonstrates how to configure the Timeweb Cloud DNS challenge provider within an acme_certificate resource. It specifies 'timewebcloud' as the DNS provider for certificate challenges.

```hcl
resource "acme_certificate" "certificate" {
  ...

  dns_challenge {
    provider = "timewebcloud"
  }
}
```

--------------------------------

### Create ACME Certificate with External CSR (Terraform)

Source: https://github.com/vancluever/terraform-provider-acme/blob/main/docs/resources/certificate.md

This example shows how to create an ACME certificate using an external Certificate Signing Request (CSR) generated by the `tls_cert_request` resource. It requires separate `acme_registration` and `tls_private_key` resources. The generated CSR's PEM-encoded content is passed to the `certificate_request_pem` argument of the `acme_certificate` resource.

```hcl
provider "acme" {
  server_url = "https://acme-staging-v02.api.letsencrypt.org/directory"
}

resource "acme_registration" "reg" {
  email_address   = "nobody@example.com"
}

resource "tls_private_key" "cert_private_key" {
  algorithm = "RSA"
}

resource "tls_cert_request" "req" {
  key_algorithm   = "RSA"
  private_key_pem = tls_private_key.cert_private_key.private_key_pem
  dns_names       = ["www.example.com", "www2.example.com"]

  subject {
    common_name = "www.example.com"
  }
}

resource "acme_certificate" "certificate" {
  account_key_pem         = acme_registration.reg.account_key_pem
  certificate_request_pem = tls_cert_request.req.cert_request_pem

  dns_challenge {
    provider = "route53"
  }
}
```

--------------------------------

### Manual DNS Challenge TXT Record Instructions

Source: https://github.com/vancluever/terraform-provider-acme/blob/main/docs/guides/dns-providers-manual.md

This output from the lego CLI provides instructions for manually creating a TXT record required for the DNS-01 challenge. It specifies the hostname and the TXT record value that needs to be added to the DNS zone.

```text
lego: Please create the following TXT record in your example.com. zone:
_acme-challenge.example.com. 120 IN TXT "hX0dPkG6Gfs9hUvBAchQclkyyoEKbShbpvJ9mY5q2JQ"
lego: Press 'Enter' when you are done
```

--------------------------------

### Terraform ACME Provider Configuration and Certificate Issuance

Source: https://github.com/vancluever/terraform-provider-acme/blob/main/docs/index.md

This example demonstrates how to configure the ACME provider in Terraform, register an ACME account, and request a certificate using DNS validation with Amazon Route 53. It requires the ACME provider to be installed and AWS credentials to be available in the environment.

```hcl
terraform {
  required_providers {
    acme = {
      source  = "vancluever/acme"
      version = "~> 2.0"
    }
  }
}

provider "acme" {
  server_url = "https://acme-staging-v02.api.letsencrypt.org/directory"
}

resource "acme_registration" "reg" {
  email_address   = "nobody@example.com"
}

resource "acme_certificate" "certificate" {
  account_key_pem           = acme_registration.reg.account_key_pem
  common_name               = "www.example.com"
  subject_alternative_names = ["www2.example.com"]

  dns_challenge {
    provider = "route53"
  }
}
```

--------------------------------

### Exec DNS Challenge Command Structure (Shell)

Source: https://github.com/vancluever/terraform-provider-acme/blob/main/docs/guides/dns-providers-exec.md

Outlines the command structures for the 'exec' DNS challenge provider, differentiating between the default mode and the 'RAW' mode for both 'present' and 'cleanup' actions.

```shell
# Default Mode
myprogram present <FQDN> <record>
myprogram cleanup <FQDN> <record>

# RAW Mode
myprogram present -- <domain> <token> <key_auth>
myprogram cleanup -- <domain> <token> <key_auth>
```

--------------------------------

### Manage ACME Account Registration with Terraform

Source: https://context7.com/vancluever/terraform-provider-acme/llms.txt

Demonstrates the `acme_registration` resource for creating and managing ACME accounts. It shows how to auto-generate account keys, use custom key algorithms (ECDSA), provide external keys, and configure external account binding for commercial CAs. Outputs include the account key PEM and registration URL.

```hcl
# Basic registration with auto-generated key
resource "acme_registration" "reg" {}

# Registration with custom key settings
resource "acme_registration" "reg_custom" {
  account_key_algorithm  = "ECDSA"
  account_key_ecdsa_curve = "P384"
}

# Registration with externally provided key
resource "tls_private_key" "private_key" {
  algorithm = "RSA"
  rsa_bits  = 4096
}

resource "acme_registration" "reg_external" {
  account_key_pem = tls_private_key.private_key.private_key_pem
}

# Registration with external account binding (for commercial CAs)
resource "acme_registration" "reg_eab" {
  external_account_binding {
    key_id      = "kid-1"
    hmac_base64 = "ZGlyZWN0bHlmcm9teW91cm1haW5mcmFtZQ=="
  }
}

# Outputs
output "account_key" {
  value     = acme_registration.reg.account_key_pem
  sensitive = true
}

output "registration_url" {
  value = acme_registration.reg.registration_url
}
```

--------------------------------

### Executing External DNS Update Script with RAW Mode (Bash)

Source: https://github.com/vancluever/terraform-provider-acme/blob/main/docs/guides/dns-providers-exec.md

Shows how to use the 'exec' DNS provider with the `EXEC_MODE=RAW` environment variable. This mode passes the domain, token, and key authentication values directly to the external script.

```bash
EXEC_MODE=RAW \
EXEC_PATH=./update-dns.sh \
lego --dns exec -d my.example.org run
```

--------------------------------

### ISPConfig DDNS Provider Configuration Example

Source: https://github.com/vancluever/terraform-provider-acme/blob/main/docs/guides/dns-providers-ispconfigddns.md

This HCL snippet demonstrates how to configure the ISPConfig DDNS provider within the `dns_challenge` block of the `acme_certificate` resource. It specifies 'ispconfigddns' as the provider name.

```hcl
resource "acme_certificate" "certificate" {
  ...

  dns_challenge {
    provider = "ispconfigddns"
  }
}
```

--------------------------------

### Calling External Program with RAW Mode Arguments (Bash)

Source: https://github.com/vancluever/terraform-provider-acme/blob/main/docs/guides/dns-providers-exec.md

Demonstrates the command-line arguments passed to the external DNS update script when `EXEC_MODE=RAW` is set. It includes the domain, token, and key authentication values, with '--' to handle potential flag conflicts.

```bash
./update-dns.sh "present" "--" "my.example.org." "some-token" "KxAy-J3NwUmg9ZQuM-gP_Mq1nStaYSaP9tYQs5_-YsE.ksT-qywTd8058G-SHHWA3RAN72Pr0yWtPYmmY5UBpQ8"
```

--------------------------------

### Name.com DNS Challenge Provider Configuration

Source: https://github.com/vancluever/terraform-provider-acme/blob/main/docs/guides/dns-providers-namedotcom.md

This section outlines the configuration arguments for the Name.com DNS challenge provider. These can be set via environment variables or within the `config` block of the `acme_certificate` resource.

```APIDOC
## Name.com DNS Challenge Provider Configuration

### Description
This provider allows you to use Name.com to solve DNS challenges for ACME certificates.

### Method
Not Applicable (Configuration arguments)

### Endpoint
Not Applicable (Configuration arguments)

### Parameters
#### Environment Variables / Config Block Arguments

- **NAMECOM_API_TOKEN** (string) - Required - API token for Name.com authentication.
- **NAMECOM_USERNAME** (string) - Required - Username for Name.com authentication.
- **NAMECOM_HTTP_TIMEOUT** (int) - Optional - API request timeout in seconds. Defaults to 10.
- **NAMECOM_POLLING_INTERVAL** (int) - Optional - Time in seconds between DNS propagation checks. Defaults to 20.
- **NAMECOM_PROPAGATION_TIMEOUT** (int) - Optional - Maximum waiting time for DNS propagation in seconds. Defaults to 900.
- **NAMECOM_TTL** (int) - Optional - The TTL of the TXT record used for the DNS challenge in seconds. Defaults to 300.

### Request Example
```hcl
resource "acme_certificate" "certificate" {
  domain = "example.com"
  dns_challenge {
    provider = "namedotcom"

    config {
      NAMECOM_USERNAME = "your_username"
      NAMECOM_API_TOKEN = "your_api_token"
    }
  }
}
```

### Response
#### Success Response (200)
Not Applicable (This is a configuration guide, not an API endpoint response).

#### Response Example
Not Applicable.
```

--------------------------------

### Terraform ACME Certificate with Azure DNS Challenge

Source: https://github.com/vancluever/terraform-provider-acme/blob/main/docs/guides/dns-providers-azuredns.md

Example of how to configure the acme_certificate resource to use the azuredns provider for DNS challenges. This snippet demonstrates the basic structure for setting up a certificate resource with a DNS challenge.

```hcl
resource "acme_certificate" "certificate" {
  ...

  dns_challenge {
    provider = "azuredns"
  }
}
```

--------------------------------

### Calling External Program for DNS Record Presentation (Bash)

Source: https://github.com/vancluever/terraform-provider-acme/blob/main/docs/guides/dns-providers-exec.md

Illustrates the command-line arguments passed to the external DNS update script when the 'exec' provider is used in its default mode. It shows the action, fully-qualified domain name, and the record value.

```bash
./update-dns.sh "present" "_acme-challenge.my.example.org." "MsijOYZxqyjGnFGwhjrhfg-Xgbl5r68WPda0J9EgqqI"
```

--------------------------------

### Configure Beget DNS Challenge for ACME Certificate (HCL)

Source: https://github.com/vancluever/terraform-provider-acme/blob/main/docs/guides/dns-providers-beget.md

This HCL code snippet demonstrates how to configure the Beget DNS challenge provider within the `acme_certificate` resource. It specifies 'beget' as the DNS provider for automated challenges.

```hcl
resource "acme_certificate" "certificate" {
  ...

  dns_challenge {
    provider = "beget"
  }
}
```

--------------------------------

### Configure TodayNIC DNS Challenge for acme_certificate

Source: https://github.com/vancluever/terraform-provider-acme/blob/main/docs/guides/dns-providers-todaynic.md

Example of how to configure the TodayNIC DNS challenge provider within the acme_certificate resource in Terraform. This snippet demonstrates setting the 'provider' argument to 'todaynic' within the 'dns_challenge' block.

```hcl
resource "acme_certificate" "certificate" {
  ...

  dns_challenge {
    provider = "todaynic"
  }
}
```

--------------------------------

### Configure Azure DNS Challenge with Credentials

Source: https://context7.com/vancluever/terraform-provider-acme/llms.txt

Sets up an Azure DNS challenge using various authentication methods, including client ID, secret, tenant ID, subscription ID, and resource group. It also supports using Terraform ARM aliases for configuration.

```hcl
resource "acme_certificate" "certificate" {
  account_key_pem = acme_registration.reg.account_key_pem
  common_name     = "www.example.com"

  dns_challenge {
    provider = "azuredns"

    config = {
      AZURE_CLIENT_ID       = var.azure_client_id
      AZURE_CLIENT_SECRET   = var.azure_client_secret
      AZURE_TENANT_ID       = var.azure_tenant_id
      AZURE_SUBSCRIPTION_ID = var.azure_subscription_id
      AZURE_RESOURCE_GROUP  = "my-dns-resource-group"
    }
  }
}

# Using Terraform ARM_ aliases
resource "acme_certificate" "certificate_arm" {
  account_key_pem = acme_registration.reg.account_key_pem
  common_name     = "www.example.com"

  dns_challenge {
    provider = "azuredns"

    config = {
      ARM_CLIENT_ID       = var.azure_client_id
      ARM_CLIENT_SECRET   = var.azure_client_secret
      ARM_TENANT_ID       = var.azure_tenant_id
      ARM_SUBSCRIPTION_ID = var.azure_subscription_id
      ARM_RESOURCE_GROUP  = "my-dns-resource-group"
    }
  }
}
```

--------------------------------

### Generate Sonic API Key and User ID (Bash)

Source: https://github.com/vancluever/terraform-provider-acme/blob/main/docs/guides/dns-providers-sonic.md

This bash script demonstrates how to generate API keys and user IDs for Sonic DNS management by making a POST request to the 'dyndns/api_key' endpoint. It requires username, password, and hostname as input.

```bash
$ curl -X POST -H "Content-Type: application/json" --data '{"username":"notarealuser","password":"notarealpassword","hostname":"example.com"}' https://public-api.sonic.net/dyndns/api_key
{"userid":"12345","apikey":"4d6fbf2f9ab0fa11697470918d37625851fc0c51","result":200,"message":"OK"}
```

--------------------------------

### ConoHa DNS Challenge Configuration Example (HCL)

Source: https://github.com/vancluever/terraform-provider-acme/blob/main/docs/guides/dns-providers-conoha.md

This HCL code snippet demonstrates how to configure the ConoHa DNS challenge provider for the acme_certificate resource in Terraform. It specifies the provider name and the dns_challenge block.

```hcl
resource "acme_certificate" "certificate" {
  ...

  dns_challenge {
    provider = "conoha"
  }
}
```

--------------------------------

### Configure Cloudflare DNS Challenge with API Tokens

Source: https://context7.com/vancluever/terraform-provider-acme/llms.txt

Sets up a DNS challenge using Cloudflare. Requires API tokens for DNS editing and optionally for zone reading. Can also use environment variables CF_DNS_API_TOKEN and CF_ZONE_API_TOKEN.

```hcl
resource "acme_certificate" "certificate" {
  account_key_pem = acme_registration.reg.account_key_pem
  common_name     = "www.example.com"

  dns_challenge {
    provider = "cloudflare"

    config = {
      CF_DNS_API_TOKEN  = var.cloudflare_api_token  # Token with DNS:Edit permission
      CF_ZONE_API_TOKEN = var.cloudflare_zone_token # Token with Zone:Read permission (optional)
    }
  }
}

# Using environment variables (alternative)
# Set CF_DNS_API_TOKEN and CF_ZONE_API_TOKEN in your environment
resource "acme_certificate" "certificate_env" {
  account_key_pem = acme_registration.reg.account_key_pem
  common_name     = "www.example.com"

  dns_challenge {
    provider = "cloudflare"
  }
}
```

--------------------------------

### Configure Terraform ACME Provider

Source: https://context7.com/vancluever/terraform-provider-acme/llms.txt

Configures the ACME provider for Terraform, specifying the ACME CA server URL. It includes examples for both Let's Encrypt staging (testing) and production environments. Ensure the correct version constraint is set for the provider.

```hcl
terraform {
  required_providers {
    acme = {
      source  = "vancluever/acme"
      version = "~> 2.0"
    }
  }
}

provider "acme" {
  server_url = "https://acme-staging-v02.api.letsencrypt.org/directory"
}

# For production, use:
# provider "acme" {
#   server_url = "https://acme-v02.api.letsencrypt.org/directory"
# }
```

--------------------------------

### Remove Manual DNS Challenge TXT Record

Source: https://github.com/vancluever/terraform-provider-acme/blob/main/docs/guides/dns-providers-manual.md

After successful validation, the lego CLI provides instructions to remove the previously created TXT record. This is a cleanup step to remove the challenge-related DNS record.

```text
lego: You can now remove this TXT record from your example.com. zone:
_acme-challenge.example.com. 120 IN TXT "hX0dPkG6Gfs9hUvBAchQclkyyoEKbShbpvJ9mY5q2JQ"
```

--------------------------------

### Configure Google Cloud DNS Challenge with Service Account

Source: https://context7.com/vancluever/terraform-provider-acme/llms.txt

Configures a DNS challenge using Google Cloud DNS with a service account file for authentication. Alternatively, it can use Application Default Credentials if the service account is configured in the environment.

```hcl
resource "acme_certificate" "certificate" {
  account_key_pem = acme_registration.reg.account_key_pem
  common_name     = "www.example.com"

  dns_challenge {
    provider = "gcloud"

    config = {
      GCE_PROJECT              = "my-gcp-project"
      GCE_SERVICE_ACCOUNT_FILE = "/path/to/service-account.json"
    }
  }
}

# Using Application Default Credentials
resource "acme_certificate" "certificate_adc" {
  account_key_pem = acme_registration.reg.account_key_pem
  common_name     = "www.example.com"

  dns_challenge {
    provider = "gcloud"

    config = {
      GCE_PROJECT = "my-gcp-project"
    }
  }
}
```

--------------------------------

### Configure webnamesca DNS Challenge for ACME Certificate

Source: https://github.com/vancluever/terraform-provider-acme/blob/main/docs/guides/dns-providers-webnamesca.md

This HCL snippet demonstrates how to configure the webnamesca DNS challenge provider within an acme_certificate resource. It specifies the provider name and can be extended with additional configuration options.

```hcl
resource "acme_certificate" "certificate" {
  ...

  dns_challenge {
    provider = "webnamesca"
  }
}
```

--------------------------------

### Configure freemyip DNS Challenge for acme_certificate

Source: https://github.com/vancluever/terraform-provider-acme/blob/main/docs/guides/dns-providers-freemyip.md

This HCL snippet demonstrates how to configure the freemyip DNS challenge provider for the acme_certificate resource. It specifies the provider name and can include additional configuration within the dns_challenge block.

```hcl
resource "acme_certificate" "certificate" {
  ...

  dns_challenge {
    provider = "freemyip"
  }
}
```

--------------------------------

### Configure Autodns DNS Challenge for acme_certificate

Source: https://github.com/vancluever/terraform-provider-acme/blob/main/docs/guides/dns-providers-autodns.md

This HCL code snippet demonstrates how to configure the Autodns DNS challenge provider for the acme_certificate resource in Terraform. It specifies 'autodns' as the provider for the dns_challenge block. This setup is essential for automating certificate issuance and renewal using Autodns for DNS record management.

```hcl
resource "acme_certificate" "certificate" {
  ...

  dns_challenge {
    provider = "autodns"
  }
}
```

--------------------------------

### Configure mijnhost DNS Challenge for ACME Certificate

Source: https://github.com/vancluever/terraform-provider-acme/blob/main/docs/guides/dns-providers-mijnhost.md

This snippet demonstrates how to configure the mijnhost DNS challenge provider within the `acme_certificate` resource. It specifies the provider name and can be extended with additional configuration arguments.

```hcl
resource "acme_certificate" "certificate" {
  ...

  dns_challenge {
    provider = "mijnhost"
  }
}
```

--------------------------------

### HTTP Request DNS Challenge Provider Configuration

Source: https://github.com/vancluever/terraform-provider-acme/blob/main/docs/guides/dns-providers-httpreq.md

Configuration details for the httpreq DNS challenge provider, including environment variables and authentication methods.

```APIDOC
## HTTP Request DNS Challenge Provider

### Description
The `httpreq` DNS challenge provider allows for DNS challenges using HTTP requests, compatible with the `acme_certificate` resource.

### Method
Not Applicable (Configuration)

### Endpoint
Not Applicable (Configuration)

### Parameters
#### Environment Variables / Config Block Arguments
- **HTTPREQ_ENDPOINT** (string) - Required - The URL of the server.
- **HTTPREQ_MODE** (string) - Optional - Can be `RAW` or default (none).
- **HTTPREQ_HTTP_TIMEOUT** (integer) - Optional - API request timeout in seconds (Default: 30).
- **HTTPREQ_PASSWORD** (string) - Optional - Basic authentication password.
- **HTTPREQ_POLLING_INTERVAL** (integer) - Optional - Time between DNS propagation check in seconds (Default: 2).
- **HTTPREQ_PROPAGATION_TIMEOUT** (integer) - Optional - Maximum waiting time for DNS propagation in seconds (Default: 60).
- **HTTPREQ_USERNAME** (string) - Optional - Basic authentication username.

### Request Example
```hcl
resource "acme_certificate" "certificate" {
  ... 

  dns_challenge {
    provider = "httpreq"
    config = {
      HTTPREQ_ENDPOINT = "http://your-httpreq-server.com"
      HTTPREQ_USERNAME = "user"
      HTTPREQ_PASSWORD = "password"
    }
  }
}
```

### Response
#### Success Response (200)
Not Applicable (Provider Configuration)

#### Response Example
Not Applicable (Provider Configuration)

### Server Requirements
The server must provide the following endpoints:
- `POST /present`
- `POST /cleanup`

### Mode Details
#### Default Mode
```json
{
  "fqdn": "_acme-challenge.domain.",
  "value": "LHDhK3oGRvkiefQnx7OOczTY5Tic_xZ6HcMOc_gmtoM"
}
```

#### RAW Mode
```json
{
  "domain": "domain",
  "token": "token",
  "keyAuth": "key"
}
```

### Authentication
Basic authentication is optional and can be configured using `HTTPREQ_USERNAME` and `HTTPREQ_PASSWORD`. Both must be set for basic authentication to be active.
```

--------------------------------

### Hurricane Electric DNS Provider Authentication Tokens

Source: https://github.com/vancluever/terraform-provider-acme/blob/main/docs/guides/dns-providers-hurricane.md

This snippet shows the format for providing authentication tokens to the Hurricane Electric DNS provider. It illustrates how to map domain names to their corresponding challenge tokens for API authentication.

```shell
HURRICANE_TOKENS=my.example.org:token1,demo.example.org:token2
```

```shell
HURRICANE_TOKENS=example.org:token
```

--------------------------------

### Generate HyperOne Passport File using H1 CLI

Source: https://github.com/vancluever/terraform-provider-acme/blob/main/docs/guides/dns-providers-hyperone.md

This shell command shows how to generate a passport file for the HyperOne CLI, which is required for authentication when using the HyperOne DNS challenge provider. It specifies the output file location.

```bash
h1 iam project sa credential generate --name my-passport --project <project ID> --sa <sa ID> --passport-output-file ~/.h1/passport.json
```

--------------------------------

### Octenium DNS Challenge Provider Configuration

Source: https://github.com/vancluever/terraform-provider-acme/blob/main/docs/guides/dns-providers-octenium.md

This section details the configuration arguments for the Octenium DNS challenge provider. These can be set via environment variables or within the `config` block of the `dns_challenge` argument in the `acme_certificate` resource.

```APIDOC
## Octenium DNS Challenge Provider Configuration

### Description

Configuration arguments for the Octenium DNS challenge provider. These can be set via environment variables or within the `config` block of the `dns_challenge` argument in the `acme_certificate` resource.

### Method

Not Applicable (Configuration arguments)

### Endpoint

Not Applicable (Configuration arguments)

### Parameters

#### Environment Variables / Config Block Arguments

- **OCTENIUM_API_KEY** (string) - Required - API key for Octenium.
- **OCTENIUM_HTTP_TIMEOUT** (int) - Optional - API request timeout in seconds. Defaults to 30.
- **OCTENIUM_POLLING_INTERVAL** (int) - Optional - Time between DNS propagation checks in seconds. Defaults to 2.
- **OCTENIUM_PROPAGATION_TIMEOUT** (int) - Optional - Maximum waiting time for DNS propagation in seconds. Defaults to 60.
- **OCTENIUM_TTL** (int) - Optional - The TTL of the TXT record used for the DNS challenge in seconds. Defaults to 120.

#### Using Variable Files

Arguments can also be stored in a local file, with the path supplied by supplying the argument with the `_FILE` suffix (e.g., `OCTENIUM_API_KEY_FILE`).

### Request Example

```hcl
resource "acme_certificate" "certificate" {
  domain = "example.com"
  dns_challenge {
    provider = "octenium"

    config {
      OCTENIUM_API_KEY = "your-api-key"
      OCTENIUM_HTTP_TIMEOUT = 60
    }
  }
}
```

### Response

This section describes the configuration parameters, not API responses.

#### Success Response (N/A)

N/A

#### Response Example (N/A)

N/A
```

--------------------------------

### Configure KeyHelp DNS Challenge for acme_certificate

Source: https://github.com/vancluever/terraform-provider-acme/blob/main/docs/guides/dns-providers-keyhelp.md

This snippet demonstrates how to configure the KeyHelp DNS challenge provider for the acme_certificate resource in Terraform. It specifies the provider name and can include additional configuration within the dns_challenge block.

```hcl
resource "acme_certificate" "certificate" {
  ...

  dns_challenge {
    provider = "keyhelp"
  }
}
```

--------------------------------

### Configure DigitalOcean DNS Challenge

Source: https://context7.com/vancluever/terraform-provider-acme/llms.txt

Enables a DNS challenge using DigitalOcean. This configuration requires a DigitalOcean API token for authentication.

```hcl
resource "acme_certificate" "certificate" {
  account_key_pem = acme_registration.reg.account_key_pem
  common_name     = "www.example.com"

  dns_challenge {
    provider = "digitalocean"

    config = {
      DO_AUTH_TOKEN = var.digitalocean_token
    }
  }
}
```

--------------------------------

### Shellrent DNS Challenge Configuration in Terraform

Source: https://github.com/vancluever/terraform-provider-acme/blob/main/docs/guides/dns-providers-shellrent.md

This HCL code snippet demonstrates how to configure the Shellrent DNS challenge provider within the `acme_certificate` resource in Terraform. It specifies the provider name and can be extended with other configuration options.

```hcl
resource "acme_certificate" "certificate" {
  ...

  dns_challenge {
    provider = "shellrent"
  }
}
```

--------------------------------

### Configure Manual DNS Challenge in Terraform

Source: https://github.com/vancluever/terraform-provider-acme/blob/main/docs/guides/dns-providers-manual.md

This snippet shows how to configure the 'manual' DNS challenge provider within the `acme_certificate` resource in Terraform. It specifies the 'manual' provider for the `dns_challenge` block.

```hcl
resource "acme_certificate" "certificate" {
  ...

  dns_challenge {
    provider = "manual"
  }
}
```

--------------------------------

### Configure Gandi Live DNS (v5) Provider for ACME Certificate

Source: https://github.com/vancluever/terraform-provider-acme/blob/main/docs/guides/dns-providers-gandiv5.md

This HCL code snippet demonstrates how to configure the `gandiv5` DNS challenge provider within the `acme_certificate` resource in Terraform. It specifies the provider to be used for DNS challenges.

```hcl
resource "acme_certificate" "certificate" {
  ...

  dns_challenge {
    provider = "gandiv5"
  }
}
```

--------------------------------

### Configure Selectel v2 DNS Challenge in Terraform

Source: https://github.com/vancluever/terraform-provider-acme/blob/main/docs/guides/dns-providers-selectelv2.md

This snippet demonstrates how to configure the Selectel v2 DNS challenge provider within the `acme_certificate` resource in Terraform. It specifies the provider name and can be extended with additional configuration arguments.

```hcl
resource "acme_certificate" "certificate" {
  ...

  dns_challenge {
    provider = "selectelv2"
  }
}
```

--------------------------------

### Create ACME Certificate with DNS Challenge (Terraform)

Source: https://github.com/vancluever/terraform-provider-acme/blob/main/docs/resources/certificate.md

This snippet demonstrates how to create an ACME certificate using the `acme_certificate` resource with a DNS challenge. It requires an `acme_registration` resource to be defined first, ensuring the account is created before the certificate. The `dns_challenge` block specifies the provider (e.g., 'route53') for domain validation.

```hcl
provider "acme" {
  server_url = "https://acme-staging-v02.api.letsencrypt.org/directory"
}

resource "acme_registration" "reg" {
  email_address   = "nobody@example.com"
}

resource "acme_certificate" "certificate" {
  account_key_pem           = acme_registration.reg.account_key_pem
  common_name               = "www.example.com"
  subject_alternative_names = ["www2.example.com"]

  dns_challenge {
    provider = "route53"
  }
}
```