> ## Documentation Index
> Fetch the complete documentation index at: https://docs.preprod.world/llms.txt
> Use this file to discover all available pages before exploring further.

# Get a Let's Encrypt certificate with Certbot

The `certbot-dns-gcore` plugin automates Let's Encrypt certificate issuance and renewal using the Gcore DNS API. To confirm domain ownership, it uses a [DNS-01 challenge](https://letsencrypt.org/docs/challenge-types): a TXT record with a specific value must be present under the domain name. The plugin creates and removes these TXT records automatically when obtaining, renewing, or revoking certificates.

<Note>
  The domain must be delegated to Gcore nameservers (`ns1.gcorelabs.net` and `ns2.gcdn.services`), and a Gcore account is required.
</Note>

## Install the Certbot plugin

<Info>
  All steps run in a terminal on the Linux server where Certbot will be installed. Connect to it via SSH before starting. The commands below apply to Ubuntu 22.04; other Linux distributions may require different package names.
</Info>

<Steps>
  <Step title="Update package lists">
    ```sh theme={null}
    sudo apt update
    ```
  </Step>

  <Step title="Install pip3 and the venv module">
    ```sh theme={null}
    sudo apt install python3-pip python3-venv
    ```
  </Step>

  <Step title="Create and activate a virtual environment">
    Ubuntu 22.04 and later restrict direct pip installations into the system Python. A virtual environment avoids this restriction:

    ```sh theme={null}
    python3 -m venv ~/certbot-venv
    source ~/certbot-venv/bin/activate
    ```

    The shell prompt changes to show `(certbot-venv)` when the environment is active.
  </Step>

  <Step title="Install the Certbot plugin">
    ```sh theme={null}
    pip install certbot-dns-gcore
    ```

    A successful installation ends with:

    ```
    Successfully installed certbot certbot-dns-gcore ...
    ```
  </Step>
</Steps>

## Create credentials for the Certbot plugin

The plugin authenticates with the Gcore DNS API using an [API token](/account-settings/api-tokens) to create and remove TXT records on behalf of the domain.

<Steps>
  <Step title="Navigate to the home directory">
    ```sh theme={null}
    cd ~/
    ```
  </Step>

  <Step title="Create the credentials file">
    Create a file named `gcore.ini` in the home directory using any text editor:

    ```sh theme={null}
    nano gcore.ini
    ```
  </Step>

  <Step title="Add the API token to the file">
    ```ini theme={null}
    dns_gcore_apitoken = 0123456789abcdef...
    ```

    Replace `0123456789abcdef...` with the actual API token value.
  </Step>

  <Step title="Restrict file permissions">
    ```sh theme={null}
    chmod 600 gcore.ini
    ```
  </Step>
</Steps>

## Acquire a certificate

<Steps>
  <Step title="Run certbot to request the certificate">
    ```sh theme={null}
    certbot certonly --authenticator dns-gcore --dns-gcore-credentials=./gcore.ini --dns-gcore-propagation-seconds=30 -d '*.example.com' --key-type ecdsa --logs-dir=. --config-dir=. --work-dir=.
    ```

    The example uses `*.example.com` to request a wildcard certificate covering all subdomains. To secure a single domain, omit the wildcard prefix: `-d 'example.com'`.
  </Step>

  <Step title="Enter an email address and agree to the terms">
    Certbot prompts for an email address for renewal notifications and urgent security alerts:

    ```
    Enter email address (used for urgent renewal and security notices)
     (Enter 'c' to cancel): user@example.com

    Please read the Terms of Service at ...
    Do you agree? [Y]es/[N]o: Y
    ```

    Enter a valid email address, then type `Y` to agree. Certificate issuance starts automatically.
  </Step>

  <Step title="Confirm the certificate was issued">
    A successful issuance returns:

    ```
    Congratulations! Your certificate and chain have been saved at:
       /path/to/fullchain.pem
    Your key file has been saved at:
       /path/to/privkey.pem
    ```

    If `Some challenges have failed` appears, increase the propagation wait time and retry:

    ```sh theme={null}
    certbot certonly --authenticator dns-gcore --dns-gcore-credentials=./gcore.ini --dns-gcore-propagation-seconds=80 -d '*.example.com' --key-type ecdsa --logs-dir=. --config-dir=. --work-dir=.
    ```

    If the error persists, verify that the domain's nameservers point to `ns1.gcorelabs.net` and `ns2.gcdn.services`. Nameserver changes can take up to 24 hours to propagate globally.
  </Step>
</Steps>

## Renew a certificate

Let's Encrypt certificates expire after 90 days. There are two renewal options:

* **Manual:** Run the following commands to renew any previously issued certificate expiring within 30 days:

```sh theme={null}
source ~/certbot-venv/bin/activate
certbot renew
```

* **Automatic (recommended):** Schedule `certbot renew` as a [cron job](https://eff-certbot.readthedocs.io/en/stable/using.html?highlight=cron) for automatic background renewal.