Installing and configuring the Gandi.net plugin

The Let's Encrypt CLI certificate manager, certbot in it's standard configuration only supports two types of challenges: HTTP, which can be easily automated, but can't be used for the creation of wildcard certificates and DNS, which can be used to create wildcard certificates but can't be easily automated (since you must manually add the challenges to your domain each time).

Luckily, many domain providers support automatic certificate renewal through the use of APIs. In this case, we will be configuring a certbot plugin developed by obynio that integrates with Gandi.net's domain API.

Installing certbot via snapd

The current version of certbot provided via apt repositories is too old, so we must instead use the snap version. Snapd should already be installed on Ubuntu 20.04, but if not it can be added via the following command:

sudo apt install snapd

Once installed, we want to ensure that the core snap is up to date:

sudo snap install core; sudo snap refresh core

This should provide an output similar to below:

core 16-2.49 from Canonical✓ installed
snap "core" has no updates available

Now that the core snap is up to date, we can install certbot:

sudo snap install --classic certbot

Create a symbolic link for certbot:

sudo ln -s /snap/bin/certbot /usr/bin/certbot

Installing the certbot gandi plugin

Obynio's plugin is published on pypi.org, so it's very easy to install once we have python3-pip installed:

sudo apt installed python3-pip

Once python3-pip is installed, we can install the plugin via this command:

sudo pip3 install certbot-plugin-gandi

Configuring the plugin

Preparing the file structure

We will now create a folder for Gandi within the Let's Encrypt folder:

sudo mkdir -p /etc/letsencrypt/gandi

Use nano to create the configuration file for the gandi plugin

sudo nano /etc/letsencrypt/gandi/gandi.ini

Paste in the following:

# live dns v5 api key
dns_gandi_api_key=

Retrieving your Gandi.net API key

Now, login to your Gandi.net account and click on the arrow to the right of your username, then click on User Settings:

Once in user settings, click on Manage the user account and security settings:

Go to the security section, and click on Regenerate the API key. The key will then appear on screen. Copy this to your clipboard.

Importing the API key

Go back to your terminal, and paste the copied key, so your gandi.ini file should look as follows:

# live dns v5 api key
dns_gandi_api_key=YOUR_API_KEY_HERE