# Convert manual to Webroot renewal **URL:** \ **Category:** Help\ **Created:** [July 17, 2018, 4:30pm UTC](https://community.letsencrypt.org/t/convert-manual-to-webroot-renewal/66965 "2018-07-17T16:30:00Z")\ **Posts on this page:** 20\ **Page:** 2
**Author:** ![ramzdam](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/ramzdam/32/24826_2.png) [@ramzdam](https://community.letsencrypt.org/u/ramzdam)\ **Post date:** [July 17, 2018, 5:34pm UTC](https://community.letsencrypt.org/t/convert-manual-to-webroot-renewal/66965/21 "2018-07-17T17:34:19Z")
> [@danb35](#): > > you can se Hi @danb35 yes I wanted to use acme.sh but when I saw that they need the account API Key for the DNS it just seems impossible since my boss told me that he will not be giving me this credential and I had to find ways to Auto Renew the site without the Account API\_KEY. That leads me to think that WEBROOT will solve everything. But sadly as @sahsanu have mentioned that I can't auto renew it with a wildcard. I really don't know now what step I should take to fix this kind of issue since account API\_KEY is crossed out from the choices ---
**Author:** ![ramzdam](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/ramzdam/32/24826_2.png) [@ramzdam](https://community.letsencrypt.org/u/ramzdam)\ **Post date:** [July 17, 2018, 5:35pm UTC](https://community.letsencrypt.org/t/convert-manual-to-webroot-renewal/66965/22 "2018-07-17T17:35:36Z")
@stevenzhu yes we are using GoDaddy but I think it needs the account API\_KEY to access it right? ---
**Author:** ![stevenzhu](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/stevenzhu/32/18864_2.png) [@stevenzhu](https://community.letsencrypt.org/u/stevenzhu)\ **Post date:** [July 17, 2018, 5:37pm UTC](https://community.letsencrypt.org/t/convert-manual-to-webroot-renewal/66965/23 "2018-07-17T17:37:08Z")
> [@ramzdam](#): > > I really don’t know now what step I should take to fix this kind of issue since account API\_KEY is crossed out from the choices Then you could try to use cname methods to only cname \_acme-challenge to another verification domain? Try this [https://github.com/joohoi/acme-dns/blob/master/README.md](https://github.com/joohoi/acme-dns/blob/master/README.md) Thank you ---
**Author:** ![danb35](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/danb35/32/70869_2.png) [@danb35](https://community.letsencrypt.org/u/danb35)\ **Post date:** [July 17, 2018, 5:37pm UTC](https://community.letsencrypt.org/t/convert-manual-to-webroot-renewal/66965/24 "2018-07-17T17:37:35Z")
> [@ramzdam](#): > > my boss told me that he will not be giving me this credential and I had to find ways to Auto Renew the site without the Account API\_KEY. - Stop using a wildcard certificate - Run your own acme-dns instance - Tell your boss to stop being an idiot, and give you the tools you need to do your job. OK, you might want to rephrase that a bit... Edit: OK, the last deserves a little bit of explanation. Automatic renewal of a wildcard cert requires that certbot (or whatever other client) be able to automatically update your DNS records. In order to do that, it must have the API\_KEY. It is not possible to perform this task, using GoDaddy for your DNS hosting, without the API\_KEY. ---
**Author:** ![ramzdam](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/ramzdam/32/24826_2.png) [@ramzdam](https://community.letsencrypt.org/u/ramzdam)\ **Post date:** [July 17, 2018, 5:46pm UTC](https://community.letsencrypt.org/t/convert-manual-to-webroot-renewal/66965/25 "2018-07-17T17:46:30Z")
@danb35 I figured that will be the case and I already told him that having no API\_Key will be impossible for the renewal since “I THINK” it needs some way to have authorization to verify that the DNS ownership. For the wildcard certificate. The site requires a wildcard domain to cater other user just like a SAAS. I haven’t tried this acme-dns but will give this a try… Really appreciate your quick reply on this. Been busting my head out trying to fix auto renewal with wildcard. Good thing I found this forum and it’s really a big help to clarify all questions in my head ---
**Author:** ![ramzdam](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/ramzdam/32/24826_2.png) [@ramzdam](https://community.letsencrypt.org/u/ramzdam)\ **Post date:** [July 17, 2018, 5:47pm UTC](https://community.letsencrypt.org/t/convert-manual-to-webroot-renewal/66965/26 "2018-07-17T17:47:17Z")
@stevenzhu will check acme-dns hopefully this will solve the issue with auto-renewal using wildcards ---
**Author:** ![danb35](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/danb35/32/70869_2.png) [@danb35](https://community.letsencrypt.org/u/danb35)\ **Post date:** [July 17, 2018, 5:48pm UTC](https://community.letsencrypt.org/t/convert-manual-to-webroot-renewal/66965/27 "2018-07-17T17:48:13Z")
> [@ramzdam](#): > > I haven’t tried this acme-dns but will give this a try… It was a little tough to wrap my head around, so I started a thread for my questions--here it is in case it helps you: > [@Help me understand acme-dns](https://community.letsencrypt.org/t/help-me-understand-acme-dns/58892): > > A… ---
**Author:** ![ramzdam](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/ramzdam/32/24826_2.png) [@ramzdam](https://community.letsencrypt.org/u/ramzdam)\ **Post date:** [July 17, 2018, 5:54pm UTC](https://community.letsencrypt.org/t/convert-manual-to-webroot-renewal/66965/28 "2018-07-17T17:54:48Z")
Ok I browse on some of the comment and I think it needs to have access to the DNS server right? Like setting up the CNAME and all that? 😥 seems this will also not work since I don’t have access to the DNS server panel in GoDaddy ( my boss is the only one who has access to this ). And it seems impossible to ask him to do this steps since he say’s “ITS MY JOB TO FIX THIS”. Sorry for venting out my frustration here. I just don’t know how to work properly with only limited resources and access I have ---
**Author:** ![sahsanu](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/sahsanu/32/89984_2.png) [@sahsanu](https://community.letsencrypt.org/u/sahsanu)\ **Post date:** [July 17, 2018, 6:02pm UTC](https://community.letsencrypt.org/t/convert-manual-to-webroot-renewal/66965/29 "2018-07-17T18:02:56Z")
> [@ramzdam](#): > > Like setting up the CNAME and all that? Yes, you need access to the DNS server to create a CNAME for \_acme-challenge.yourdomain.tld but you just need to create it once. > [@ramzdam](#): > > And it seems impossible to ask him to do this steps since he say’s “ITS MY JOB TO FIX THIS”. You boss is responsible to provide the right tools and access to be able to do your job. If there is no way to modify the DNS for the domain how did you create the right \_acme-challenge TXT records to validate it and get your wildcard certificate?. If it was your boss who edited the DNS records then you should say to your boss that he/she will have to do it every 60-90 days or he/she should pay for a wildcard cert, whatever he/she prefers. Good luck, sahsanu ---
**Author:** ![ramzdam](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/ramzdam/32/24826_2.png) [@ramzdam](https://community.letsencrypt.org/u/ramzdam)\ **Post date:** [July 17, 2018, 6:06pm UTC](https://community.letsencrypt.org/t/convert-manual-to-webroot-renewal/66965/30 "2018-07-17T18:06:54Z")
> [@sahsanu](#): > > If there is no way to modify the DNS for the domain how did you create the right \_acme-challenge TXT records to validate it and get your wildcard certificate? Yes he created it and I asked him to create it for me when I first setup the certificate. Already told inform him that TXT Value and renewal needs to be done every 90 days. But he was asking me to look for other ways to fix it without HIM to do the TXT Value changing every 90days. Well anyway I guess I just have to let him know about this in a Nicer way for him to accept there are no other way to auto renew a certificate with wildcards. Thanks all for the great support. ---
**Author:** ![schoen](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/schoen/32/79_2.png) [@schoen](https://community.letsencrypt.org/u/schoen)\ **Post date:** [July 17, 2018, 6:07pm UTC](https://community.letsencrypt.org/t/convert-manual-to-webroot-renewal/66965/31 "2018-07-17T18:07:43Z")
Note that the `CNAME` record would only need to be created once. It would point somewhere else and the different `TXT` records would be created there. Therefore, your boss wouldn’t have to do ongoing work to create the `CNAME` record if you find a plan that uses this method. ---
**Author:** ![ramzdam](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/ramzdam/32/24826_2.png) [@ramzdam](https://community.letsencrypt.org/u/ramzdam)\ **Post date:** [July 17, 2018, 6:10pm UTC](https://community.letsencrypt.org/t/convert-manual-to-webroot-renewal/66965/32 "2018-07-17T18:10:27Z")
@schoen that seems to be ok i guess… Would need to understand this first on how to implement this. If it’s just a one time setup that it’s feasible that he can do it. ---
**Author:** ![Neilpang](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/neilpang/32/20232_2.png) [@Neilpang](https://community.letsencrypt.org/u/Neilpang)\ **Post date:** [July 18, 2018, 1:27am UTC](https://community.letsencrypt.org/t/convert-manual-to-webroot-renewal/66965/33 "2018-07-18T01:27:37Z")
try our dns alias mode 🙂 > **[Neilpang/acme.sh](https://github.com/Neilpang/acme.sh/wiki/DNS-alias-mode)** > > A pure Unix shell script implementing ACME client protocol - Neilpang/acme.sh ---
**Author:** ![ramzdam](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/ramzdam/32/24826_2.png) [@ramzdam](https://community.letsencrypt.org/u/ramzdam)\ **Post date:** [July 18, 2018, 6:52am UTC](https://community.letsencrypt.org/t/convert-manual-to-webroot-renewal/66965/34 "2018-07-18T06:52:25Z")
@Neilpang I guess this can also be a solution but I need to ask first if we have a spare server that we can use as dummy ---
**Author:** ![ramzdam](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/ramzdam/32/24826_2.png) [@ramzdam](https://community.letsencrypt.org/u/ramzdam)\ **Post date:** [July 20, 2018, 4:34am UTC](https://community.letsencrypt.org/t/convert-manual-to-webroot-renewal/66965/35 "2018-07-20T04:34:03Z")
@sahsanu @danb35 do I need to install acme-dns on my server? as mentioned on their github? or can I not install it? Since server disk is only 300mb and it can’t cater another installation like GO ---
**Author:** ![schoen](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/schoen/32/79_2.png) [@schoen](https://community.letsencrypt.org/u/schoen)\ **Post date:** [July 20, 2018, 5:19am UTC](https://community.letsencrypt.org/t/convert-manual-to-webroot-renewal/66965/36 "2018-07-20T05:19:53Z")
If you don’t want to use a DNS provider that offers you an API that you have credentials for, then you need to install acme-dns on a server that you control, since it’s an alternative to using a DNS provider’s API. If you want to use a DNS provider that offers you an API that you have credentials for, then you don’t need to install acme-dns. This does not necessarily need to be your existing DNS provider, if you can create the `CNAME` record that I referred to before. ---
**Author:** ![ramzdam](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/ramzdam/32/24826_2.png) [@ramzdam](https://community.letsencrypt.org/u/ramzdam)\ **Post date:** [July 20, 2018, 5:29am UTC](https://community.letsencrypt.org/t/convert-manual-to-webroot-renewal/66965/37 "2018-07-20T05:29:58Z")
I see. Guess it makes sense… Will need to figure out how to make it work probably increase storage space. Does Acme-dns realy requires GO to run? I saw the link from [https://github.com/joohoi/acme-dns](https://github.com/joohoi/acme-dns) it needs to install go to download the file from [https://github.com/joohoi/acme-dns](https://github.com/joohoi/acme-dns) can I just do git clone or something for this file? ---
**Author:** ![sahsanu](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/sahsanu/32/89984_2.png) [@sahsanu](https://community.letsencrypt.org/u/sahsanu)\ **Post date:** [July 20, 2018, 7:45am UTC](https://community.letsencrypt.org/t/convert-manual-to-webroot-renewal/66965/38 "2018-07-20T07:45:36Z")
Hi @ramzdam, acme-dns developer (@joohoi) has a hosted acme-dns instance `https://auth.acme-dns.io` that you could use instead of installing your own self-hosted instance BUT keep in mind that: **1.-** That instance could be down anytime, developer has no plans to get it down but it could happen. **2.-** That instance could not be available because of maintenance or whatever. **3.-** The db used could be nuked at any time because a new version is in place or because of... **4.-** The hosted acme-dns provided by @joohoi is intended to be used for testing purposes not for production. Said that, acme.sh client has a plugin for acme-dns that uses `https://auth.acme-dns.io` by default but the recommended way is to install your own instance of acme-dns. This is what the developer says about his hosted acme-dns instance: > [@Trouble Validating Wildcard certificates](https://community.letsencrypt.org/t/trouble-validating-wildcard-certificates/61039/7): > > T… > [@ramzdam](#): > > Does Acme-dns realy requires GO to run? I saw the link from [https://github.com/joohoi/acme-dns](https://github.com/joohoi/acme-dns) it needs to install go to download the file from [https://github.com/joohoi/acme-dns](https://github.com/joohoi/acme-dns) can I just do git clone or something for this file? It doesn't need go to run but it needs it to compile acme-dns, so yes, you should install go, compile acme-dns and once compiled and installed you could remove go if you don't need it. **Edit** : As @danb35 commented in below post (thanks), @joohoi provides compiled binaries for Linux (32 and 64 bits) so you won't need to install go nor compile acme-dns yourself if you don't want to do so.[Link to the acme-dns release page](https://github.com/joohoi/acme-dns/releases). If using acme-dns hosted instance and you can't install your own acme-dns instance, there are other alternatives, like using cloudflare because of their API to modify records plus acme.sh with its dns-alias (as mentioned by @Neilpang a few post ago) and dns\_cf plugin. The process would be similar as with acme-dns: **1.-** Get a new domain, you could even get a free one from [https://www.freenom.com](https://www.freenom.com) **2.-** Create a free account on cloudflare and add this new domain so DNS will be managed by them. **3.-** Get you API credentials from cloudflare. **4.-** Create CNAME record for your domain pointing to the new domain: Example: `_acme-challenge.yourdomain.tld CNAME _acme-challenge.newdomain.tld` **5.-** Use acme.sh client to get a certificate for your domain using dns-alias and dns\_cf plugin (with the API credentials you got from cloudflare). Info and examples here [DNS alias mode · acmesh-official/acme.sh Wiki · GitHub](https://github.com/Neilpang/acme.sh/wiki/DNS-alias-mode) **Note** : Using cloudflare is just an example, you could use any other dns provider supported by acme.sh [dns plugins](https://github.com/Neilpang/acme.sh/tree/master/dnsapi). Good luck, sahsanu ---
**Author:** ![danb35](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/danb35/32/70869_2.png) [@danb35](https://community.letsencrypt.org/u/danb35)\ **Post date:** [July 20, 2018, 9:52am UTC](https://community.letsencrypt.org/t/convert-manual-to-webroot-renewal/66965/39 "2018-07-20T09:52:11Z")
> [@ramzdam](#): > > Does Acme-dns realy requires GO to run? No, just to compile. There are compiled binaries available to download as well. ---
**Author:** ![danb35](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/danb35/32/70869_2.png) [@danb35](https://community.letsencrypt.org/u/danb35)\ **Post date:** [July 20, 2018, 10:17am UTC](https://community.letsencrypt.org/t/convert-manual-to-webroot-renewal/66965/40 "2018-07-20T10:17:25Z")
> [@sahsanu](#): > > **1.-** Get a new domain, you could even get a free one from [https://www.freenom.com](https://www.freenom.com) > **2.-** Create a free account on cloudflare and add this new domain so DNS will be managed by them I don't think you can manage DNS for the free domains other than at freenom--at least, that's what I remember from when I had a domain there. [Previous page](https://community.letsencrypt.org/t/convert-manual-to-webroot-renewal/66965.md?page=1) [Next page](https://community.letsencrypt.org/t/convert-manual-to-webroot-renewal/66965.md?page=3)