> ## Documentation Index
> Fetch the complete documentation index at: https://docs.gcore.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Get a Let's Encrypt certificate with Certbot

> Use the certbot-dns-gcore plugin to obtain and renew Let's Encrypt certificates with Gcore DNS validation.

The `certbot-dns-gcore` plugin automates Let's Encrypt certificate issuance and renewal using the Gcore DNS API. To confirm domain ownership, it uses a [DNS-01 challenge](https://letsencrypt.org/docs/challenge-types): a TXT record with a specific value must be present under the domain name. The plugin creates and removes these TXT records automatically when obtaining, renewing, or revoking certificates.

> [!NOTE]
>
> The domain must be delegated to Gcore nameservers (`ns1.gcorelabs.net` and `ns2.gcdn.services`), and a Gcore account is required.

## Install the Certbot plugin

> [!NOTE]
>
> All steps run in a terminal on the Linux server where Certbot will be installed. Connect to it via SSH before starting. The commands below apply to Ubuntu 22.04; other Linux distributions may require different package names.

**1. Update package lists**

```sh theme={null}
sudo apt update
```

**2. Install pip3 and the venv module**

```sh theme={null}
sudo apt install python3-pip python3-venv
```

**3. Create and activate a virtual environment**

Ubuntu 22.04 and later restrict direct pip installations into the system Python. A virtual environment avoids this restriction:

```sh theme={null}
python3 -m venv ~/certbot-venv
source ~/certbot-venv/bin/activate
```

The shell prompt changes to show `(certbot-venv)` when the environment is active.

**4. Install the Certbot plugin**

```sh theme={null}
pip install certbot-dns-gcore
```

A successful installation ends with:

```
Successfully installed certbot certbot-dns-gcore ...
```

## Create credentials for the Certbot plugin

The plugin authenticates with the Gcore DNS API using an [API token](/account-settings/api-tokens) to create and remove TXT records on behalf of the domain.

**1. Navigate to the home directory**

```sh theme={null}
cd ~/
```

**2. Create the credentials file**

Create a file named `gcore.ini` in the home directory using any text editor:

```sh theme={null}
nano gcore.ini
```

**3. Add the API token to the file**

```ini theme={null}
dns_gcore_apitoken = 0123456789abcdef...
```

Replace `0123456789abcdef...` with the actual API token value.

**4. Restrict file permissions**

```sh theme={null}
chmod 600 gcore.ini
```

## Acquire a certificate

**1. Run certbot to request the certificate**

```sh theme={null}
certbot certonly --authenticator dns-gcore --dns-gcore-credentials=./gcore.ini --dns-gcore-propagation-seconds=30 -d '*.example.com' --key-type ecdsa --logs-dir=. --config-dir=. --work-dir=.
```

The example uses `*.example.com` to request a wildcard certificate covering all subdomains. To secure a single domain, omit the wildcard prefix: `-d 'example.com'`.

**2. Enter an email address and agree to the terms**

Certbot prompts for an email address for renewal notifications and urgent security alerts:

```
Enter email address (used for urgent renewal and security notices)
 (Enter 'c' to cancel): user@example.com

Please read the Terms of Service at ...
Do you agree? [Y]es/[N]o: Y
```

Enter a valid email address, then type `Y` to agree. Certificate issuance starts automatically.

**3. Confirm the certificate was issued**

A successful issuance returns:

```
Congratulations! Your certificate and chain have been saved at:
   /path/to/fullchain.pem
Your key file has been saved at:
   /path/to/privkey.pem
```

If `Some challenges have failed` appears, increase the propagation wait time and retry:

```sh theme={null}
certbot certonly --authenticator dns-gcore --dns-gcore-credentials=./gcore.ini --dns-gcore-propagation-seconds=80 -d '*.example.com' --key-type ecdsa --logs-dir=. --config-dir=. --work-dir=.
```

If the error persists, verify that the domain's nameservers point to `ns1.gcorelabs.net` and `ns2.gcdn.services`. Nameserver changes can take up to 24 hours to propagate globally.

## Renew a certificate

Let's Encrypt certificates expire after 90 days. There are two renewal options:

* **Manual:** Run the following commands to renew any previously issued certificate expiring within 30 days:

```sh theme={null}
source ~/certbot-venv/bin/activate
certbot renew
```

* **Automatic (recommended):** Schedule `certbot renew` as a [cron job](https://eff-certbot.readthedocs.io/en/stable/using.html?highlight=cron) for automatic background renewal.