DNS-01 with OVH ( acme.sh )

Cisco30

Hi
Do you know where I can find more information on how to configure DNS-01 with OVH?
I tried with this configuration but it’s impossible to configure it correctly:

/opt/mailcow-dockerized/data/conf/acme/dns-01.conf

# Add here your DNS-01 challenge configuration
# For more information, visit the acme.sh documentation:
# https://github.com/acmesh-official/acme.sh/wiki/dnsapi
dns_ovh_endpoint = ovh-eu
dns_ovh_application_key = 017c7aXxXXXXXXXXX
dns_ovh_application_secret = bfc87XXXXXXXXXXXXXXXXXXXX690f1b
dns_ovh_consumer_key = e3XXXXXXXXXXXXXXXXXXXXXXXd5e777

mailcow.conf

# Enable DNS-01 challenge for ACME (acme-mailcow) - y/n
# This requires you to set ACME_DNS_PROVIDER and ACME_ACCOUNT_EMAIL below
ACME_DNS_CHALLENGE=y
# DNS provider for DNS-01 challenge (e.g. dns_cf, dns_azure, dns_gd, etc.)
# See the dns-01 provider documentation for more information.
ACME_DNS_PROVIDER=dns_ovh
# Account email for ACME DNS-01 challenge registration
ACME_ACCOUNT_EMAIL=XXXXXXX@XXXXXX.com

Log ACME

acme-mailcow-1  | Fri Mar 13 17:50:22 CET 2026 - Loading DNS-01 configuration from /etc/acme/dns-01.conf
acme-mailcow-1  | Fri Mar 13 17:50:22 CET 2026 - Exported DNS config key dns_ovh_endpoint
acme-mailcow-1  | Fri Mar 13 17:50:22 CET 2026 - Exported DNS config key dns_ovh_application_key
acme-mailcow-1  | Fri Mar 13 17:50:22 CET 2026 - Exported DNS config key dns_ovh_application_secret
acme-mailcow-1  | Fri Mar 13 17:50:22 CET 2026 - Exported DNS config key dns_ovh_consumer_key
acme-mailcow-1  | Fri Mar 13 17:50:22 CET 2026 - ACME_DNS_CHALLENGE is enabled, DNS provider secrets loaded
acme-mailcow-1  | Fri Mar 13 17:50:22 CET 2026 - Using Let's Encrypt production servers
acme-mailcow-1  | Fri Mar 13 17:50:22 CET 2026 - Certificate /var/lib/acme/autoconfig.XXXX.com/cert.pem missing or changed domains 'autoconfig.XXXX.com autoconfig.XXXX.com autodiscover.XXXX.com mta-sts.XXXX.com' - start obtaining
acme-mailcow-1  | Fri Mar 13 17:50:23 CET 2026 - Copying shared private key for this certificate...
acme-mailcow-1  | Fri Mar 13 17:50:23 CET 2026 - Checking resolver...
acme-mailcow-1  | Fri Mar 13 17:50:23 CET 2026 - Resolver OK
acme-mailcow-1  | Fri Mar 13 17:50:23 CET 2026 - Registering acme.sh account for XXXX@XXXX.COM
acme-mailcow-1  | Fri Mar 13 17:50:24 CET 2026 - Using command /opt/acme.sh/acme.sh --home /var/lib/acme/acme-sh --config-home /var/lib/acme/acme-sh --cert-home /var/lib/acme/acme-sh --server letsencrypt --issue --dns dns_ovh --key-file /var/lib/acme/autoconfig.tiboxs.com/key.pem --cert-file /tmp/acme-cert.hCDdHk --fullchain-file /tmp/acme-fullchain.FcAPIk --force -d autoconfig.XXXX.com -d autoconfig.XXXX.com -d autodiscover.XXXX.com -d mta-sts.XXXX.com
acme-mailcow-1  | Fri Mar 13 17:50:24 CET 2026 - DNS provider: dns_ovh
acme-mailcow-1  | [Fri Mar 13 17:50:25 CET 2026] Using CA: https://acme-v02.api.letsencrypt.org/directory
acme-mailcow-1  | [Fri Mar 13 17:50:25 CET 2026] Creating domain key
acme-mailcow-1  | [Fri Mar 13 17:50:25 CET 2026] The domain key is here: /var/lib/acme/acme-sh/autoconfig.XXXX.com_ecc/autoconfig.XXXX.com.key
acme-mailcow-1  | [Fri Mar 13 17:50:25 CET 2026] Multi domain='DNS:autoconfig.XXXX.com,DNS:autoconfig.XXXX.com,DNS:autodiscover.XXXX.com,DNS:mta-sts.XXXX.com'
acme-mailcow-1  | [Fri Mar 13 17:50:27 CET 2026] Getting webroot for domain='autoconfig.XXXX.com'
acme-mailcow-1  | [Fri Mar 13 17:50:27 CET 2026] Getting webroot for domain='autoconfig.XXXX.com'
acme-mailcow-1  | [Fri Mar 13 17:50:27 CET 2026] Getting webroot for domain='autodiscover.XXXX.com'
acme-mailcow-1  | [Fri Mar 13 17:50:27 CET 2026] Getting webroot for domain='mta-sts.XXXX.com'
acme-mailcow-1  | [Fri Mar 13 17:50:27 CET 2026] Adding TXT value: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXVzJV1raZs for domain: _acme-challenge.autoconfig.XXXX.com
acme-mailcow-1  | [Fri Mar 13 17:50:27 CET 2026] You don't specify OVH application key and application secret yet.
acme-mailcow-1  | [Fri Mar 13 17:50:27 CET 2026] Please create you key and try again.
acme-mailcow-1  | [Fri Mar 13 17:50:27 CET 2026] Error adding TXT record to domain: _acme-challenge.autoconfig.XXXX.com
acme-mailcow-1  | [Fri Mar 13 17:50:27 CET 2026] Please add '--debug' or '--log' to see more information.
acme-mailcow-1  | [Fri Mar 13 17:50:27 CET 2026] See: https://github.com/acmesh-official/acme.sh/wiki/How-to-debug-acme.sh
acme-mailcow-1  | Fri Mar 13 17:50:30 CET 2026 - Failed to obtain certificate /var/lib/acme/autoconfig.XXXX.com/cert.pem for domains 'autoconfig.XXXX.com autoconfig.XXXX.com autodiscover.XXXX.com mta-sts.XXXX.com' via DNS challenge
acme-mailcow-1  | OK
acme-mailcow-1  | Fri Mar 13 17:50:30 CET 2026 - Some errors occurred, retrying in 30 minutes...
acme-mailcow-1  | OK

Thank you for your help.

accolon

Cisco30 dns_ovh_application_key = 017c7aXxXXXXXXXXX
dns_ovh_application_secret = bfc87XXXXXXXXXXXXXXXXXXXX690f1b
dns_ovh_consumer_key = e3XXXXXXXXXXXXXXXXXXXXXXXd5e777

I don’t use OVH, but these variable names don’t look like the ones from acme.sh’s documentation:
https://github.com/acmesh-official/acme.sh/wiki/How-to-use-OVH-domain-api

Cisco30

accolon
Hi,
I already use Certbot with the DNS-01 challenge for other services on other servers, and this configuration works.

I’ve already tried with the link you provided, and it doesn’t work. A little more documentation on how to implement DNS-01 with OVH would be welcome. OVH is very widespread; it’s the European leader.