UACME

UACME hook REXX script ---------------------- It's not perfect, but it might be useful to someone. :) This is my script for the uacme hook. This is used on my servers to renew certificates with DNS validation, but can also work for the http-01 validation type. It was written in one day and hasn't been tested much, so there may be some flaws, but it works pretty well for me. In this example, certificates are used for the domain name, and the domain name with the "*." prefix is used as an alternative name. Thus, a single certificate can be used for the names example.com, www.example.com, mail.example.com, and so on. Bind 9.18 acts as a DNS server providing the master zone(s). The names of the zones in the configuration match the names of the domains. The script (hook.cmd) uses the "sed" command, which must be installed. Check this: >yum install sed The example assumes that Bind is installed in C:\Programs\bind, and the example.com zone is configured to describe the example.com domain. uacme.exe, hook.cmd, and nsupdate.txt are located in C:\Programs\uacme. Steps to issue a certificate for the example.com domain that will also be valid for all subdomains: 1. Create a key for Bind update requests: >C: & cd \Programs\bind >tsig-keygen update-key>update.key 2. Add the following line to named.conf: include "C:/Programs/bind/update.key"; Add parameter "allow-update" and, if necessary, "also-notify" for your zone for which you need a certificate. zone "example.com." IN { type master; . . . . . allow-update { key "update-key"; }; also-notify { provider_server1; provider_server2; ... }; }; 3. If no certificates have ever been requested on the installed system, you need to run uacme with the "new" argument. This is used to create a new ACME account on the CA server and is only performed once before issuing any certificates: >C:\Programs\uacme\uacme -v new File %unixroot%\etc\ssl\uacme\private\key.pem will be created after executing this command. 4. Certificate issue: >C: & cd \Programs\uacme >uacme -v -h hook.cmd issue example.com *.example.com If everything went well, this command will write the private key to the file %unixroot%\etc\ssl\uacme\private\example.com\key.pem and the certificate to the file %unixroot%\etc\ssl\uacme\example.com\cert.pem. This command can be called from the scheduler once a day to ensure the certificate is updated in a timely manner. You can specify a different path for storing private keys and certificates in steps 3 and 4 using the '-c' command line switch. If you need a certificate for a single specific name within your domain (my-host.example.com), or if the zone name doesn't match the domain name and you don't need to issue certificates for different zones, simply replace key "#IDENT#" in the "zone #IDENT#" line of nsupdate.txt with the name of your zone specified in the bind configuration. In step 4, specify the domain name for which the certificate is being issued: >uacme -v -h hook.cmd issue my-host.example.com For additional settings, see the CONFIGURATION section in hook.cmd. --- Andrey Vasilkin, 2026