acme.sh DNS Plugin

Issue Let's Encrypt (and other ACME) certificates with DNS-01 validation using your NSIN API key and the dns_nsin acme.sh plugin.

dns_nsin solves the ACME DNS-01 challenge for acme.sh: it adds and removes _acme-challenge TXT records on your NSIN zone, for wildcard certs (*.example.com). It authenticates with your API key, same as the REST API.

Requirements

Domain is on NSIN (authoritative for the zone).
A non read-only API key. Create one in Settings → API Keys.

Install and configure

Download dns_nsin.sh into ~/.acme.sh/dnsapi/:

bash

curl -o ~/.acme.sh/dnsapi/dns_nsin.sh https://nsin.ir/docs/dns_nsin.sh

Set your key — acme.sh saves it to account.conf for renewals:

bash

export NSIN_Api_Key="nsin_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"

Variable	Required	Description
`NSIN_Api_Key`	yes	NSIN API key (starts with `nsin_`, not read-only).
`NSIN_Api`	no	API base URL. Defaults to `https://api.nsin.ir`.

Issue a certificate

bash

# Single hostname
acme.sh --issue --dns dns_nsin -d example.com -d www.example.com

# Wildcard (requires DNS-01)
acme.sh --issue --dns dns_nsin -d example.com -d '*.example.com'

The plugin adds the TXT record, waits, then removes it after validation.

How it works

Add — POST /domains/{domain}/records/ with {"name":"_acme-challenge","type":"TXT","destination":"<value>"}.
Remove — finds the matching TXT record, calls DELETE /domains/{domain}/records/{id}.
Matches the challenge name against your domain list — subdomain certs need no extra config.

Troubleshooting

read-only API key / 403 — use a key with write access.
invalid domain — not in your account, or key lacks access; check GET /domains/.
Validation fails — DNS hasn't propagated; add --dnssleep 60 (or higher).
--debug 2 — shows the requests and responses.