Billionmail/BillionMail · error

DNS provider credentials are required for DNS verification

Error message

DNS provider credentials are required for DNS verification

What it means

When VerifyType is "dns", Validate also requires DnsConfig to be a non-empty map of provider credentials (API keys/tokens/secret ids). This error is returned when DnsConfig is nil or empty, meaning the ACME client could not authenticate to the DNS provider API.

Source

Thrown at core/internal/service/acme/cli.go:122

		// Check if DNS provider is supported
		supportedProviders := []string{"tencentcloud", "alidns", "cloudxns", "azuredns", "cloudflare", "godaddy"}
		isSupported := false
		for _, provider := range supportedProviders {
			if cli.DnsProvider == provider {
				isSupported = true
				break
			}
		}

		if !isSupported {
			return fmt.Errorf("unsupported DNS provider: %s, supported providers: %s",
				cli.DnsProvider, strings.Join(supportedProviders, ", "))
		}

		// Check DNS config
		if cli.DnsConfig == nil || len(cli.DnsConfig) == 0 {
			return fmt.Errorf("DNS provider credentials are required for DNS verification")
		}
	}

	return nil
}

/**
 * @brief Apply for certificate
 * @return certificatePath, privateKeyPath, error
 */
func (cli *AcmeCLI) Apply() (string, string, error) {
	// Validate parameters
	if err := cli.Validate(); err != nil {
		return "", "", err
	}

	// Create context
	ctx := context.Background()

View on GitHub (pinned to fc36c76c05)

Solutions

1. Populate cli.DnsConfig with the provider's required credentials (e.g. {"api_key": ...} for cloudflare, SecretId/SecretKey for alidns)
2. Load credentials from env/secret store before Apply and fail fast if empty
3. Pass credentials via the CLI's dns-config flag/JSON

Example fix

// before
cli := &AcmeCLI{Email: e, Domains: d, VerifyType: "dns", DnsProvider: "cloudflare"} // no DnsConfig
// after
cli := &AcmeCLI{Email: e, Domains: d, VerifyType: "dns", DnsProvider: "cloudflare",
  DnsConfig: map[string]string{"api_key": os.Getenv("CF_API_KEY")}}

if cli.VerifyType == "dns" {
    if len(cli.DnsConfig) == 0 { return errors.New("dns credentials missing") }
    required := []string{"api_key"} // adjust per provider
    for _, k := range required {
        if v, ok := cli.DnsConfig[k]; !ok || strings.TrimSpace(v) == "" {
            return fmt.Errorf("dns credential %q missing", k)
        }
    }
}

if err := cli.Validate(); err != nil {
    if strings.Contains(err.Error(), "credentials are required") {
        log.Printf("inject DNS API credentials from secret store before issuance")
    }
    os.Exit(1)
}

When it happens

Trigger: VerifyType="dns" with a valid DnsProvider but DnsConfig nil/empty — credentials flag or config section omitted.

Common situations: Secrets managed separately and not injected into the config; rotation jobs that cleared the credentials map; users providing credentials as flags but never wiring them into DnsConfig.

Related errors

• DNS provider is required for DNS verification
• unsupported DNS provider: %s, supported providers: %s
• DNS automated resolution failed: SecretId or SecretKey is em
• DNS provider initialization failed: {}
• DNS verification setup failed: {}

AI-assisted analysis of Billionmail/BillionMail@fc36c76c05 (2026-09-05). Data as JSON: /api/errors/c101c16d45b256aa. Report an issue: GitHub.