DEHYDRATED(1)

📦
version 0.7.2 · 2 versions
, in arch rolling, debian trixie, fedora 43, fedora 44, nixos 26.05, nixpkgs unstable, ubuntu resolute, ubuntu stonking

💧 dehydrated(1) — the general commands manual, but make it a vibe

okay so bestie, welcome to dehydrated(1), the general commands manual entry for dehydrated, and honestly? she's iconic. sit down, grab a strawberry, we're doing this. 🍓

✨ NAME ✨

dehydrated — an ACME client that is literally implemented as a shell-script. no cap. a whole certificate authority client, in shell. main character energy fr fr. 💅

🌈 SYNOPSIS 🌈

dehydrated [command [argument]] [argument [argument]] ...

💖 DESCRIPTION 💖

So. dehydrated is a client for ACME-based Certificate Authorities, like LetsEncrypt. That's the whole thing — you use it to request and obtain TLS certificates from an ACME-based certificate authority. slay. 🔥

Before you can request any certificates, Dehydrated needs to acquire an account with the Certificate Authorities. Optionally, you can provide an email address — it'll be used to, like, notify you about expiring certificates and stuff. You'll usually need to accept the Terms of Service of the CA. Dehydrated will notify you if no account is configured, so don't be surprised. Run with --register --accept-terms to create a new account. periodt.

Next up: all your domain names have to go in domains.txt. The format is line based, okay? So if the file contains two lines, "example.com" and "example.net", dehydrated will request two certificates — one for "example.com" and the other for "example.net". But a single line containing "example.com example.net" will request a single certificate valid for both "example.net" and "example.com" through the Subject Alternative Name (SAN) field. two lines = two certs, one line = one cert, it's giving very straightforward actually.

For the next step, you need to configure one way of verifying domain name ownership. Dehydrated implements http-01 and dns-01 verification. 🦋

The http-01 verification provides proof of ownership by providing a challenge token. In order to do that, the directory referenced in the WELLKNOWN config variable needs to be exposed at http://{domain}/.well-known/acme-challenge/, where {domain} is every domain name specified in domains.txt. Dehydrated does not provide its own challenge responder — it relies on an existing web server to provide the challenge response. See wellknown.md for configuration examples of popular web servers. iykyk.

The dns-01 verification works by providing a challenge token through DNS. This is especially interesting for hosts that cannot be exposed to the public Internet. Because adding records to DNS zones is oftentimes highly specific to the software or the DNS provider at hand, there are many third party hooks available for dehydrated. See dns-verification.md for hooks for popular DNS servers and DNS hosters. 💜

Finally, the certificates need to be requested and updated on a regular basis. This can happen through a cron job or a timer. Initially, you may enforce this by invoking dehydrated -c manually. no shame in a manual little run, we've all been there. 🫶

After a successful run, certificates are stored in /etc/dehydrated/certs/{domain}, where {domain} is the domain name in the first column of domains.txt. 📁

🎀 OPTIONS 🎀

Commands

  • --version, -v — Print version information. the "who even am i" flag.
  • --register — Register account key.
  • --account — Update account contact information.
  • --cron, -c — Sign/renew non-existent/changed/expiring certificates. the daily driver, the moment, the ritual.
  • --signcsr, -s path/to/csr.pem — Sign a given CSR, output CRT on stdout (advanced usage). ooh advanced, look at you. 👑
  • --revoke, -r path/to/cert.pem — Revoke specified certificate. bye bestie 💀
  • --cleanup, -gc — Move unused certificate files to archive directory.
  • --help, -h — Show help text.
  • --env, -e — Output configuration variables for use in other scripts.

Parameters

  • --accept-terms — Accept CAs terms of service. yes, you have to actually do this.
  • --full-chain, -fc — Print full chain when using --signcsr.
  • --ipv4, -4 — Resolve names to IPv4 addresses only.
  • --ipv6, -6 — Resolve names to IPv6 addresses only.
  • --domain, -d domain.tld — Use specified domain name(s) instead of domains.txt entry (one certificate!). ⚠️ note the "one certificate!" — it's not playing.
  • --keep-going, -g — Keep going after encountering an error while creating/renewing multiple certificates in cron mode. resilience queen. 💪
  • --force, -x — Force certificate renewal even if it is not due to expire within RENEW_DAYS.
  • --no-lock, -n — Don't use lockfile (potentially dangerous!). > bestie. the word "dangerous" is right there. 🙈
  • --lock-suffix example.com — Suffix lockfile name with a string (useful for use with -d).
  • --ocsp — Sets option in CSR indicating OCSP stapling to be mandatory.
  • --privkey, -p path/to/key.pem — Use specified private key instead of account key (useful for revocation).
  • --config, -f path/to/config — Use specified config file.
  • --hook, -k path/to/hook.sh — Use specified script for hooks.
  • --out, -o certs/directory — Output certificates into the specified directory.
  • --challenge, -t [http-01|dns-01] — Which challenge should be used? Currently http-01 and dns-01 are supported.
  • --algo, -a [rsa|prime256v1|secp384r1] — Which public key algorithm should be used? Supported: rsa, prime256v1 and secp384r1.

🔍 DIAGNOSTICS 🔍

The program exits 0 if everything was fine, 1 if an error occurred. that's it, that's the whole mood system. ✨

🐛 BUGS 🐛

Please report any bugs that you may encounter at the project web site https://github.com/dehydrated-io/dehydrated/issues. found a bug? tell the internet. we love accountability. 🦋

💜 AUTHOR 💜

Dehydrated was written by Lukas Schauer. This man page was contributed by Daniel Molkentin. kings, honestly. 👑

Copyright 2015-2018 by Lukas Schauer and the respective contributors. Provided under the MIT License. See the LICENSE file that accompanies the distribution for licensing information. legal besties stay winning. 🌸

👀 SEE ALSO 👀

Full documentation along with configuration examples are provided in the docs directory of the distribution, or at https://github.com/dehydrated-io/dehydrated/tree/master/docs. go read it, it's giving informative. 💖

and that's the whole page bestie!! this was the Dehydrated ACME Client man page, dated 2018-01-13, from the DEHYDRATED(1) of it all. go get those certificates, you absolute icon. 💅✨🎀

📦 where this page comes from