chore: add debug transport on DNS API clients (#2692)

Co-authored-by: Dominik Menke <git@dmke.org>

cmd/zz_gen_cmd_dnshelp.go

@@ -614,6 +614,7 @@ func displayDNSHelp(w io.Writer, name string) error {
 		ew.writeln()
 
 		ew.writeln(`Additional Configuration:`)
+		ew.writeln(`	- "BUNNY_HTTP_TIMEOUT":	API request timeout in seconds (Default: 30)`)
 		ew.writeln(`	- "BUNNY_POLLING_INTERVAL":	Time between DNS propagation check in seconds (Default: 2)`)
 		ew.writeln(`	- "BUNNY_PROPAGATION_TIMEOUT":	Maximum waiting time for DNS propagation in seconds (Default: 120)`)
 		ew.writeln(`	- "BUNNY_TTL":	The TTL of the TXT record used for the DNS challenge in seconds (Default: 60)`)
@@ -2171,6 +2172,7 @@ func displayDNSHelp(w io.Writer, name string) error {
 		ew.writeln()
 
 		ew.writeln(`Additional Configuration:`)
+		ew.writeln(`	- "MAILINABOX_HTTP_TIMEOUT":	API request timeout in seconds (Default: 30)`)
 		ew.writeln(`	- "MAILINABOX_POLLING_INTERVAL":	Time between DNS propagation check in seconds (Default: 4)`)
 		ew.writeln(`	- "MAILINABOX_PROPAGATION_TIMEOUT":	Maximum waiting time for DNS propagation in seconds (Default: 120)`)
 
@@ -3001,6 +3003,7 @@ func displayDNSHelp(w io.Writer, name string) error {
 
 		ew.writeln(`Additional Configuration:`)
 		ew.writeln(`	- "SCW_ACCESS_KEY":	Access key`)
+		ew.writeln(`	- "SCW_HTTP_TIMEOUT":	API request timeout in seconds (Default: 30)`)
 		ew.writeln(`	- "SCW_POLLING_INTERVAL":	Time between DNS propagation check in seconds (Default: 10)`)
 		ew.writeln(`	- "SCW_PROPAGATION_TIMEOUT":	Maximum waiting time for DNS propagation in seconds (Default: 120)`)
 		ew.writeln(`	- "SCW_TTL":	The TTL of the TXT record used for the DNS challenge in seconds (Default: 60)`)
@@ -3281,6 +3284,7 @@ func displayDNSHelp(w io.Writer, name string) error {
 		ew.writeln()
 
 		ew.writeln(`Additional Configuration:`)
+		ew.writeln(`	- "TRANSIP_HTTP_TIMEOUT":	API request timeout in seconds (Default: 30)`)
 		ew.writeln(`	- "TRANSIP_POLLING_INTERVAL":	Time between DNS propagation check in seconds (Default: 10)`)
 		ew.writeln(`	- "TRANSIP_PROPAGATION_TIMEOUT":	Maximum waiting time for DNS propagation in seconds (Default: 600)`)
 		ew.writeln(`	- "TRANSIP_TTL":	The TTL of the TXT record used for the DNS challenge in seconds (Default: 10)`)
@@ -3409,6 +3413,7 @@ func displayDNSHelp(w io.Writer, name string) error {
 		ew.writeln()
 
 		ew.writeln(`Additional Configuration:`)
+		ew.writeln(`	- "VINYLDNS_HTTP_TIMEOUT":	API request timeout in seconds (Default: 30)`)
 		ew.writeln(`	- "VINYLDNS_POLLING_INTERVAL":	Time between DNS propagation check in seconds (Default: 4)`)
 		ew.writeln(`	- "VINYLDNS_PROPAGATION_TIMEOUT":	Maximum waiting time for DNS propagation in seconds (Default: 120)`)
 		ew.writeln(`	- "VINYLDNS_QUOTE_VALUE":	Adds quotes around the TXT record value (Default: false)`)

docs/content/dns/zz_gen_bunny.md

@@ -47,6 +47,7 @@ More information [here]({{% ref "dns#configuration-and-credentials" %}}).
 
 | Environment Variable Name | Description |
 |--------------------------------|-------------|
+| `BUNNY_HTTP_TIMEOUT` | API request timeout in seconds (Default: 30) |
 | `BUNNY_POLLING_INTERVAL` | Time between DNS propagation check in seconds (Default: 2) |
 | `BUNNY_PROPAGATION_TIMEOUT` | Maximum waiting time for DNS propagation in seconds (Default: 120) |
 | `BUNNY_TTL` | The TTL of the TXT record used for the DNS challenge in seconds (Default: 60) |

docs/content/dns/zz_gen_mailinabox.md

@@ -51,6 +51,7 @@ More information [here]({{% ref "dns#configuration-and-credentials" %}}).
 
 | Environment Variable Name | Description |
 |--------------------------------|-------------|
+| `MAILINABOX_HTTP_TIMEOUT` | API request timeout in seconds (Default: 30) |
 | `MAILINABOX_POLLING_INTERVAL` | Time between DNS propagation check in seconds (Default: 4) |
 | `MAILINABOX_PROPAGATION_TIMEOUT` | Maximum waiting time for DNS propagation in seconds (Default: 120) |
 

docs/content/dns/zz_gen_scaleway.md

@@ -49,6 +49,7 @@ More information [here]({{% ref "dns#configuration-and-credentials" %}}).
 | Environment Variable Name | Description |
 |--------------------------------|-------------|
 | `SCW_ACCESS_KEY` | Access key |
+| `SCW_HTTP_TIMEOUT` | API request timeout in seconds (Default: 30) |
 | `SCW_POLLING_INTERVAL` | Time between DNS propagation check in seconds (Default: 10) |
 | `SCW_PROPAGATION_TIMEOUT` | Maximum waiting time for DNS propagation in seconds (Default: 120) |
 | `SCW_TTL` | The TTL of the TXT record used for the DNS challenge in seconds (Default: 60) |

docs/content/dns/zz_gen_transip.md

@@ -49,6 +49,7 @@ More information [here]({{% ref "dns#configuration-and-credentials" %}}).
 
 | Environment Variable Name | Description |
 |--------------------------------|-------------|
+| `TRANSIP_HTTP_TIMEOUT` | API request timeout in seconds (Default: 30) |
 | `TRANSIP_POLLING_INTERVAL` | Time between DNS propagation check in seconds (Default: 10) |
 | `TRANSIP_PROPAGATION_TIMEOUT` | Maximum waiting time for DNS propagation in seconds (Default: 600) |
 | `TRANSIP_TTL` | The TTL of the TXT record used for the DNS challenge in seconds (Default: 10) |

docs/content/dns/zz_gen_vinyldns.md

@@ -51,6 +51,7 @@ More information [here]({{% ref "dns#configuration-and-credentials" %}}).
 
 | Environment Variable Name | Description |
 |--------------------------------|-------------|
+| `VINYLDNS_HTTP_TIMEOUT` | API request timeout in seconds (Default: 30) |
 | `VINYLDNS_POLLING_INTERVAL` | Time between DNS propagation check in seconds (Default: 4) |
 | `VINYLDNS_PROPAGATION_TIMEOUT` | Maximum waiting time for DNS propagation in seconds (Default: 120) |
 | `VINYLDNS_QUOTE_VALUE` | Adds quotes around the TXT record value (Default: false) |

docs/content/usage/cli/Options.md

@@ -143,6 +143,25 @@ Example:
 LEGO_DEBUG_CLIENT_VERBOSE_ERROR=true
 ```
 
+### LEGO_DEBUG_DNS_API_HTTP_CLIENT
+
+> **⚠️ WARNING: This will expose credentials in the log output! ⚠️**
+> 
+> Do not run this in production environments, or if you can't be sure that logs aren't accessed by third parties or tools (like log collectors).
+> 
+> You have been warned. Here be dragons.
+
+The environment variable `LEGO_DEBUG_DNS_API_HTTP_CLIENT` allows debugging the DNS API interaction.
+It will dump the full request and response to the log output.
+
+Some DNS providers don't support this option.
+
+Example:
+
+```bash
+LEGO_DEBUG_DNS_API_HTTP_CLIENT=true
+```
+
 ### LEGO_DEBUG_ACME_HTTP_CLIENT
 
 The environment variable `LEGO_DEBUG_ACME_HTTP_CLIENT` allows debug the calls to the ACME server.

go.mod

@@ -53,13 +53,13 @@ require (
 	github.com/mimuret/golang-iij-dpf v0.9.1
 	github.com/namedotcom/go/v4 v4.0.2
 	github.com/nrdcg/auroradns v1.1.0
-	github.com/nrdcg/bunny-go v0.0.0-20250327222614-988a091fc7ea
+	github.com/nrdcg/bunny-go v0.1.0
 	github.com/nrdcg/desec v0.11.0
 	github.com/nrdcg/dnspod-go v0.4.0
 	github.com/nrdcg/freemyip v0.3.0
 	github.com/nrdcg/goacmedns v0.2.0
 	github.com/nrdcg/goinwx v0.11.0
-	github.com/nrdcg/mailinabox v0.2.0
+	github.com/nrdcg/mailinabox v0.3.0
 	github.com/nrdcg/namesilo v0.5.0
 	github.com/nrdcg/nodion v0.1.0
 	github.com/nrdcg/oci-go-sdk/common/v1065 v1065.102.0

go.sum

@@ -685,8 +685,8 @@ github.com/nats-io/nuid v1.0.1/go.mod h1:19wcPz3Ph3q0Jbyiqsd0kePYG7A95tJPxeL+1OS
 github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno=
 github.com/nrdcg/auroradns v1.1.0 h1:KekGh8kmf2MNwqZVVYo/fw/ZONt8QMEmbMFOeljteWo=
 github.com/nrdcg/auroradns v1.1.0/go.mod h1:O7tViUZbAcnykVnrGkXzIJTHoQCHcgalgAe6X1mzHfk=
-github.com/nrdcg/bunny-go v0.0.0-20250327222614-988a091fc7ea h1:OSgRS4kqOs/WuxuFOObP2gwrenL4/qiKXQbQugr/Two=
-github.com/nrdcg/bunny-go v0.0.0-20250327222614-988a091fc7ea/go.mod h1:IDRRngAngb2eTEaWgpO0hukQFI/vJId46fT1KErMytA=
+github.com/nrdcg/bunny-go v0.1.0 h1:GAHTRpHaG/TxfLZlqoJ8OJFzw8rI74+jOTkzxWh0uHA=
+github.com/nrdcg/bunny-go v0.1.0/go.mod h1:u+C9dgsspgtWVaAz6QkyV17s9fxD8viwwKoxb9XMz1A=
 github.com/nrdcg/desec v0.11.0 h1:XZVHy07sg12y8FozMp+l7XvzPsdzog0AYXuQMaHBsfs=
 github.com/nrdcg/desec v0.11.0/go.mod h1:5+4vyhMRTs49V9CNoODF/HwT8Mwxv9DJ6j+7NekUnBs=
 github.com/nrdcg/dnspod-go v0.4.0 h1:c/jn1mLZNKF3/osJ6mz3QPxTudvPArXTjpkmYj0uK6U=
@@ -697,8 +697,8 @@ github.com/nrdcg/goacmedns v0.2.0 h1:ADMbThobzEMnr6kg2ohs4KGa3LFqmgiBA22/6jUWJR0
 github.com/nrdcg/goacmedns v0.2.0/go.mod h1:T5o6+xvSLrQpugmwHvrSNkzWht0UGAwj2ACBMhh73Cg=
 github.com/nrdcg/goinwx v0.11.0 h1:GER0SE3POub7rxARt3Y3jRy1OON1hwF1LRxHz5xsFBw=
 github.com/nrdcg/goinwx v0.11.0/go.mod h1:0BXSC0FxVtU4aTjX0Zw3x0DK32tjugLzeNIAGtwXvPQ=
-github.com/nrdcg/mailinabox v0.2.0 h1:IKq8mfKiVwNW2hQii/ng1dJ4yYMMv3HAP3fMFIq2CFk=
-github.com/nrdcg/mailinabox v0.2.0/go.mod h1:0yxqeYOiGyxAu7Sb94eMxHPIOsPYXAjTeA9ZhePhGnc=
+github.com/nrdcg/mailinabox v0.3.0 h1:PHkC1elKXKAjEvdx2HHFMgcEGZFqudAl7aU3L2JDhM4=
+github.com/nrdcg/mailinabox v0.3.0/go.mod h1:1eFIGcM4lI+AfFOUpbs548SFGz1ZWoMOGbECBmkghw4=
 github.com/nrdcg/namesilo v0.5.0 h1:6QNxT/XxE+f5B+7QlfWorthNzOzcGlBLRQxqi6YeBrE=
 github.com/nrdcg/namesilo v0.5.0/go.mod h1:4UkwlwQfDt74kSGmhLaDylnBrD94IfflnpoEaj6T2qw=
 github.com/nrdcg/nodion v0.1.0 h1:zLKaqTn2X0aDuBHHfyA1zFgeZfiCpmu/O9DM73okavw=

providers/dns/active24/active24.go

@@ -12,6 +12,7 @@ import (
 	"github.com/go-acme/lego/v4/challenge/dns01"
 	"github.com/go-acme/lego/v4/platform/config/env"
 	"github.com/go-acme/lego/v4/providers/dns/internal/active24"
+	"github.com/go-acme/lego/v4/providers/dns/internal/clientdebug"
 )
 
 const baseAPIDomain = "active24.cz"
@@ -87,6 +88,8 @@ func NewDNSProviderConfig(config *Config) (*DNSProvider, error) {
 		client.HTTPClient = config.HTTPClient
 	}
 
+	client.HTTPClient = clientdebug.Wrap(client.HTTPClient)
+
 	return &DNSProvider{
 		config: config,
 		client: client,

providers/dns/allinkl/allinkl.go

@@ -13,6 +13,7 @@ import (
 	"github.com/go-acme/lego/v4/challenge/dns01"
 	"github.com/go-acme/lego/v4/platform/config/env"
 	"github.com/go-acme/lego/v4/providers/dns/allinkl/internal"
+	"github.com/go-acme/lego/v4/providers/dns/internal/clientdebug"
 )
 
 // Environment variables names.
@@ -92,12 +93,16 @@ func NewDNSProviderConfig(config *Config) (*DNSProvider, error) {
 		identifier.HTTPClient = config.HTTPClient
 	}
 
+	identifier.HTTPClient = clientdebug.Wrap(identifier.HTTPClient)
+
 	client := internal.NewClient(config.Login)
 
 	if config.HTTPClient != nil {
 		client.HTTPClient = config.HTTPClient
 	}
 
+	client.HTTPClient = clientdebug.Wrap(client.HTTPClient)
+
 	return &DNSProvider{
 		config:     config,
 		identifier: identifier,

providers/dns/anexia/anexia.go

@@ -15,6 +15,7 @@ import (
 	"github.com/go-acme/lego/v4/challenge/dns01"
 	"github.com/go-acme/lego/v4/platform/config/env"
 	"github.com/go-acme/lego/v4/providers/dns/anexia/internal"
+	"github.com/go-acme/lego/v4/providers/dns/internal/clientdebug"
 )
 
 // Environment variables names.
@@ -105,6 +106,8 @@ func NewDNSProviderConfig(config *Config) (*DNSProvider, error) {
 		client.HTTPClient = config.HTTPClient
 	}
 
+	client.HTTPClient = clientdebug.Wrap(client.HTTPClient)
+
 	return &DNSProvider{
 		config: config,
 		client: client,

providers/dns/arvancloud/arvancloud.go

@@ -13,6 +13,7 @@ import (
 	"github.com/go-acme/lego/v4/challenge/dns01"
 	"github.com/go-acme/lego/v4/platform/config/env"
 	"github.com/go-acme/lego/v4/providers/dns/arvancloud/internal"
+	"github.com/go-acme/lego/v4/providers/dns/internal/clientdebug"
 )
 
 // Environment variables names.
@@ -95,6 +96,8 @@ func NewDNSProviderConfig(config *Config) (*DNSProvider, error) {
 		client.HTTPClient = config.HTTPClient
 	}
 
+	client.HTTPClient = clientdebug.Wrap(client.HTTPClient)
+
 	return &DNSProvider{
 		config:    config,
 		client:    client,

providers/dns/auroradns/auroradns.go

@@ -10,6 +10,7 @@ import (
 	"github.com/go-acme/lego/v4/challenge"
 	"github.com/go-acme/lego/v4/challenge/dns01"
 	"github.com/go-acme/lego/v4/platform/config/env"
+	"github.com/go-acme/lego/v4/providers/dns/internal/clientdebug"
 	"github.com/miekg/dns"
 	"github.com/nrdcg/auroradns"
 )
@@ -94,7 +95,7 @@ func NewDNSProviderConfig(config *Config) (*DNSProvider, error) {
 		return nil, fmt.Errorf("aurora: %w", err)
 	}
 
-	client, err := auroradns.NewClient(tr.Client(), auroradns.WithBaseURL(config.BaseURL))
+	client, err := auroradns.NewClient(clientdebug.Wrap(tr.Client()), auroradns.WithBaseURL(config.BaseURL))
 	if err != nil {
 		return nil, fmt.Errorf("aurora: %w", err)
 	}

providers/dns/autodns/autodns.go

@@ -13,6 +13,7 @@ import (
 	"github.com/go-acme/lego/v4/challenge/dns01"
 	"github.com/go-acme/lego/v4/platform/config/env"
 	"github.com/go-acme/lego/v4/providers/dns/autodns/internal"
+	"github.com/go-acme/lego/v4/providers/dns/internal/clientdebug"
 )
 
 // Environment variables names.
@@ -105,6 +106,8 @@ func NewDNSProviderConfig(config *Config) (*DNSProvider, error) {
 		client.HTTPClient = config.HTTPClient
 	}
 
+	client.HTTPClient = clientdebug.Wrap(client.HTTPClient)
+
 	return &DNSProvider{config: config, client: client}, nil
 }
 

providers/dns/axelname/axelname.go

@@ -11,6 +11,7 @@ import (
 	"github.com/go-acme/lego/v4/challenge/dns01"
 	"github.com/go-acme/lego/v4/platform/config/env"
 	"github.com/go-acme/lego/v4/providers/dns/axelname/internal"
+	"github.com/go-acme/lego/v4/providers/dns/internal/clientdebug"
 )
 
 // Environment variables names.
@@ -84,6 +85,8 @@ func NewDNSProviderConfig(config *Config) (*DNSProvider, error) {
 		client.HTTPClient = config.HTTPClient
 	}
 
+	client.HTTPClient = clientdebug.Wrap(client.HTTPClient)
+
 	return &DNSProvider{
 		config: config,
 		client: client,

providers/dns/azion/azion.go

@@ -12,6 +12,7 @@ import (
 	"github.com/aziontech/azionapi-go-sdk/idns"
 	"github.com/go-acme/lego/v4/challenge/dns01"
 	"github.com/go-acme/lego/v4/platform/config/env"
+	"github.com/go-acme/lego/v4/providers/dns/internal/clientdebug"
 )
 
 // Environment variables names.
@@ -92,6 +93,8 @@ func NewDNSProviderConfig(config *Config) (*DNSProvider, error) {
 		clientConfig.HTTPClient = config.HTTPClient
 	}
 
+	clientConfig.HTTPClient = clientdebug.Wrap(clientConfig.HTTPClient)
+
 	client := idns.NewAPIClient(clientConfig)
 
 	return &DNSProvider{

providers/dns/azuredns/azuredns.go

@@ -11,6 +11,7 @@ import (
 	"github.com/Azure/azure-sdk-for-go/sdk/azcore/cloud"
 	"github.com/go-acme/lego/v4/challenge"
 	"github.com/go-acme/lego/v4/platform/config/env"
+	"github.com/go-acme/lego/v4/providers/dns/internal/clientdebug"
 )
 
 // Environment variables names.
@@ -171,6 +172,8 @@ func NewDNSProviderConfig(config *Config) (*DNSProvider, error) {
 		config.HTTPClient = &http.Client{Timeout: 5 * time.Second}
 	}
 
+	config.HTTPClient = clientdebug.Wrap(config.HTTPClient)
+
 	credentials, err := getCredentials(config)
 	if err != nil {
 		return nil, fmt.Errorf("azuredns: Unable to retrieve valid credentials: %w", err)

providers/dns/beget/beget.go

@@ -12,6 +12,7 @@ import (
 	"github.com/go-acme/lego/v4/challenge/dns01"
 	"github.com/go-acme/lego/v4/platform/config/env"
 	"github.com/go-acme/lego/v4/providers/dns/beget/internal"
+	"github.com/go-acme/lego/v4/providers/dns/internal/clientdebug"
 )
 
 // Environment variables names.
@@ -90,6 +91,8 @@ func NewDNSProviderConfig(config *Config) (*DNSProvider, error) {
 		client.HTTPClient = config.HTTPClient
 	}
 
+	client.HTTPClient = clientdebug.Wrap(client.HTTPClient)
+
 	return &DNSProvider{config: config, client: client}, nil
 }
 

providers/dns/beget/beget_test.go

@@ -158,13 +158,13 @@ func mockBuilder() *servermock.Builder[*DNSProvider] {
 			config := NewDefaultConfig()
 			config.Username = "user"
 			config.Password = "secret"
+			config.HTTPClient = server.Client()
 
 			p, err := NewDNSProviderConfig(config)
 			if err != nil {
 				return nil, err
 			}
 
-			p.client.HTTPClient = server.Client()
 			p.client.BaseURL, _ = url.Parse(server.URL)
 
 			return p, nil

providers/dns/binarylane/binarylane.go

@@ -12,6 +12,7 @@ import (
 	"github.com/go-acme/lego/v4/challenge/dns01"
 	"github.com/go-acme/lego/v4/platform/config/env"
 	"github.com/go-acme/lego/v4/providers/dns/binarylane/internal"
+	"github.com/go-acme/lego/v4/providers/dns/internal/clientdebug"
 )
 
 // Environment variables names.
@@ -85,6 +86,8 @@ func NewDNSProviderConfig(config *Config) (*DNSProvider, error) {
 		client.HTTPClient = config.HTTPClient
 	}
 
+	client.HTTPClient = clientdebug.Wrap(client.HTTPClient)
+
 	return &DNSProvider{
 		config:    config,
 		client:    client,

providers/dns/bindman/bindman.go

@@ -10,7 +10,8 @@ import (
 	"github.com/go-acme/lego/v4/challenge"
 	"github.com/go-acme/lego/v4/challenge/dns01"
 	"github.com/go-acme/lego/v4/platform/config/env"
-	"github.com/labbsr0x/bindman-dns-webhook/src/client"
+	"github.com/go-acme/lego/v4/providers/dns/internal/clientdebug"
+	bindman "github.com/labbsr0x/bindman-dns-webhook/src/client"
 )
 
 // Environment variables names.
@@ -48,7 +49,7 @@ func NewDefaultConfig() *Config {
 // DNSProvider implements the challenge.Provider interface.
 type DNSProvider struct {
 	config *Config
-	client *client.DNSWebhookClient
+	client *bindman.DNSWebhookClient
 }
 
 // NewDNSProvider returns a DNSProvider instance configured for Bindman.
@@ -75,12 +76,17 @@ func NewDNSProviderConfig(config *Config) (*DNSProvider, error) {
 		return nil, errors.New("bindman: bindman manager address missing")
 	}
 
-	bClient, err := client.New(config.BaseURL, config.HTTPClient)
+	// Because the client.New uses the http.DefaultClient.
+	if config.HTTPClient == nil {
+		config.HTTPClient = &http.Client{Timeout: time.Minute}
+	}
+
+	client, err := bindman.New(config.BaseURL, clientdebug.Wrap(config.HTTPClient))
 	if err != nil {
 		return nil, fmt.Errorf("bindman: %w", err)
 	}
 
-	return &DNSProvider{config: config, client: bClient}, nil
+	return &DNSProvider{config: config, client: client}, nil
 }
 
 // Present creates a TXT record using the specified parameters.

providers/dns/bluecat/bluecat.go

@@ -13,6 +13,7 @@ import (
 	"github.com/go-acme/lego/v4/log"
 	"github.com/go-acme/lego/v4/platform/config/env"
 	"github.com/go-acme/lego/v4/providers/dns/bluecat/internal"
+	"github.com/go-acme/lego/v4/providers/dns/internal/clientdebug"
 )
 
 // Environment variables names.
@@ -110,6 +111,8 @@ func NewDNSProviderConfig(config *Config) (*DNSProvider, error) {
 		client.HTTPClient = config.HTTPClient
 	}
 
+	client.HTTPClient = clientdebug.Wrap(client.HTTPClient)
+
 	return &DNSProvider{config: config, client: client}, nil
 }
 

providers/dns/bookmyname/bookmyname.go

@@ -12,6 +12,7 @@ import (
 	"github.com/go-acme/lego/v4/challenge/dns01"
 	"github.com/go-acme/lego/v4/platform/config/env"
 	"github.com/go-acme/lego/v4/providers/dns/bookmyname/internal"
+	"github.com/go-acme/lego/v4/providers/dns/internal/clientdebug"
 )
 
 // Environment variables names.
@@ -87,6 +88,8 @@ func NewDNSProviderConfig(config *Config) (*DNSProvider, error) {
 		client.HTTPClient = config.HTTPClient
 	}
 
+	client.HTTPClient = clientdebug.Wrap(client.HTTPClient)
+
 	return &DNSProvider{
 		config: config,
 		client: client,

providers/dns/brandit/brandit.go

@@ -13,6 +13,7 @@ import (
 	"github.com/go-acme/lego/v4/challenge/dns01"
 	"github.com/go-acme/lego/v4/platform/config/env"
 	"github.com/go-acme/lego/v4/providers/dns/brandit/internal"
+	"github.com/go-acme/lego/v4/providers/dns/internal/clientdebug"
 )
 
 // Environment variables names.
@@ -92,6 +93,8 @@ func NewDNSProviderConfig(config *Config) (*DNSProvider, error) {
 		client.HTTPClient = config.HTTPClient
 	}
 
+	client.HTTPClient = clientdebug.Wrap(client.HTTPClient)
+
 	return &DNSProvider{
 		config:  config,
 		client:  client,

providers/dns/bunny/bunny.go

@@ -5,13 +5,16 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"net/http"
 	"slices"
 	"time"
 
 	"github.com/go-acme/lego/v4/challenge"
 	"github.com/go-acme/lego/v4/challenge/dns01"
 	"github.com/go-acme/lego/v4/platform/config/env"
+	"github.com/go-acme/lego/v4/providers/dns/internal/clientdebug"
 	"github.com/go-acme/lego/v4/providers/dns/internal/ptr"
+	"github.com/go-acme/lego/v4/providers/dns/internal/useragent"
 	"github.com/nrdcg/bunny-go"
 	"golang.org/x/net/publicsuffix"
 )
@@ -25,6 +28,7 @@ const (
 	EnvTTL                = envNamespace + "TTL"
 	EnvPropagationTimeout = envNamespace + "PROPAGATION_TIMEOUT"
 	EnvPollingInterval    = envNamespace + "POLLING_INTERVAL"
+	EnvHTTPTimeout        = envNamespace + "HTTP_TIMEOUT"
 )
 
 const minTTL = 60
@@ -33,10 +37,12 @@ var _ challenge.ProviderTimeout = (*DNSProvider)(nil)
 
 // Config is used to configure the creation of the DNSProvider.
 type Config struct {
-	APIKey             string
+	APIKey string
+
 	PropagationTimeout time.Duration
 	PollingInterval    time.Duration
 	TTL                int
+	HTTPClient         *http.Client
 }
 
 // NewDefaultConfig returns a default configuration for the DNSProvider.
@@ -45,6 +51,9 @@ func NewDefaultConfig() *Config {
 		TTL:                env.GetOrDefaultInt(EnvTTL, minTTL),
 		PropagationTimeout: env.GetOrDefaultSecond(EnvPropagationTimeout, 120*time.Second),
 		PollingInterval:    env.GetOrDefaultSecond(EnvPollingInterval, dns01.DefaultPollingInterval),
+		HTTPClient: &http.Client{
+			Timeout: env.GetOrDefaultSecond(EnvHTTPTimeout, 30*time.Second),
+		},
 	}
 }
 
@@ -82,9 +91,19 @@ func NewDNSProviderConfig(config *Config) (*DNSProvider, error) {
 		return nil, fmt.Errorf("bunny: invalid TTL, TTL (%d) must be greater than %d", config.TTL, minTTL)
 	}
 
-	client := bunny.NewClient(config.APIKey)
+	if config.HTTPClient == nil {
+		config.HTTPClient = &http.Client{Timeout: 30 * time.Second}
+	}
 
-	return &DNSProvider{config: config, client: client}, nil
+	config.HTTPClient = clientdebug.Wrap(config.HTTPClient)
+
+	return &DNSProvider{
+		config: config,
+		client: bunny.NewClient(config.APIKey,
+			bunny.WithUserAgent(useragent.Get()),
+			bunny.WithHTTPClient(config.HTTPClient),
+		),
+	}, nil
 }
 
 // Timeout returns the timeout and interval to use when checking for DNS propagation.

providers/dns/bunny/bunny.toml

@@ -16,6 +16,7 @@ lego --email you@example.com --dns bunny -d '*.example.com' -d example.com run
     BUNNY_POLLING_INTERVAL = "Time between DNS propagation check in seconds (Default: 2)"
     BUNNY_PROPAGATION_TIMEOUT = "Maximum waiting time for DNS propagation in seconds (Default: 120)"
     BUNNY_TTL = "The TTL of the TXT record used for the DNS challenge in seconds (Default: 60)"
+    BUNNY_HTTP_TIMEOUT = "API request timeout in seconds (Default: 30)"
 
 [Links]
   API = "https://docs.bunny.net/reference/dnszonepublic_index"

providers/dns/checkdomain/checkdomain.go

@@ -13,6 +13,7 @@ import (
 	"github.com/go-acme/lego/v4/challenge/dns01"
 	"github.com/go-acme/lego/v4/platform/config/env"
 	"github.com/go-acme/lego/v4/providers/dns/checkdomain/internal"
+	"github.com/go-acme/lego/v4/providers/dns/internal/clientdebug"
 )
 
 // Environment variables names.
@@ -86,7 +87,11 @@ func NewDNSProviderConfig(config *Config) (*DNSProvider, error) {
 		return nil, errors.New("checkdomain: missing token")
 	}
 
-	client := internal.NewClient(internal.OAuthStaticAccessToken(config.HTTPClient, config.Token))
+	client := internal.NewClient(
+		clientdebug.Wrap(
+			internal.OAuthStaticAccessToken(config.HTTPClient, config.Token),
+		),
+	)
 
 	if config.Endpoint != nil {
 		client.BaseURL = config.Endpoint

providers/dns/civo/civo.go

@@ -12,6 +12,7 @@ import (
 	"github.com/go-acme/lego/v4/challenge/dns01"
 	"github.com/go-acme/lego/v4/platform/config/env"
 	"github.com/go-acme/lego/v4/providers/dns/civo/internal"
+	"github.com/go-acme/lego/v4/providers/dns/internal/clientdebug"
 )
 
 // Environment variables names.
@@ -91,7 +92,11 @@ func NewDNSProviderConfig(config *Config) (*DNSProvider, error) {
 	}
 
 	// Create a Civo client - DNS is region independent, we can use any region
-	client, err := internal.NewClient(internal.OAuthStaticAccessToken(config.HTTPClient, config.Token), "LON1")
+	client, err := internal.NewClient(
+		clientdebug.Wrap(
+			internal.OAuthStaticAccessToken(config.HTTPClient, config.Token),
+		),
+		"LON1")
 	if err != nil {
 		return nil, fmt.Errorf("civo: %w", err)
 	}

providers/dns/clouddns/clouddns.go

@@ -12,6 +12,7 @@ import (
 	"github.com/go-acme/lego/v4/challenge/dns01"
 	"github.com/go-acme/lego/v4/platform/config/env"
 	"github.com/go-acme/lego/v4/providers/dns/clouddns/internal"
+	"github.com/go-acme/lego/v4/providers/dns/internal/clientdebug"
 )
 
 // Environment variables names.
@@ -93,6 +94,8 @@ func NewDNSProviderConfig(config *Config) (*DNSProvider, error) {
 		client.HTTPClient = config.HTTPClient
 	}
 
+	client.HTTPClient = clientdebug.Wrap(client.HTTPClient)
+
 	return &DNSProvider{client: client, config: config}, nil
 }
 

providers/dns/cloudflare/internal/client.go

@@ -17,6 +17,7 @@ import (
 	"net/url"
 	"time"
 
+	"github.com/go-acme/lego/v4/providers/dns/internal/clientdebug"
 	"github.com/go-acme/lego/v4/providers/dns/internal/errutils"
 	"github.com/go-acme/lego/v4/providers/dns/internal/useragent"
 )
@@ -61,6 +62,8 @@ func NewClient(opts ...Option) (*Client, error) {
 		return nil, errors.New("invalid credentials: authEmail and authKey must be set together")
 	}
 
+	client.HTTPClient = clientdebug.Wrap(client.HTTPClient)
+
 	return client, nil
 }
 

providers/dns/cloudns/cloudns.go

@@ -15,6 +15,7 @@ import (
 	"github.com/go-acme/lego/v4/platform/config/env"
 	"github.com/go-acme/lego/v4/platform/wait"
 	"github.com/go-acme/lego/v4/providers/dns/cloudns/internal"
+	"github.com/go-acme/lego/v4/providers/dns/internal/clientdebug"
 )
 
 // Environment variables names.
@@ -100,7 +101,11 @@ func NewDNSProviderConfig(config *Config) (*DNSProvider, error) {
 		return nil, fmt.Errorf("ClouDNS: %w", err)
 	}
 
-	client.HTTPClient = config.HTTPClient
+	if config.HTTPClient != nil {
+		client.HTTPClient = config.HTTPClient
+	}
+
+	client.HTTPClient = clientdebug.Wrap(client.HTTPClient)
 
 	return &DNSProvider{client: client, config: config}, nil
 }

providers/dns/cloudru/cloudru.go

@@ -14,6 +14,7 @@ import (
 	"github.com/go-acme/lego/v4/challenge/dns01"
 	"github.com/go-acme/lego/v4/platform/config/env"
 	"github.com/go-acme/lego/v4/providers/dns/cloudru/internal"
+	"github.com/go-acme/lego/v4/providers/dns/internal/clientdebug"
 )
 
 // Environment variables names.
@@ -99,6 +100,8 @@ func NewDNSProviderConfig(config *Config) (*DNSProvider, error) {
 		client.HTTPClient = config.HTTPClient
 	}
 
+	client.HTTPClient = clientdebug.Wrap(client.HTTPClient)
+
 	return &DNSProvider{
 		config:  config,
 		client:  client,

providers/dns/conoha/conoha.go

@@ -12,6 +12,7 @@ import (
 	"github.com/go-acme/lego/v4/challenge/dns01"
 	"github.com/go-acme/lego/v4/platform/config/env"
 	"github.com/go-acme/lego/v4/providers/dns/conoha/internal"
+	"github.com/go-acme/lego/v4/providers/dns/internal/clientdebug"
 )
 
 // Environment variables names.
@@ -98,6 +99,8 @@ func NewDNSProviderConfig(config *Config) (*DNSProvider, error) {
 		identifier.HTTPClient = config.HTTPClient
 	}
 
+	identifier.HTTPClient = clientdebug.Wrap(identifier.HTTPClient)
+
 	auth := internal.Auth{
 		TenantID: config.TenantID,
 		PasswordCredentials: internal.PasswordCredentials{
@@ -120,6 +123,8 @@ func NewDNSProviderConfig(config *Config) (*DNSProvider, error) {
 		client.HTTPClient = config.HTTPClient
 	}
 
+	client.HTTPClient = clientdebug.Wrap(client.HTTPClient)
+
 	return &DNSProvider{config: config, client: client}, nil
 }
 

providers/dns/conohav3/conohav3.go

@@ -12,6 +12,7 @@ import (
 	"github.com/go-acme/lego/v4/challenge/dns01"
 	"github.com/go-acme/lego/v4/platform/config/env"
 	"github.com/go-acme/lego/v4/providers/dns/conohav3/internal"
+	"github.com/go-acme/lego/v4/providers/dns/internal/clientdebug"
 )
 
 // Environment variables names.
@@ -98,6 +99,8 @@ func NewDNSProviderConfig(config *Config) (*DNSProvider, error) {
 		identifier.HTTPClient = config.HTTPClient
 	}
 
+	identifier.HTTPClient = clientdebug.Wrap(identifier.HTTPClient)
+
 	auth := internal.Auth{
 		Identity: internal.Identity{
 			Methods: []string{"password"},
@@ -129,6 +132,8 @@ func NewDNSProviderConfig(config *Config) (*DNSProvider, error) {
 		client.HTTPClient = config.HTTPClient
 	}
 
+	client.HTTPClient = clientdebug.Wrap(client.HTTPClient)
+
 	return &DNSProvider{config: config, client: client}, nil
 }
 

providers/dns/constellix/constellix.go

@@ -14,6 +14,7 @@ import (
 	"github.com/go-acme/lego/v4/challenge/dns01"
 	"github.com/go-acme/lego/v4/platform/config/env"
 	"github.com/go-acme/lego/v4/providers/dns/constellix/internal"
+	"github.com/go-acme/lego/v4/providers/dns/internal/clientdebug"
 	"github.com/hashicorp/go-retryablehttp"
 )
 
@@ -96,7 +97,7 @@ func NewDNSProviderConfig(config *Config) (*DNSProvider, error) {
 	retryClient.HTTPClient = tr.Wrap(config.HTTPClient)
 	retryClient.Backoff = backoff
 
-	client := internal.NewClient(retryClient.StandardClient())
+	client := internal.NewClient(clientdebug.Wrap(retryClient.StandardClient()))
 
 	return &DNSProvider{config: config, client: client}, nil
 }

providers/dns/corenetworks/corenetworks.go

@@ -11,6 +11,7 @@ import (
 	"github.com/go-acme/lego/v4/challenge/dns01"
 	"github.com/go-acme/lego/v4/platform/config/env"
 	"github.com/go-acme/lego/v4/providers/dns/corenetworks/internal"
+	"github.com/go-acme/lego/v4/providers/dns/internal/clientdebug"
 )
 
 // Environment variables names.
@@ -90,6 +91,8 @@ func NewDNSProviderConfig(config *Config) (*DNSProvider, error) {
 		client.HTTPClient = config.HTTPClient
 	}
 
+	client.HTTPClient = clientdebug.Wrap(client.HTTPClient)
+
 	return &DNSProvider{config: config, client: client}, nil
 }
 

providers/dns/cpanel/cpanel.go

@@ -17,6 +17,7 @@ import (
 	"github.com/go-acme/lego/v4/providers/dns/cpanel/internal/cpanel"
 	"github.com/go-acme/lego/v4/providers/dns/cpanel/internal/shared"
 	"github.com/go-acme/lego/v4/providers/dns/cpanel/internal/whm"
+	"github.com/go-acme/lego/v4/providers/dns/internal/clientdebug"
 )
 
 // Environment variables names.
@@ -314,6 +315,8 @@ func createClient(config *Config) (apiClient, error) {
 			client.HTTPClient = config.HTTPClient
 		}
 
+		client.HTTPClient = clientdebug.Wrap(client.HTTPClient)
+
 		return client, nil
 
 	case "whm":
@@ -326,6 +329,8 @@ func createClient(config *Config) (apiClient, error) {
 			client.HTTPClient = config.HTTPClient
 		}
 
+		client.HTTPClient = clientdebug.Wrap(client.HTTPClient)
+
 		return client, nil
 
 	default:

providers/dns/derak/derak.go

@@ -14,6 +14,7 @@ import (
 	"github.com/go-acme/lego/v4/challenge/dns01"
 	"github.com/go-acme/lego/v4/platform/config/env"
 	"github.com/go-acme/lego/v4/providers/dns/derak/internal"
+	"github.com/go-acme/lego/v4/providers/dns/internal/clientdebug"
 	"github.com/miekg/dns"
 )
 
@@ -94,6 +95,8 @@ func NewDNSProviderConfig(config *Config) (*DNSProvider, error) {
 		client.HTTPClient = config.HTTPClient
 	}
 
+	client.HTTPClient = clientdebug.Wrap(client.HTTPClient)
+
 	return &DNSProvider{
 		config:    config,
 		client:    client,

providers/dns/desec/desec.go

@@ -12,6 +12,7 @@ import (
 	"github.com/go-acme/lego/v4/challenge"
 	"github.com/go-acme/lego/v4/challenge/dns01"
 	"github.com/go-acme/lego/v4/platform/config/env"
+	"github.com/go-acme/lego/v4/providers/dns/internal/clientdebug"
 	"github.com/nrdcg/desec"
 )
 
@@ -87,7 +88,14 @@ func NewDNSProviderConfig(config *Config) (*DNSProvider, error) {
 	opts := desec.NewDefaultClientOptions()
 	if config.HTTPClient != nil {
 		opts.HTTPClient = config.HTTPClient
+	} else {
+		// Because the desec.NewDefaultClientOptions uses the http.DefaultClient.
+		// TODO(ldez): change the desec lib.
+		opts.HTTPClient = &http.Client{Timeout: 30 * time.Second}
 	}
+
+	opts.HTTPClient = clientdebug.Wrap(opts.HTTPClient)
+
 	opts.Logger = log.Default()
 
 	client := desec.New(config.Token, opts)

providers/dns/digitalocean/digitalocean.go

@@ -14,6 +14,7 @@ import (
 	"github.com/go-acme/lego/v4/challenge/dns01"
 	"github.com/go-acme/lego/v4/platform/config/env"
 	"github.com/go-acme/lego/v4/providers/dns/digitalocean/internal"
+	"github.com/go-acme/lego/v4/providers/dns/internal/clientdebug"
 )
 
 // Environment variables names.
@@ -88,7 +89,11 @@ func NewDNSProviderConfig(config *Config) (*DNSProvider, error) {
 		return nil, errors.New("digitalocean: credentials missing")
 	}
 
-	client := internal.NewClient(internal.OAuthStaticAccessToken(config.HTTPClient, config.AuthToken))
+	client := internal.NewClient(
+		clientdebug.Wrap(
+			internal.OAuthStaticAccessToken(config.HTTPClient, config.AuthToken),
+		),
+	)
 
 	if config.BaseURL != "" {
 		var err error

providers/dns/directadmin/directadmin.go

@@ -11,6 +11,7 @@ import (
 	"github.com/go-acme/lego/v4/challenge/dns01"
 	"github.com/go-acme/lego/v4/platform/config/env"
 	"github.com/go-acme/lego/v4/providers/dns/directadmin/internal"
+	"github.com/go-acme/lego/v4/providers/dns/internal/clientdebug"
 )
 
 // Environment variables names.
@@ -99,6 +100,8 @@ func NewDNSProviderConfig(config *Config) (*DNSProvider, error) {
 		client.HTTPClient = config.HTTPClient
 	}
 
+	client.HTTPClient = clientdebug.Wrap(client.HTTPClient)
+
 	return &DNSProvider{client: client, config: config}, nil
 }
 

providers/dns/dnshomede/dnshomede.go

@@ -11,6 +11,7 @@ import (
 	"github.com/go-acme/lego/v4/challenge/dns01"
 	"github.com/go-acme/lego/v4/platform/config/env"
 	"github.com/go-acme/lego/v4/providers/dns/dnshomede/internal"
+	"github.com/go-acme/lego/v4/providers/dns/internal/clientdebug"
 )
 
 // Environment variables names.
@@ -92,6 +93,12 @@ func NewDNSProviderConfig(config *Config) (*DNSProvider, error) {
 
 	client := internal.NewClient(config.Credentials)
 
+	if config.HTTPClient != nil {
+		client.HTTPClient = config.HTTPClient
+	}
+
+	client.HTTPClient = clientdebug.Wrap(client.HTTPClient)
+
 	return &DNSProvider{config: config, client: client}, nil
 }
 

providers/dns/dnsimple/dnsimple.go

@@ -12,6 +12,7 @@ import (
 	"github.com/go-acme/lego/v4/challenge"
 	"github.com/go-acme/lego/v4/challenge/dns01"
 	"github.com/go-acme/lego/v4/platform/config/env"
+	"github.com/go-acme/lego/v4/providers/dns/internal/clientdebug"
 	"github.com/go-acme/lego/v4/providers/dns/internal/useragent"
 	"golang.org/x/oauth2"
 )
@@ -79,8 +80,14 @@ func NewDNSProviderConfig(config *Config) (*DNSProvider, error) {
 		return nil, errors.New("dnsimple: OAuth token is missing")
 	}
 
-	ts := oauth2.StaticTokenSource(&oauth2.Token{AccessToken: config.AccessToken})
-	client := dnsimple.NewClient(oauth2.NewClient(context.Background(), ts))
+	client := dnsimple.NewClient(
+		clientdebug.Wrap(
+			oauth2.NewClient(
+				context.Background(),
+				oauth2.StaticTokenSource(&oauth2.Token{AccessToken: config.AccessToken}),
+			),
+		),
+	)
 	client.SetUserAgent(useragent.Get())
 
 	if config.BaseURL != "" {

providers/dns/dnsmadeeasy/dnsmadeeasy.go

@@ -15,6 +15,7 @@ import (
 	"github.com/go-acme/lego/v4/challenge/dns01"
 	"github.com/go-acme/lego/v4/platform/config/env"
 	"github.com/go-acme/lego/v4/providers/dns/dnsmadeeasy/internal"
+	"github.com/go-acme/lego/v4/providers/dns/internal/clientdebug"
 )
 
 // Environment variables names.
@@ -112,7 +113,12 @@ func NewDNSProviderConfig(config *Config) (*DNSProvider, error) {
 		return nil, fmt.Errorf("dnsmadeeasy: %w", err)
 	}
 
-	client.HTTPClient = config.HTTPClient
+	if config.HTTPClient != nil {
+		client.HTTPClient = config.HTTPClient
+	}
+
+	client.HTTPClient = clientdebug.Wrap(client.HTTPClient)
+
 	client.BaseURL, err = url.Parse(baseURL)
 	if err != nil {
 		return nil, err

providers/dns/dnspod/dnspod.go

@@ -11,6 +11,7 @@ import (
 	"github.com/go-acme/lego/v4/challenge"
 	"github.com/go-acme/lego/v4/challenge/dns01"
 	"github.com/go-acme/lego/v4/platform/config/env"
+	"github.com/go-acme/lego/v4/providers/dns/internal/clientdebug"
 	"github.com/nrdcg/dnspod-go"
 )
 
@@ -82,7 +83,12 @@ func NewDNSProviderConfig(config *Config) (*DNSProvider, error) {
 	params := dnspod.CommonParams{LoginToken: config.LoginToken, Format: "json"}
 
 	client := dnspod.NewClient(params)
-	client.HTTPClient = config.HTTPClient
+
+	if config.HTTPClient != nil {
+		client.HTTPClient = config.HTTPClient
+	}
+
+	client.HTTPClient = clientdebug.Wrap(client.HTTPClient)
 
 	return &DNSProvider{client: client, config: config}, nil
 }

providers/dns/dode/dode.go

@@ -12,6 +12,7 @@ import (
 	"github.com/go-acme/lego/v4/challenge/dns01"
 	"github.com/go-acme/lego/v4/platform/config/env"
 	"github.com/go-acme/lego/v4/providers/dns/dode/internal"
+	"github.com/go-acme/lego/v4/providers/dns/internal/clientdebug"
 )
 
 // Environment variables names.
@@ -85,6 +86,8 @@ func NewDNSProviderConfig(config *Config) (*DNSProvider, error) {
 		client.HTTPClient = config.HTTPClient
 	}
 
+	client.HTTPClient = clientdebug.Wrap(client.HTTPClient)
+
 	return &DNSProvider{config: config, client: client}, nil
 }
 

providers/dns/domeneshop/domeneshop.go

@@ -12,6 +12,7 @@ import (
 	"github.com/go-acme/lego/v4/challenge/dns01"
 	"github.com/go-acme/lego/v4/platform/config/env"
 	"github.com/go-acme/lego/v4/providers/dns/domeneshop/internal"
+	"github.com/go-acme/lego/v4/providers/dns/internal/clientdebug"
 )
 
 // Environment variables names.
@@ -86,6 +87,8 @@ func NewDNSProviderConfig(config *Config) (*DNSProvider, error) {
 		client.HTTPClient = config.HTTPClient
 	}
 
+	client.HTTPClient = clientdebug.Wrap(client.HTTPClient)
+
 	return &DNSProvider{config: config, client: client}, nil
 }
 

providers/dns/dreamhost/dreamhost.go

@@ -14,6 +14,7 @@ import (
 	"github.com/go-acme/lego/v4/challenge/dns01"
 	"github.com/go-acme/lego/v4/platform/config/env"
 	"github.com/go-acme/lego/v4/providers/dns/dreamhost/internal"
+	"github.com/go-acme/lego/v4/providers/dns/internal/clientdebug"
 )
 
 // Environment variables names.
@@ -86,6 +87,8 @@ func NewDNSProviderConfig(config *Config) (*DNSProvider, error) {
 		client.HTTPClient = config.HTTPClient
 	}
 
+	client.HTTPClient = clientdebug.Wrap(client.HTTPClient)
+
 	if config.BaseURL != "" {
 		client.BaseURL = config.BaseURL
 	}

providers/dns/duckdns/duckdns.go

@@ -13,6 +13,7 @@ import (
 	"github.com/go-acme/lego/v4/challenge/dns01"
 	"github.com/go-acme/lego/v4/platform/config/env"
 	"github.com/go-acme/lego/v4/providers/dns/duckdns/internal"
+	"github.com/go-acme/lego/v4/providers/dns/internal/clientdebug"
 )
 
 // Environment variables names.
@@ -86,6 +87,8 @@ func NewDNSProviderConfig(config *Config) (*DNSProvider, error) {
 		client.HTTPClient = config.HTTPClient
 	}
 
+	client.HTTPClient = clientdebug.Wrap(client.HTTPClient)
+
 	return &DNSProvider{config: config, client: client}, nil
 }
 

providers/dns/dyn/dyn.go

@@ -12,6 +12,7 @@ import (
 	"github.com/go-acme/lego/v4/challenge/dns01"
 	"github.com/go-acme/lego/v4/platform/config/env"
 	"github.com/go-acme/lego/v4/providers/dns/dyn/internal"
+	"github.com/go-acme/lego/v4/providers/dns/internal/clientdebug"
 )
 
 // Environment variables names.
@@ -92,6 +93,8 @@ func NewDNSProviderConfig(config *Config) (*DNSProvider, error) {
 		client.HTTPClient = config.HTTPClient
 	}
 
+	client.HTTPClient = clientdebug.Wrap(client.HTTPClient)
+
 	return &DNSProvider{config: config, client: client}, nil
 }
 

providers/dns/dyndnsfree/dyndnsfree.go

@@ -11,6 +11,7 @@ import (
 	"github.com/go-acme/lego/v4/challenge/dns01"
 	"github.com/go-acme/lego/v4/platform/config/env"
 	"github.com/go-acme/lego/v4/providers/dns/dyndnsfree/internal"
+	"github.com/go-acme/lego/v4/providers/dns/internal/clientdebug"
 )
 
 // Environment variables names.
@@ -81,6 +82,8 @@ func NewDNSProviderConfig(config *Config) (*DNSProvider, error) {
 		client.HTTPClient = config.HTTPClient
 	}
 
+	client.HTTPClient = clientdebug.Wrap(client.HTTPClient)
+
 	return &DNSProvider{
 		config: config,
 		client: client,

providers/dns/dynu/dynu.go

@@ -12,6 +12,7 @@ import (
 	"github.com/go-acme/lego/v4/challenge/dns01"
 	"github.com/go-acme/lego/v4/platform/config/env"
 	"github.com/go-acme/lego/v4/providers/dns/dynu/internal"
+	"github.com/go-acme/lego/v4/providers/dns/internal/clientdebug"
 )
 
 // Environment variables names.
@@ -86,7 +87,8 @@ func NewDNSProviderConfig(config *Config) (*DNSProvider, error) {
 	}
 
 	client := internal.NewClient()
-	client.HTTPClient = tr.Wrap(config.HTTPClient)
+
+	client.HTTPClient = clientdebug.Wrap(tr.Wrap(config.HTTPClient))
 
 	return &DNSProvider{config: config, client: client}, nil
 }

providers/dns/easydns/easydns.go

@@ -16,6 +16,7 @@ import (
 	"github.com/go-acme/lego/v4/challenge/dns01"
 	"github.com/go-acme/lego/v4/platform/config/env"
 	"github.com/go-acme/lego/v4/providers/dns/easydns/internal"
+	"github.com/go-acme/lego/v4/providers/dns/internal/clientdebug"
 )
 
 // Environment variables names.
@@ -110,6 +111,8 @@ func NewDNSProviderConfig(config *Config) (*DNSProvider, error) {
 		client.HTTPClient = config.HTTPClient
 	}
 
+	client.HTTPClient = clientdebug.Wrap(client.HTTPClient)
+
 	if config.Endpoint != nil {
 		client.BaseURL = config.Endpoint
 	}

providers/dns/efficientip/efficientip.go

@@ -13,6 +13,7 @@ import (
 	"github.com/go-acme/lego/v4/challenge/dns01"
 	"github.com/go-acme/lego/v4/platform/config/env"
 	"github.com/go-acme/lego/v4/providers/dns/efficientip/internal"
+	"github.com/go-acme/lego/v4/providers/dns/internal/clientdebug"
 )
 
 // Environment variables names.
@@ -113,6 +114,8 @@ func NewDNSProviderConfig(config *Config) (*DNSProvider, error) {
 		}
 	}
 
+	client.HTTPClient = clientdebug.Wrap(client.HTTPClient)
+
 	return &DNSProvider{config: config, client: client}, nil
 }
 

providers/dns/epik/epik.go

@@ -13,6 +13,7 @@ import (
 	"github.com/go-acme/lego/v4/challenge/dns01"
 	"github.com/go-acme/lego/v4/platform/config/env"
 	"github.com/go-acme/lego/v4/providers/dns/epik/internal"
+	"github.com/go-acme/lego/v4/providers/dns/internal/clientdebug"
 )
 
 // Environment variables names.
@@ -86,6 +87,8 @@ func NewDNSProviderConfig(config *Config) (*DNSProvider, error) {
 		client.HTTPClient = config.HTTPClient
 	}
 
+	client.HTTPClient = clientdebug.Wrap(client.HTTPClient)
+
 	return &DNSProvider{config: config, client: client}, nil
 }
 

providers/dns/exoscale/exoscale.go

@@ -14,6 +14,7 @@ import (
 	"github.com/go-acme/lego/v4/challenge"
 	"github.com/go-acme/lego/v4/challenge/dns01"
 	"github.com/go-acme/lego/v4/platform/config/env"
+	"github.com/go-acme/lego/v4/providers/dns/internal/clientdebug"
 	"github.com/go-acme/lego/v4/providers/dns/internal/useragent"
 )
 
@@ -89,7 +90,7 @@ func NewDNSProviderConfig(config *Config) (*DNSProvider, error) {
 	client, err := egoscale.NewClient(
 		credentials.NewStaticCredentials(config.APIKey, config.APISecret),
 		egoscale.ClientOptWithEndpoint(egoscale.Endpoint(config.Endpoint)),
-		egoscale.ClientOptWithHTTPClient(&http.Client{Timeout: config.HTTPTimeout}),
+		egoscale.ClientOptWithHTTPClient(clientdebug.Wrap(&http.Client{Timeout: config.HTTPTimeout})),
 		egoscale.ClientOptWithUserAgent(useragent.Get()),
 	)
 	if err != nil {

providers/dns/f5xc/f5xc.go

@@ -13,6 +13,7 @@ import (
 	"github.com/go-acme/lego/v4/platform/config/env"
 	"github.com/go-acme/lego/v4/platform/wait"
 	"github.com/go-acme/lego/v4/providers/dns/f5xc/internal"
+	"github.com/go-acme/lego/v4/providers/dns/internal/clientdebug"
 )
 
 // Environment variables names.
@@ -93,6 +94,8 @@ func NewDNSProviderConfig(config *Config) (*DNSProvider, error) {
 		client.HTTPClient = config.HTTPClient
 	}
 
+	client.HTTPClient = clientdebug.Wrap(client.HTTPClient)
+
 	return &DNSProvider{
 		config: config,
 		client: client,

providers/dns/freemyip/freemyip.go

@@ -11,6 +11,7 @@ import (
 	"github.com/go-acme/lego/v4/challenge"
 	"github.com/go-acme/lego/v4/challenge/dns01"
 	"github.com/go-acme/lego/v4/platform/config/env"
+	"github.com/go-acme/lego/v4/providers/dns/internal/clientdebug"
 	"github.com/nrdcg/freemyip"
 )
 
@@ -88,6 +89,8 @@ func NewDNSProviderConfig(config *Config) (*DNSProvider, error) {
 		client.HTTPClient = config.HTTPClient
 	}
 
+	client.HTTPClient = clientdebug.Wrap(client.HTTPClient)
+
 	return &DNSProvider{
 		config: config,
 		client: client,

providers/dns/gandi/gandi.go

@@ -13,6 +13,7 @@ import (
 	"github.com/go-acme/lego/v4/challenge/dns01"
 	"github.com/go-acme/lego/v4/platform/config/env"
 	"github.com/go-acme/lego/v4/providers/dns/gandi/internal"
+	"github.com/go-acme/lego/v4/providers/dns/internal/clientdebug"
 )
 
 // Environment variables names.
@@ -109,6 +110,8 @@ func NewDNSProviderConfig(config *Config) (*DNSProvider, error) {
 		client.HTTPClient = config.HTTPClient
 	}
 
+	client.HTTPClient = clientdebug.Wrap(client.HTTPClient)
+
 	return &DNSProvider{
 		config:              config,
 		client:              client,

providers/dns/gandiv5/gandiv5.go

@@ -15,6 +15,7 @@ import (
 	"github.com/go-acme/lego/v4/log"
 	"github.com/go-acme/lego/v4/platform/config/env"
 	"github.com/go-acme/lego/v4/providers/dns/gandiv5/internal"
+	"github.com/go-acme/lego/v4/providers/dns/internal/clientdebug"
 )
 
 // Environment variables names.
@@ -120,6 +121,8 @@ func NewDNSProviderConfig(config *Config) (*DNSProvider, error) {
 		client.HTTPClient = config.HTTPClient
 	}
 
+	client.HTTPClient = clientdebug.Wrap(client.HTTPClient)
+
 	return &DNSProvider{
 		config:          config,
 		client:          client,

providers/dns/gcloud/googlecloud.go

@@ -17,6 +17,7 @@ import (
 	"github.com/go-acme/lego/v4/log"
 	"github.com/go-acme/lego/v4/platform/config/env"
 	"github.com/go-acme/lego/v4/platform/wait"
+	"github.com/go-acme/lego/v4/providers/dns/internal/clientdebug"
 	"github.com/miekg/dns"
 	"golang.org/x/net/context"
 	"golang.org/x/oauth2"
@@ -172,7 +173,7 @@ func NewDNSProviderConfig(config *Config) (*DNSProvider, error) {
 		return nil, errors.New("googlecloud: unable to create Google Cloud DNS service: client is nil")
 	}
 
-	svc, err := gdns.NewService(context.Background(), option.WithHTTPClient(config.HTTPClient))
+	svc, err := gdns.NewService(context.Background(), option.WithHTTPClient(clientdebug.Wrap(config.HTTPClient)))
 	if err != nil {
 		return nil, fmt.Errorf("googlecloud: unable to create Google Cloud DNS service: %w", err)
 	}

providers/dns/gcore/gcore.go

@@ -12,6 +12,7 @@ import (
 	"github.com/go-acme/lego/v4/challenge/dns01"
 	"github.com/go-acme/lego/v4/platform/config/env"
 	"github.com/go-acme/lego/v4/providers/dns/gcore/internal"
+	"github.com/go-acme/lego/v4/providers/dns/internal/clientdebug"
 )
 
 // Environment variables names.
@@ -89,6 +90,8 @@ func NewDNSProviderConfig(config *Config) (*DNSProvider, error) {
 		client.HTTPClient = config.HTTPClient
 	}
 
+	client.HTTPClient = clientdebug.Wrap(client.HTTPClient)
+
 	return &DNSProvider{
 		config: config,
 		client: client,

providers/dns/glesys/glesys.go

@@ -13,6 +13,7 @@ import (
 	"github.com/go-acme/lego/v4/challenge/dns01"
 	"github.com/go-acme/lego/v4/platform/config/env"
 	"github.com/go-acme/lego/v4/providers/dns/glesys/internal"
+	"github.com/go-acme/lego/v4/providers/dns/internal/clientdebug"
 )
 
 // Environment variables names.
@@ -99,6 +100,8 @@ func NewDNSProviderConfig(config *Config) (*DNSProvider, error) {
 		client.HTTPClient = config.HTTPClient
 	}
 
+	client.HTTPClient = clientdebug.Wrap(client.HTTPClient)
+
 	return &DNSProvider{
 		config:        config,
 		client:        client,

providers/dns/godaddy/godaddy.go

@@ -12,6 +12,7 @@ import (
 	"github.com/go-acme/lego/v4/challenge/dns01"
 	"github.com/go-acme/lego/v4/platform/config/env"
 	"github.com/go-acme/lego/v4/providers/dns/godaddy/internal"
+	"github.com/go-acme/lego/v4/providers/dns/internal/clientdebug"
 )
 
 // Environment variables names.
@@ -95,6 +96,8 @@ func NewDNSProviderConfig(config *Config) (*DNSProvider, error) {
 		client.HTTPClient = config.HTTPClient
 	}
 
+	client.HTTPClient = clientdebug.Wrap(client.HTTPClient)
+
 	return &DNSProvider{config: config, client: client}, nil
 }
 

providers/dns/hetzner/internal/hetznerv1/hetznerv1.go

@@ -14,6 +14,7 @@ import (
 	"github.com/go-acme/lego/v4/platform/config/env"
 	"github.com/go-acme/lego/v4/platform/wait"
 	"github.com/go-acme/lego/v4/providers/dns/hetzner/internal/hetznerv1/internal"
+	"github.com/go-acme/lego/v4/providers/dns/internal/clientdebug"
 	"golang.org/x/net/idna"
 )
 
@@ -80,7 +81,11 @@ func NewDNSProviderConfig(config *Config) (*DNSProvider, error) {
 		return nil, errors.New("hetzner: credentials missing")
 	}
 
-	client, err := internal.NewClient(internal.OAuthStaticAccessToken(config.HTTPClient, config.APIToken))
+	client, err := internal.NewClient(
+		clientdebug.Wrap(
+			internal.OAuthStaticAccessToken(config.HTTPClient, config.APIToken),
+		),
+	)
 	if err != nil {
 		return nil, fmt.Errorf("hetzner: %w", err)
 	}

providers/dns/hetzner/internal/legacy/hetzner.go

@@ -12,6 +12,7 @@ import (
 	"github.com/go-acme/lego/v4/challenge/dns01"
 	"github.com/go-acme/lego/v4/platform/config/env"
 	"github.com/go-acme/lego/v4/providers/dns/hetzner/internal/legacy/internal"
+	"github.com/go-acme/lego/v4/providers/dns/internal/clientdebug"
 )
 
 // Environment variables names.
@@ -91,6 +92,8 @@ func NewDNSProviderConfig(config *Config) (*DNSProvider, error) {
 		client.HTTPClient = config.HTTPClient
 	}
 
+	client.HTTPClient = clientdebug.Wrap(client.HTTPClient)
+
 	return &DNSProvider{config: config, client: client}, nil
 }
 

providers/dns/hostingde/hostingde.go

@@ -12,6 +12,7 @@ import (
 	"github.com/go-acme/lego/v4/challenge"
 	"github.com/go-acme/lego/v4/challenge/dns01"
 	"github.com/go-acme/lego/v4/platform/config/env"
+	"github.com/go-acme/lego/v4/providers/dns/internal/clientdebug"
 	"github.com/go-acme/lego/v4/providers/dns/internal/hostingde"
 )
 
@@ -87,9 +88,17 @@ func NewDNSProviderConfig(config *Config) (*DNSProvider, error) {
 		return nil, errors.New("hostingde: API key missing")
 	}
 
+	client := hostingde.NewClient(config.APIKey)
+
+	if config.HTTPClient != nil {
+		client.HTTPClient = config.HTTPClient
+	}
+
+	client.HTTPClient = clientdebug.Wrap(client.HTTPClient)
+
 	return &DNSProvider{
 		config:    config,
-		client:    hostingde.NewClient(config.APIKey),
+		client:    client,
 		recordIDs: make(map[string]string),
 	}, nil
 }

providers/dns/hostinger/hostinger.go

@@ -12,6 +12,7 @@ import (
 	"github.com/go-acme/lego/v4/challenge/dns01"
 	"github.com/go-acme/lego/v4/platform/config/env"
 	"github.com/go-acme/lego/v4/providers/dns/hostinger/internal"
+	"github.com/go-acme/lego/v4/providers/dns/internal/clientdebug"
 )
 
 // Environment variables names.
@@ -82,6 +83,8 @@ func NewDNSProviderConfig(config *Config) (*DNSProvider, error) {
 		client.HTTPClient = config.HTTPClient
 	}
 
+	client.HTTPClient = clientdebug.Wrap(client.HTTPClient)
+
 	return &DNSProvider{
 		config: config,
 		client: client,

providers/dns/hostinger/hostinger_test.go

@@ -96,13 +96,13 @@ func mockBuilder() *servermock.Builder[*DNSProvider] {
 		func(server *httptest.Server) (*DNSProvider, error) {
 			config := NewDefaultConfig()
 			config.APIToken = "secret"
+			config.HTTPClient = server.Client()
 
 			p, err := NewDNSProviderConfig(config)
 			if err != nil {
 				return nil, err
 			}
 
-			p.client.HTTPClient = server.Client()
 			p.client.BaseURL, _ = url.Parse(server.URL)
 
 			return p, nil

providers/dns/hosttech/hosttech.go

@@ -14,6 +14,7 @@ import (
 	"github.com/go-acme/lego/v4/challenge/dns01"
 	"github.com/go-acme/lego/v4/platform/config/env"
 	"github.com/go-acme/lego/v4/providers/dns/hosttech/internal"
+	"github.com/go-acme/lego/v4/providers/dns/internal/clientdebug"
 )
 
 // Environment variables names.
@@ -84,7 +85,11 @@ func NewDNSProviderConfig(config *Config) (*DNSProvider, error) {
 		return nil, errors.New("hosttech: missing credentials")
 	}
 
-	client := internal.NewClient(internal.OAuthStaticAccessToken(config.HTTPClient, config.APIKey))
+	client := internal.NewClient(
+		clientdebug.Wrap(
+			internal.OAuthStaticAccessToken(config.HTTPClient, config.APIKey),
+		),
+	)
 
 	return &DNSProvider{
 		config:    config,

providers/dns/httpnet/httpnet.go

@@ -13,6 +13,7 @@ import (
 	"github.com/go-acme/lego/v4/challenge"
 	"github.com/go-acme/lego/v4/challenge/dns01"
 	"github.com/go-acme/lego/v4/platform/config/env"
+	"github.com/go-acme/lego/v4/providers/dns/internal/clientdebug"
 	"github.com/go-acme/lego/v4/providers/dns/internal/hostingde"
 )
 
@@ -91,6 +92,12 @@ func NewDNSProviderConfig(config *Config) (*DNSProvider, error) {
 	client := hostingde.NewClient(config.APIKey)
 	client.BaseURL, _ = url.Parse(hostingde.DefaultHTTPNetBaseURL)
 
+	if config.HTTPClient != nil {
+		client.HTTPClient = config.HTTPClient
+	}
+
+	client.HTTPClient = clientdebug.Wrap(client.HTTPClient)
+
 	return &DNSProvider{
 		config:    config,
 		client:    client,

providers/dns/httpreq/httpreq.go

@@ -14,6 +14,7 @@ import (
 	"github.com/go-acme/lego/v4/challenge"
 	"github.com/go-acme/lego/v4/challenge/dns01"
 	"github.com/go-acme/lego/v4/platform/config/env"
+	"github.com/go-acme/lego/v4/providers/dns/internal/clientdebug"
 	"github.com/go-acme/lego/v4/providers/dns/internal/errutils"
 )
 
@@ -88,6 +89,7 @@ func NewDNSProvider() (*DNSProvider, error) {
 	config.Username = env.GetOrFile(EnvUsername)
 	config.Password = env.GetOrFile(EnvPassword)
 	config.Endpoint = endpoint
+
 	return NewDNSProviderConfig(config)
 }
 
@@ -101,6 +103,8 @@ func NewDNSProviderConfig(config *Config) (*DNSProvider, error) {
 		return nil, errors.New("httpreq: the endpoint is missing")
 	}
 
+	config.HTTPClient = clientdebug.Wrap(config.HTTPClient)
+
 	return &DNSProvider{config: config}, nil
 }
 

providers/dns/hurricane/hurricane.go

@@ -11,6 +11,7 @@ import (
 	"github.com/go-acme/lego/v4/challenge/dns01"
 	"github.com/go-acme/lego/v4/platform/config/env"
 	"github.com/go-acme/lego/v4/providers/dns/hurricane/internal"
+	"github.com/go-acme/lego/v4/providers/dns/internal/clientdebug"
 )
 
 // Environment variables names.
@@ -83,6 +84,12 @@ func NewDNSProviderConfig(config *Config) (*DNSProvider, error) {
 
 	client := internal.NewClient(config.Credentials)
 
+	if config.HTTPClient != nil {
+		client.HTTPClient = config.HTTPClient
+	}
+
+	client.HTTPClient = clientdebug.Wrap(client.HTTPClient)
+
 	return &DNSProvider{config: config, client: client}, nil
 }
 

providers/dns/hyperone/hyperone.go

@@ -13,6 +13,7 @@ import (
 	"github.com/go-acme/lego/v4/challenge/dns01"
 	"github.com/go-acme/lego/v4/platform/config/env"
 	"github.com/go-acme/lego/v4/providers/dns/hyperone/internal"
+	"github.com/go-acme/lego/v4/providers/dns/internal/clientdebug"
 )
 
 // Environment variables names.
@@ -96,6 +97,8 @@ func NewDNSProviderConfig(config *Config) (*DNSProvider, error) {
 		client.HTTPClient = config.HTTPClient
 	}
 
+	client.HTTPClient = clientdebug.Wrap(client.HTTPClient)
+
 	return &DNSProvider{client: client, config: config}, nil
 }
 

providers/dns/infomaniak/infomaniak.go

@@ -13,6 +13,7 @@ import (
 	"github.com/go-acme/lego/v4/challenge/dns01"
 	"github.com/go-acme/lego/v4/platform/config/env"
 	"github.com/go-acme/lego/v4/providers/dns/infomaniak/internal"
+	"github.com/go-acme/lego/v4/providers/dns/internal/clientdebug"
 )
 
 // Infomaniak API reference: https://api.infomaniak.com/doc
@@ -96,7 +97,11 @@ func NewDNSProviderConfig(config *Config) (*DNSProvider, error) {
 		return nil, errors.New("infomaniak: missing access token")
 	}
 
-	client, err := internal.New(internal.OAuthStaticAccessToken(config.HTTPClient, config.AccessToken), config.APIEndpoint)
+	client, err := internal.New(
+		clientdebug.Wrap(
+			internal.OAuthStaticAccessToken(config.HTTPClient, config.AccessToken),
+		),
+		config.APIEndpoint)
 	if err != nil {
 		return nil, fmt.Errorf("infomaniak: %w", err)
 	}

providers/dns/internal/clientdebug/.gitattributes

@@ -0,0 +1 @@
+/testdata/** text eol=lf

providers/dns/internal/clientdebug/client.go

@@ -0,0 +1,131 @@
+package clientdebug
+
+import (
+	"fmt"
+	"io"
+	"net/http"
+	"net/http/httputil"
+	"os"
+	"regexp"
+	"strconv"
+	"strings"
+
+	"github.com/go-acme/lego/v4/platform/config/env"
+)
+
+const replacement = "***"
+
+type Option func(*DumpTransport)
+
+func WithEnvKeys(keys ...string) Option {
+	return func(d *DumpTransport) {
+		for _, key := range keys {
+			v := strings.TrimSpace(env.GetOrFile(key))
+			if v == "" {
+				continue
+			}
+
+			d.replacements = append(d.replacements, v, replacement)
+		}
+	}
+}
+
+func WithValues(values ...string) Option {
+	return func(d *DumpTransport) {
+		for _, value := range values {
+			d.replacements = append(d.replacements, value, replacement)
+		}
+	}
+}
+
+func WithHeaders(keys ...string) Option {
+	return func(d *DumpTransport) {
+		d.regexps = append(d.regexps,
+			regexp.MustCompile(fmt.Sprintf(`(?im)^(%s):.+$`, strings.Join(keys, "|"))))
+	}
+}
+
+type DumpTransport struct {
+	rt http.RoundTripper
+
+	replacements []string
+	replacer     *strings.Replacer
+
+	regexps []*regexp.Regexp
+
+	writer io.Writer
+}
+
+func NewDumpTransport(rt http.RoundTripper, opts ...Option) *DumpTransport {
+	if rt == nil {
+		rt = http.DefaultTransport
+	}
+
+	d := &DumpTransport{
+		rt:     rt,
+		writer: os.Stdout,
+	}
+
+	for _, opt := range opts {
+		opt(d)
+	}
+
+	d.regexps = append(d.regexps,
+		regexp.MustCompile(`(?im)^(Authorization):.+$`),
+		regexp.MustCompile(`(?im)^(Token|X-Token):.+$`),
+		regexp.MustCompile(`(?im)^(Auth-Token|X-Auth-Token):.+$`),
+		regexp.MustCompile(`(?im)^(Api-Key|X-Api-Key|X-Api-Secret):.+$`),
+	)
+
+	if len(d.replacements) > 0 {
+		d.replacer = strings.NewReplacer(d.replacements...)
+	}
+
+	return d
+}
+
+func (d *DumpTransport) RoundTrip(h *http.Request) (*http.Response, error) {
+	data, _ := httputil.DumpRequestOut(h, true)
+
+	_, _ = fmt.Fprintln(d.writer, "[HTTP Request]")
+	_, _ = fmt.Fprintln(d.writer, d.redact(data))
+
+	resp, err := d.rt.RoundTrip(h)
+
+	data, _ = httputil.DumpResponse(resp, true)
+
+	_, _ = fmt.Fprintln(d.writer, "[HTTP Response]")
+	_, _ = fmt.Fprintln(d.writer, d.redact(data))
+
+	return resp, err
+}
+
+func (d *DumpTransport) redact(content []byte) string {
+	data := string(content)
+
+	for _, r := range d.regexps {
+		data = r.ReplaceAllString(data, "$1: "+replacement)
+	}
+
+	if d.replacer == nil {
+		return data
+	}
+
+	return d.replacer.Replace(data)
+}
+
+// Wrap wraps an HTTP client Transport with the [DumpTransport].
+func Wrap(client *http.Client, opts ...Option) *http.Client {
+	val, found := os.LookupEnv("LEGO_DEBUG_DNS_API_HTTP_CLIENT")
+	if !found {
+		return client
+	}
+
+	if ok, _ := strconv.ParseBool(val); !ok {
+		return client
+	}
+
+	client.Transport = NewDumpTransport(client.Transport, opts...)
+
+	return client
+}

providers/dns/internal/clientdebug/client_test.go

@@ -0,0 +1,168 @@
+package clientdebug
+
+import (
+	"bytes"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"path/filepath"
+	"strings"
+	"testing"
+	"text/template"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestWrap_redact_env_vars(t *testing.T) {
+	t.Setenv("LEGO_DEBUG_DNS_API_HTTP_CLIENT", "true")
+
+	t.Setenv("MY_VAR_01", "env-aaaa-aaaa")
+	t.Setenv("MY_VAR_02", "query-aaaa-aaaa")
+	t.Setenv("MY_VAR_03", "path-aaaa-aaaa")
+	t.Setenv("MY_VAR_04", "request-body-aaaa-aaaa")
+	t.Setenv("MY_VAR_05", "request-header-aaaa-aaaa")
+	t.Setenv("MY_VAR_06", "response-body-aaaa-aaaa")
+
+	buf := bytes.NewBufferString("")
+
+	server, client, req := setupTest(t, buf,
+		WithEnvKeys("MY_VAR_01", "MY_VAR_02", "MY_VAR_03", "MY_VAR_04", "MY_VAR_05", "MY_VAR_06"),
+	)
+
+	resp, err := client.Transport.RoundTrip(req)
+	require.NoError(t, err)
+
+	assert.Equal(t, http.StatusOK, resp.StatusCode)
+
+	assertDump(t, server, buf, "env_vars.txt")
+}
+
+func TestWrap_redact_headers(t *testing.T) {
+	t.Setenv("LEGO_DEBUG_DNS_API_HTTP_CLIENT", "true")
+
+	buf := bytes.NewBufferString("")
+
+	server, client, req := setupTest(t, buf,
+		WithHeaders("Secret-Request-Header", "Super-Secret-Request-Header", "Secret-Response-Header"),
+	)
+
+	resp, err := client.Transport.RoundTrip(req)
+	require.NoError(t, err)
+
+	assert.Equal(t, http.StatusOK, resp.StatusCode)
+
+	assertDump(t, server, buf, "headers.txt")
+}
+
+func TestWrap_redact_values(t *testing.T) {
+	t.Setenv("LEGO_DEBUG_DNS_API_HTTP_CLIENT", "true")
+
+	buf := bytes.NewBufferString("")
+
+	server, client, req := setupTest(t, buf,
+		WithValues("query-aaaa-aaaa", "path-aaaa-aaaa", "request-body-aaaa-aaaa"),
+	)
+
+	resp, err := client.Transport.RoundTrip(req)
+	require.NoError(t, err)
+
+	assert.Equal(t, http.StatusOK, resp.StatusCode)
+
+	assertDump(t, server, buf, "values.txt")
+}
+
+func fakeRequest(t *testing.T, baseURL string) *http.Request {
+	t.Helper()
+
+	endpoint, err := url.Parse(baseURL)
+	require.NoError(t, err)
+
+	query := endpoint.Query()
+	query.Set("foo", "query-aaaa-aaaa")
+	endpoint.RawQuery = query.Encode()
+
+	endpoint = endpoint.JoinPath("path-aaaa-aaaa")
+
+	body := `{
+	"foo": "request-body-aaaa-aaaa"
+}
+`
+
+	req := httptest.NewRequest(http.MethodGet, endpoint.String(), bytes.NewBufferString(body))
+
+	req.Header.Set("X-Authorization", "not-redacted")
+
+	req.Header.Set("Secret-Request-Header", "request-header-aaaa-aaaa")
+	req.Header.Set("Super-Secret-Request-Header", "env-aaaa-aaaa")
+
+	req.Header.Set("Authorization", "header-aaaa-0000")
+	req.Header.Set("Token", "header-aaaa-0001")
+	req.Header.Set("X-Token", "header-aaaa-0002")
+	req.Header.Set("Auth-Token", "header-aaaa-0003")
+	req.Header.Set("X-Auth-Token", "header-aaaa-0004")
+	req.Header.Set("Api-Key", "header-aaaa-0006")
+	req.Header.Set("X-Api-Key", "header-aaaa-0007")
+	req.Header.Set("X-Api-Secret", "header-aaaa-0008")
+
+	req.SetBasicAuth("user", "secret")
+
+	return req
+}
+
+func fakeResponse() http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Secret-Response-Header", "response-header-aaaa-aaaa")
+		_, _ = w.Write([]byte(`{
+	"bar": "response-body-aaaa-aaaa"
+}`,
+		))
+	}
+}
+
+func withWriter(w io.Writer) Option {
+	return func(d *DumpTransport) {
+		if w != nil {
+			d.writer = w
+		}
+	}
+}
+
+func setupTest(t *testing.T, buf io.Writer, opts ...Option) (*httptest.Server, *http.Client, *http.Request) {
+	t.Helper()
+
+	server := httptest.NewServer(fakeResponse())
+
+	opts = append(opts, withWriter(buf))
+
+	client := Wrap(server.Client(), opts...)
+
+	req := fakeRequest(t, server.URL)
+
+	return server, client, req
+}
+
+func assertDump(t *testing.T, server *httptest.Server, actual *bytes.Buffer, filename string) {
+	t.Helper()
+
+	tmpl, err := template.New(filename).ParseFiles(filepath.Join("testdata", filename))
+	require.NoError(t, err)
+
+	expected := bytes.NewBufferString("")
+
+	location, err := time.LoadLocation("GMT")
+	require.NoError(t, err)
+
+	baseURL, err := url.Parse(server.URL)
+	require.NoError(t, err)
+
+	err = tmpl.Execute(expected, map[string]string{
+		"Host": baseURL.Host,
+		"Date": time.Now().In(location).Format(time.RFC1123),
+	})
+	require.NoError(t, err)
+
+	assert.Equal(t, expected.String(), strings.ReplaceAll(actual.String(), "\r", ""))
+}

providers/dns/internal/clientdebug/testdata/env_vars.txt

@@ -0,0 +1,32 @@
+[HTTP Request]
+GET /***?foo=*** HTTP/1.1
+Host: {{ .Host }}
+User-Agent: Go-http-client/1.1
+Content-Length: 37
+Api-Key: ***
+Auth-Token: ***
+Authorization: ***
+Secret-Request-Header: ***
+Super-Secret-Request-Header: ***
+Token: ***
+X-Api-Key: ***
+X-Api-Secret: ***
+X-Auth-Token: ***
+X-Authorization: not-redacted
+X-Token: ***
+Accept-Encoding: gzip
+
+{
+	"foo": "***"
+}
+
+[HTTP Response]
+HTTP/1.1 200 OK
+Content-Length: 37
+Content-Type: text/plain; charset=utf-8
+Date: {{ .Date }}
+Secret-Response-Header: response-header-aaaa-aaaa
+
+{
+	"bar": "***"
+}

providers/dns/internal/clientdebug/testdata/headers.txt

@@ -0,0 +1,32 @@
+[HTTP Request]
+GET /path-aaaa-aaaa?foo=query-aaaa-aaaa HTTP/1.1
+Host: {{ .Host }}
+User-Agent: Go-http-client/1.1
+Content-Length: 37
+Api-Key: ***
+Auth-Token: ***
+Authorization: ***
+Secret-Request-Header: ***
+Super-Secret-Request-Header: ***
+Token: ***
+X-Api-Key: ***
+X-Api-Secret: ***
+X-Auth-Token: ***
+X-Authorization: not-redacted
+X-Token: ***
+Accept-Encoding: gzip
+
+{
+	"foo": "request-body-aaaa-aaaa"
+}
+
+[HTTP Response]
+HTTP/1.1 200 OK
+Content-Length: 37
+Content-Type: text/plain; charset=utf-8
+Date: {{ .Date }}
+Secret-Response-Header: ***
+
+{
+	"bar": "response-body-aaaa-aaaa"
+}

providers/dns/internal/clientdebug/testdata/values.txt

@@ -0,0 +1,32 @@
+[HTTP Request]
+GET /***?foo=*** HTTP/1.1
+Host: {{ .Host }}
+User-Agent: Go-http-client/1.1
+Content-Length: 37
+Api-Key: ***
+Auth-Token: ***
+Authorization: ***
+Secret-Request-Header: request-header-aaaa-aaaa
+Super-Secret-Request-Header: env-aaaa-aaaa
+Token: ***
+X-Api-Key: ***
+X-Api-Secret: ***
+X-Auth-Token: ***
+X-Authorization: not-redacted
+X-Token: ***
+Accept-Encoding: gzip
+
+{
+	"foo": "***"
+}
+
+[HTTP Response]
+HTTP/1.1 200 OK
+Content-Length: 37
+Content-Type: text/plain; charset=utf-8
+Date: {{ .Date }}
+Secret-Response-Header: response-header-aaaa-aaaa
+
+{
+	"bar": "response-body-aaaa-aaaa"
+}

providers/dns/internetbs/internetbs.go

@@ -11,6 +11,7 @@ import (
 	"github.com/go-acme/lego/v4/challenge"
 	"github.com/go-acme/lego/v4/challenge/dns01"
 	"github.com/go-acme/lego/v4/platform/config/env"
+	"github.com/go-acme/lego/v4/providers/dns/internal/clientdebug"
 	"github.com/go-acme/lego/v4/providers/dns/internetbs/internal"
 )
 
@@ -88,6 +89,8 @@ func NewDNSProviderConfig(config *Config) (*DNSProvider, error) {
 		client.HTTPClient = config.HTTPClient
 	}
 
+	client.HTTPClient = clientdebug.Wrap(client.HTTPClient)
+
 	return &DNSProvider{
 		config: config,
 		client: client,

providers/dns/ionos/ionos.go

@@ -13,6 +13,7 @@ import (
 	"github.com/go-acme/lego/v4/challenge"
 	"github.com/go-acme/lego/v4/challenge/dns01"
 	"github.com/go-acme/lego/v4/platform/config/env"
+	"github.com/go-acme/lego/v4/providers/dns/internal/clientdebug"
 	"github.com/go-acme/lego/v4/providers/dns/ionos/internal"
 )
 
@@ -96,6 +97,8 @@ func NewDNSProviderConfig(config *Config) (*DNSProvider, error) {
 		client.HTTPClient = config.HTTPClient
 	}
 
+	client.HTTPClient = clientdebug.Wrap(client.HTTPClient)
+
 	return &DNSProvider{config: config, client: client}, nil
 }
 

providers/dns/ipv64/ipv64.go

@@ -12,6 +12,7 @@ import (
 	"github.com/go-acme/lego/v4/challenge"
 	"github.com/go-acme/lego/v4/challenge/dns01"
 	"github.com/go-acme/lego/v4/platform/config/env"
+	"github.com/go-acme/lego/v4/providers/dns/internal/clientdebug"
 	"github.com/go-acme/lego/v4/providers/dns/ipv64/internal"
 	"github.com/miekg/dns"
 )
@@ -85,6 +86,8 @@ func NewDNSProviderConfig(config *Config) (*DNSProvider, error) {
 		client.HTTPClient = config.HTTPClient
 	}
 
+	client.HTTPClient = clientdebug.Wrap(client.HTTPClient)
+
 	return &DNSProvider{config: config, client: client}, nil
 }
 

providers/dns/iwantmyname/iwantmyname.go

@@ -11,6 +11,7 @@ import (
 	"github.com/go-acme/lego/v4/challenge"
 	"github.com/go-acme/lego/v4/challenge/dns01"
 	"github.com/go-acme/lego/v4/platform/config/env"
+	"github.com/go-acme/lego/v4/providers/dns/internal/clientdebug"
 	"github.com/go-acme/lego/v4/providers/dns/iwantmyname/internal"
 )
 
@@ -88,6 +89,8 @@ func NewDNSProviderConfig(config *Config) (*DNSProvider, error) {
 		client.HTTPClient = config.HTTPClient
 	}
 
+	client.HTTPClient = clientdebug.Wrap(client.HTTPClient)
+
 	return &DNSProvider{
 		config: config,
 		client: client,

providers/dns/joker/provider_dmapi.go

@@ -10,6 +10,7 @@ import (
 	"github.com/go-acme/lego/v4/challenge/dns01"
 	"github.com/go-acme/lego/v4/log"
 	"github.com/go-acme/lego/v4/platform/config/env"
+	"github.com/go-acme/lego/v4/providers/dns/internal/clientdebug"
 	"github.com/go-acme/lego/v4/providers/dns/joker/internal/dmapi"
 )
 
@@ -66,6 +67,8 @@ func newDmapiProviderConfig(config *Config) (*dmapiProvider, error) {
 		client.HTTPClient = config.HTTPClient
 	}
 
+	client.HTTPClient = clientdebug.Wrap(client.HTTPClient)
+
 	return &dmapiProvider{config: config, client: client}, nil
 }
 

providers/dns/joker/provider_svc.go

@@ -9,6 +9,7 @@ import (
 	"github.com/go-acme/lego/v4/challenge"
 	"github.com/go-acme/lego/v4/challenge/dns01"
 	"github.com/go-acme/lego/v4/platform/config/env"
+	"github.com/go-acme/lego/v4/providers/dns/internal/clientdebug"
 	"github.com/go-acme/lego/v4/providers/dns/joker/internal/svc"
 )
 
@@ -47,6 +48,8 @@ func newSvcProviderConfig(config *Config) (*svcProvider, error) {
 
 	client := svc.NewClient(config.Username, config.Password)
 
+	client.HTTPClient = clientdebug.Wrap(client.HTTPClient)
+
 	return &svcProvider{config: config, client: client}, nil
 }
 

providers/dns/keyhelp/keyhelp.go

@@ -11,6 +11,7 @@ import (
 
 	"github.com/go-acme/lego/v4/challenge/dns01"
 	"github.com/go-acme/lego/v4/platform/config/env"
+	"github.com/go-acme/lego/v4/providers/dns/internal/clientdebug"
 	"github.com/go-acme/lego/v4/providers/dns/keyhelp/internal"
 )
 
@@ -88,6 +89,8 @@ func NewDNSProviderConfig(config *Config) (*DNSProvider, error) {
 		client.HTTPClient = config.HTTPClient
 	}
 
+	client.HTTPClient = clientdebug.Wrap(client.HTTPClient)
+
 	return &DNSProvider{
 		config:    config,
 		client:    client,

providers/dns/liara/liara.go

@@ -13,6 +13,7 @@ import (
 	"github.com/go-acme/lego/v4/challenge/dns01"
 	"github.com/go-acme/lego/v4/log"
 	"github.com/go-acme/lego/v4/platform/config/env"
+	"github.com/go-acme/lego/v4/providers/dns/internal/clientdebug"
 	"github.com/go-acme/lego/v4/providers/dns/liara/internal"
 	"github.com/hashicorp/go-retryablehttp"
 )
@@ -105,7 +106,11 @@ func NewDNSProviderConfig(config *Config) (*DNSProvider, error) {
 	}
 	retryClient.Logger = log.Logger
 
-	client := internal.NewClient(internal.OAuthStaticAccessToken(retryClient.StandardClient(), config.APIKey))
+	client := internal.NewClient(
+		clientdebug.Wrap(
+			internal.OAuthStaticAccessToken(retryClient.StandardClient(), config.APIKey),
+		),
+	)
 
 	return &DNSProvider{
 		config:    config,

providers/dns/limacity/limacity.go

@@ -13,6 +13,7 @@ import (
 	"github.com/go-acme/lego/v4/challenge"
 	"github.com/go-acme/lego/v4/challenge/dns01"
 	"github.com/go-acme/lego/v4/platform/config/env"
+	"github.com/go-acme/lego/v4/providers/dns/internal/clientdebug"
 	"github.com/go-acme/lego/v4/providers/dns/limacity/internal"
 )
 
@@ -89,6 +90,12 @@ func NewDNSProviderConfig(config *Config) (*DNSProvider, error) {
 
 	client := internal.NewClient(config.APIKey)
 
+	if config.HTTPClient != nil {
+		client.HTTPClient = config.HTTPClient
+	}
+
+	client.HTTPClient = clientdebug.Wrap(client.HTTPClient)
+
 	return &DNSProvider{
 		config:    config,
 		client:    client,

providers/dns/linode/linode.go

@@ -12,6 +12,7 @@ import (
 	"github.com/go-acme/lego/v4/challenge"
 	"github.com/go-acme/lego/v4/challenge/dns01"
 	"github.com/go-acme/lego/v4/platform/config/env"
+	"github.com/go-acme/lego/v4/providers/dns/internal/clientdebug"
 	"github.com/go-acme/lego/v4/providers/dns/internal/useragent"
 	"github.com/linode/linodego"
 	"golang.org/x/oauth2"
@@ -102,7 +103,7 @@ func NewDNSProviderConfig(config *Config) (*DNSProvider, error) {
 		},
 	}
 
-	client := linodego.NewClient(oauth2Client)
+	client := linodego.NewClient(clientdebug.Wrap(oauth2Client))
 	client.SetUserAgent(useragent.Get())
 
 	return &DNSProvider{config: config, client: &client}, nil

providers/dns/loopia/loopia.go

@@ -12,6 +12,7 @@ import (
 	"github.com/go-acme/lego/v4/challenge"
 	"github.com/go-acme/lego/v4/challenge/dns01"
 	"github.com/go-acme/lego/v4/platform/config/env"
+	"github.com/go-acme/lego/v4/providers/dns/internal/clientdebug"
 	"github.com/go-acme/lego/v4/providers/dns/loopia/internal"
 )
 
@@ -113,6 +114,8 @@ func NewDNSProviderConfig(config *Config) (*DNSProvider, error) {
 		client.HTTPClient = config.HTTPClient
 	}
 
+	client.HTTPClient = clientdebug.Wrap(client.HTTPClient)
+
 	if config.BaseURL != "" {
 		client.BaseURL = config.BaseURL
 	}

providers/dns/luadns/luadns.go

@@ -13,6 +13,7 @@ import (
 	"github.com/go-acme/lego/v4/challenge"
 	"github.com/go-acme/lego/v4/challenge/dns01"
 	"github.com/go-acme/lego/v4/platform/config/env"
+	"github.com/go-acme/lego/v4/providers/dns/internal/clientdebug"
 	"github.com/go-acme/lego/v4/providers/dns/luadns/internal"
 )
 
@@ -100,6 +101,8 @@ func NewDNSProviderConfig(config *Config) (*DNSProvider, error) {
 		client.HTTPClient = config.HTTPClient
 	}
 
+	client.HTTPClient = clientdebug.Wrap(client.HTTPClient)
+
 	return &DNSProvider{
 		config:    config,
 		client:    client,

providers/dns/mailinabox/mailinabox.go

@@ -5,11 +5,13 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"net/http"
 	"time"
 
 	"github.com/go-acme/lego/v4/challenge"
 	"github.com/go-acme/lego/v4/challenge/dns01"
 	"github.com/go-acme/lego/v4/platform/config/env"
+	"github.com/go-acme/lego/v4/providers/dns/internal/clientdebug"
 	"github.com/nrdcg/mailinabox"
 )
 
@@ -23,6 +25,7 @@ const (
 
 	EnvPropagationTimeout = envNamespace + "PROPAGATION_TIMEOUT"
 	EnvPollingInterval    = envNamespace + "POLLING_INTERVAL"
+	EnvHTTPTimeout        = envNamespace + "HTTP_TIMEOUT"
 )
 
 var _ challenge.ProviderTimeout = (*DNSProvider)(nil)
@@ -34,6 +37,7 @@ type Config struct {
 	BaseURL            string
 	PropagationTimeout time.Duration
 	PollingInterval    time.Duration
+	HTTPClient         *http.Client
 }
 
 // NewDefaultConfig returns a default configuration for the DNSProvider.
@@ -41,6 +45,9 @@ func NewDefaultConfig() *Config {
 	return &Config{
 		PropagationTimeout: env.GetOrDefaultSecond(EnvPropagationTimeout, 120*time.Second),
 		PollingInterval:    env.GetOrDefaultSecond(EnvPollingInterval, 4*time.Second),
+		HTTPClient: &http.Client{
+			Timeout: env.GetOrDefaultSecond(EnvHTTPTimeout, 30*time.Second),
+		},
 	}
 }
 
@@ -81,7 +88,13 @@ func NewDNSProviderConfig(config *Config) (*DNSProvider, error) {
 		return nil, errors.New("mailinabox: missing base URL")
 	}
 
-	client, err := mailinabox.New(config.BaseURL, config.Email, config.Password)
+	if config.HTTPClient == nil {
+		config.HTTPClient = &http.Client{Timeout: 30 * time.Second}
+	}
+
+	config.HTTPClient = clientdebug.Wrap(config.HTTPClient)
+
+	client, err := mailinabox.New(config.BaseURL, config.Email, config.Password, mailinabox.WithHTTPClient(config.HTTPClient))
 	if err != nil {
 		return nil, fmt.Errorf("mailinabox: %w", err)
 	}

providers/dns/mailinabox/mailinabox.toml

@@ -19,6 +19,7 @@ lego --email you@example.com --dns mailinabox -d '*.example.com' -d example.com
   [Configuration.Additional]
     MAILINABOX_POLLING_INTERVAL = "Time between DNS propagation check in seconds (Default: 4)"
     MAILINABOX_PROPAGATION_TIMEOUT = "Maximum waiting time for DNS propagation in seconds (Default: 120)"
+    MAILINABOX_HTTP_TIMEOUT = "API request timeout in seconds (Default: 30)"
 
 [Links]
   API = "https://mailinabox.email/api-docs.html"

providers/dns/manageengine/internal/client.go

@@ -24,12 +24,12 @@ type Client struct {
 }
 
 // NewClient creates a new Client.
-func NewClient(ctx context.Context, clientID, clientSecret string) *Client {
+func NewClient(hc *http.Client) *Client {
 	baseURL, _ := url.Parse(defaultBaseURL)
 
 	return &Client{
 		baseURL:    baseURL,
-		httpClient: createOAuthClient(ctx, clientID, clientSecret),
+		httpClient: hc,
 	}
 }
 

providers/dns/manageengine/internal/client_test.go

@@ -1,7 +1,6 @@
 package internal
 
 import (
-	"context"
 	"net/http"
 	"net/http/httptest"
 	"net/url"
@@ -15,9 +14,8 @@ import (
 func mockBuilder() *servermock.Builder[*Client] {
 	return servermock.NewBuilder[*Client](
 		func(server *httptest.Server) (*Client, error) {
-			client := NewClient(context.Background(), "abc", "secret")
+			client := NewClient(server.Client())
 
-			client.httpClient = server.Client()
 			client.baseURL, _ = url.Parse(server.URL)
 
 			return client, nil

providers/dns/manageengine/internal/identity.go

@@ -9,7 +9,7 @@ import (
 
 const defaultAuthURL = "https://clouddns.manageengine.com/oauth2/token/"
 
-func createOAuthClient(ctx context.Context, clientID, clientSecret string) *http.Client {
+func CreateOAuthClient(ctx context.Context, clientID, clientSecret string) *http.Client {
 	config := &clientcredentials.Config{
 		TokenURL:     defaultAuthURL,
 		ClientID:     clientID,

providers/dns/manageengine/manageengine.go

@@ -11,6 +11,7 @@ import (
 
 	"github.com/go-acme/lego/v4/challenge/dns01"
 	"github.com/go-acme/lego/v4/platform/config/env"
+	"github.com/go-acme/lego/v4/providers/dns/internal/clientdebug"
 	"github.com/go-acme/lego/v4/providers/dns/manageengine/internal"
 )
 
@@ -75,11 +76,13 @@ func NewDNSProviderConfig(config *Config) (*DNSProvider, error) {
 		return nil, errors.New("manageengine: credentials missing")
 	}
 
-	client := internal.NewClient(context.Background(), config.ClientID, config.ClientSecret)
-
 	return &DNSProvider{
 		config: config,
-		client: client,
+		client: internal.NewClient(
+			clientdebug.Wrap(
+				internal.CreateOAuthClient(context.Background(), config.ClientID, config.ClientSecret),
+			),
+		),
 	}, nil
 }