lego/docs/data/zz_cli_help.toml

# THIS FILE IS AUTO-GENERATED. PLEASE DO NOT EDIT.


[[command]]
title   = "lego help"
content = """
NAME:
   lego - Let's Encrypt client written in Go

USAGE:
   lego [global options] [command [command options]]

COMMANDS:
   run      Register an account, then create and install a certificate
   revoke   Revoke a certificate
   renew    Renew a certificate
   dnshelp  Shows additional help for the '--dns' global option
   list     Display certificates and accounts information.
   help, h  Shows a list of commands or help for one command

GLOBAL OPTIONS:
   --domains string, -d string [ --domains string, -d string ]    Add a domain to the process. Can be specified multiple times.
   --server string, -s string                                     CA hostname (and optionally :port). The server certificate must be trusted in order to avoid further modifications to the client. (default: "https://acme-v02.api.letsencrypt.org/directory") [$LEGO_SERVER]
   --accept-tos, -a                                               By setting this flag to true you indicate that you accept the current Let's Encrypt terms of service.
   --email string, -m string                                      Email used for registration and recovery contact. [$LEGO_EMAIL]
   --disable-cn                                                   Disable the use of the common name in the CSR.
   --csr string, -c string                                        Certificate signing request filename, if an external CSR is to be used.
   --eab                                                          Use External Account Binding for account registration. Requires --kid and --hmac. [$LEGO_EAB]
   --kid string                                                   Key identifier from External CA. Used for External Account Binding. [$LEGO_EAB_KID]
   --hmac string                                                  MAC key from External CA. Should be in Base64 URL Encoding without padding format. Used for External Account Binding. [$LEGO_EAB_HMAC]
   --key-type string, -k string                                   Key type to use for private keys. Supported: rsa2048, rsa3072, rsa4096, rsa8192, ec256, ec384. (default: "ec256")
   --filename string                                              (deprecated) Filename of the generated certificate.
   --path string                                                  Directory to use for storing the data. (default: "./.lego") [$LEGO_PATH]
   --http                                                         Use the HTTP-01 challenge to solve challenges. Can be mixed with other types of challenges.
   --http.port string                                             Set the port and interface to use for HTTP-01 based challenges to listen on. Supported: interface:port or :port. (default: ":80")
   --http.delay duration                                          Delay between the starts of the HTTP server (use for HTTP-01 based challenges) and the validation of the challenge. (default: 0s)
   --http.proxy-header string                                     Validate against this HTTP header when solving HTTP-01 based challenges behind a reverse proxy. (default: "Host")
   --http.webroot string                                          Set the webroot folder to use for HTTP-01 based challenges to write directly to the .well-known/acme-challenge file. This disables the built-in server and expects the given directory to be publicly served with access to .well-known/acme-challenge
   --http.memcached-host string [ --http.memcached-host string ]  Set the memcached host(s) to use for HTTP-01 based challenges. Challenges will be written to all specified hosts.
   --http.s3-bucket string                                        Set the S3 bucket name to use for HTTP-01 based challenges. Challenges will be written to the S3 bucket.
   --tls                                                          Use the TLS-ALPN-01 challenge to solve challenges. Can be mixed with other types of challenges.
   --tls.port string                                              Set the port and interface to use for TLS-ALPN-01 based challenges to listen on. Supported: interface:port or :port. (default: ":443")
   --tls.delay duration                                           Delay between the start of the TLS listener (use for TLSALPN-01 based challenges) and the validation of the challenge. (default: 0s)
   --dns string                                                   Solve a DNS-01 challenge using the specified provider. Can be mixed with other types of challenges. Run 'lego dnshelp' for help on usage.
   --dns.disable-cp                                               (deprecated) use dns.propagation-disable-ans instead.
   --dns.propagation-disable-ans                                  By setting this flag to true, disables the need to await propagation of the TXT record to all authoritative name servers.
   --dns.propagation-rns                                          By setting this flag to true, use all the recursive nameservers to check the propagation of the TXT record.
   --dns.propagation-wait duration                                By setting this flag, disables all the propagation checks of the TXT record and uses a wait duration instead. (default: 0s)
   --dns.resolvers string [ --dns.resolvers string ]              Set the resolvers to use for performing (recursive) CNAME resolving and apex domain determination. For DNS-01 challenge verification, the authoritative DNS server is queried directly. Supported: host:port. The default is to use the system resolvers, or Google's DNS resolvers if the system's cannot be determined.
   --http-timeout int                                             Set the HTTP timeout value to a specific value in seconds. (default: 0)
   --tls-skip-verify                                              Skip the TLS verification of the ACME server.
   --dns-timeout int                                              Set the DNS timeout value to a specific value in seconds. Used only when performing authoritative name server queries. (default: 10)
   --pem                                                          Generate an additional .pem (base64) file by concatenating the .key and .crt files together.
   --pfx                                                          Generate an additional .pfx (PKCS#12) file by concatenating the .key and .crt and issuer .crt files together. [$LEGO_PFX]
   --pfx.pass string                                              The password used to encrypt the .pfx (PCKS#12) file. (default: "changeit") [$LEGO_PFX_PASSWORD]
   --pfx.format string                                            The encoding format to use when encrypting the .pfx (PCKS#12) file. Supported: RC2, DES, SHA256. (default: "RC2") [$LEGO_PFX_FORMAT]
   --cert.timeout int                                             Set the certificate timeout value to a specific value in seconds. Only used when obtaining certificates. (default: 30)
   --overall-request-limit int                                    ACME overall requests limit. (default: 18)
   --user-agent string                                            Add to the user-agent sent to the CA to identify an application embedding lego-cli
   --help, -h                                                     show help
"""

[[command]]
title   = "lego help run"
content = """
NAME:
   lego run - Register an account, then create and install a certificate

USAGE:
   lego run

OPTIONS:
   --no-bundle                                Do not create a certificate bundle by adding the issuers certificate to the new certificate.
   --must-staple                              Include the OCSP must staple TLS extension in the CSR and generated certificate. Only works if the CSR is generated by lego.
   --not-before time                          Set the notBefore field in the certificate (RFC3339 format)
   --not-after time                           Set the notAfter field in the certificate (RFC3339 format)
   --private-key string                       Path to private key (in PEM encoding) for the certificate. By default, the private key is generated.
   --preferred-chain string                   If the CA offers multiple certificate chains, prefer the chain with an issuer matching this Subject Common Name. If no match, the default offered chain will be used.
   --profile string                           If the CA offers multiple certificate profiles (draft-ietf-acme-profiles), choose this one.
   --always-deactivate-authorizations string  Force the authorizations to be relinquished even if the certificate request was successful.
   --run-hook string                          Define a hook. The hook is executed when the certificates are effectively created.
   --run-hook-timeout duration                Define the timeout for the hook execution. (default: 2m0s)
   --help, -h                                 show help
"""

[[command]]
title   = "lego help renew"
content = """
NAME:
   lego renew - Renew a certificate

USAGE:
   lego renew

OPTIONS:
   --days int                                 The number of days left on a certificate to renew it. (default: 30)
   --dynamic                                  Compute dynamically, based on the lifetime of the certificate(s), when to renew: use 1/3rd of the lifetime left, or 1/2 of the lifetime for short-lived certificates). This supersedes --days and will be the default behavior in Lego v5.
   --ari-disable                              Do not use the renewalInfo endpoint (RFC9773) to check if a certificate should be renewed.
   --ari-wait-to-renew-duration duration      The maximum duration you're willing to sleep for a renewal time returned by the renewalInfo endpoint. (default: 0s)
   --reuse-key                                Used to indicate you want to reuse your current private key for the new certificate.
   --no-bundle                                Do not create a certificate bundle by adding the issuers certificate to the new certificate.
   --must-staple                              Include the OCSP must staple TLS extension in the CSR and generated certificate. Only works if the CSR is generated by lego.
   --not-before time                          Set the notBefore field in the certificate (RFC3339 format)
   --not-after time                           Set the notAfter field in the certificate (RFC3339 format)
   --preferred-chain string                   If the CA offers multiple certificate chains, prefer the chain with an issuer matching this Subject Common Name. If no match, the default offered chain will be used.
   --profile string                           If the CA offers multiple certificate profiles (draft-ietf-acme-profiles), choose this one.
   --always-deactivate-authorizations string  Force the authorizations to be relinquished even if the certificate request was successful.
   --renew-hook string                        Define a hook. The hook is executed only when the certificates are effectively renewed.
   --renew-hook-timeout duration              Define the timeout for the hook execution. (default: 2m0s)
   --no-random-sleep                          Do not add a random sleep before the renewal. We do not recommend using this flag if you are doing your renewals in an automated way.
   --force-cert-domains                       Check and ensure that the cert's domain list matches those passed in the domains argument.
   --help, -h                                 show help
"""

[[command]]
title   = "lego help revoke"
content = """
NAME:
   lego revoke - Revoke a certificate

USAGE:
   lego revoke

OPTIONS:
   --keep, -k     Keep the certificates after the revocation instead of archiving them.
   --reason uint  Identifies the reason for the certificate revocation. See https://www.rfc-editor.org/rfc/rfc5280.html#section-5.3.1. Valid values are: 0 (unspecified), 1 (keyCompromise), 2 (cACompromise), 3 (affiliationChanged), 4 (superseded), 5 (cessationOfOperation), 6 (certificateHold), 8 (removeFromCRL), 9 (privilegeWithdrawn), or 10 (aACompromise). (default: 0)
   --help, -h     show help
"""

[[command]]
title   = "lego help list"
content = """
NAME:
   lego list - Display certificates and accounts information.

USAGE:
   lego list

OPTIONS:
   --accounts, -a  Display accounts.
   --names, -n     Display certificate common names only.
   --help, -h      show help
"""

[[command]]
title   = "lego dnshelp"
content = """
Credentials for DNS providers must be passed through environment variables.

To display the documentation for a specific DNS provider, run:

  $ lego dnshelp -c code

Supported DNS providers:
  acmedns, active24, alidns, aliesa, allinkl, alwaysdata, anexia, arvancloud, auroradns, autodns, axelname, azion, azure, azuredns, baiducloud, beget, binarylane, bindman, bluecat, bookmyname, brandit, bunny, checkdomain, civo, clouddns, cloudflare, cloudns, cloudru, cloudxns, com35, conoha, conohav3, constellix, corenetworks, cpanel, ddnss, derak, desec, designate, digitalocean, directadmin, dnsexit, dnshomede, dnsimple, dnsmadeeasy, dnspod, dode, domeneshop, dreamhost, duckdns, dyn, dyndnsfree, dynu, easydns, edgecenter, edgedns, edgeone, efficientip, epik, exec, exoscale, f5xc, freemyip, gandi, gandiv5, gcloud, gcore, gigahostno, glesys, godaddy, googledomains, gravity, hetzner, hostingde, hostinger, hostingnl, hosttech, httpnet, httpreq, huaweicloud, hurricane, hyperone, ibmcloud, iij, iijdpf, infoblox, infomaniak, internetbs, inwx, ionos, ionoscloud, ipv64, ispconfig, ispconfigddns, iwantmyname, jdcloud, joker, keyhelp, liara, lightsail, limacity, linode, liquidweb, loopia, luadns, mailinabox, manageengine, manual, metaname, metaregistrar, mijnhost, mittwald, myaddr, mydnsjp, mythicbeasts, namecheap, namedotcom, namesilo, nearlyfreespeech, neodigit, netcup, netlify, nicmanager, nicru, nifcloud, njalla, nodion, ns1, octenium, oraclecloud, otc, ovh, pdns, plesk, porkbun, rackspace, rainyun, rcodezero, regfish, regru, rfc2136, rimuhosting, route53, safedns, sakuracloud, scaleway, selectel, selectelv2, selfhostde, servercow, shellrent, simply, sonic, spaceship, stackpath, syse, technitium, tencentcloud, timewebcloud, todaynic, transip, ultradns, uniteddomains, variomedia, vegadns, vercel, versio, vinyldns, virtualname, vkcloud, volcengine, vscale, vultr, webnamesca, webnamesru, websupport, wedos, westcn, yandex, yandex360, yandexcloud, zoneedit, zoneee, zonomi

More information: https://go-acme.github.io/lego/dns
"""