Hetzner "DNS Console is moving to the Hetzner Console"

[tsohst]

What provider would you like to see added to NPM?
Hetzner is moving DNS Console to the Hetzner Console.
After migration in Hetzner to Hetzner Console, DNS challenge seems broken because of "zone not found".

[10/19/2025] [7:27:03 PM] [Global   ] › ⬤  debug     CMD: certbot certonly --config '/etc/letsencrypt.ini' --work-dir "/tmp/letsencrypt-lib" --logs-dir "/tmp/letsencrypt-log" --cert-name 'npm-32' --agree-tos --email 'XXXX' --domains 'XXXX' --authenticator 'dns-hetzner' --dns-hetzner-credentials '/etc/letsencrypt/credentials/credentials-32' 

[10/19/2025] [7:27:06 PM] [Global   ] › ⬤  debug     CMD: /usr/sbin/nginx -t -g "error_log off;"

[10/19/2025] [7:27:06 PM] [Nginx    ] › ℹ  info      Reloading Nginx

[10/19/2025] [7:27:06 PM] [Global   ] › ⬤  debug     CMD: /usr/sbin/nginx -s reload

[10/19/2025] [7:27:06 PM] [Express  ] › ⚠  warning   Saving debug log to /tmp/letsencrypt-log/letsencrypt.log

Encountered exception during recovery: certbot_dns_hetzner.hetzner_client._ZoneNotFoundException: Zone port.movtube.de not found in Hetzner account

Zone port.movtube.de not found in Hetzner account

Before:

curl -sS https://dns.hetzner.com/api/v1/zones   -H "Auth-API-Token: XXXXX"
{"zones":[],"meta":{"pagination":{"page":0,"per_page":0,"previous_page":0,"next_page":0,"last_page":0,"total_entries":0}},"error":{"message":"zone not found","code":404}}

After the migration

        curl -H "Authorization: Bearer XXXXX" \
        "https://api.hetzner.cloud/v1/zones"
{
    "meta": {
        "pagination": {
            "last_page": 1,
            "next_page": null,
            "page": 1,
            "per_page": 25,
            "previous_page": null,
            "total_entries": 1
        }
    },
    "zones": [
        {

[lastsamurai26]

Please read this
https://docs.hetzner.com/de/networking/dns/migration-to-hetzner-console/process/

[tsohst]

The DNS API can no longer be used for the zone after migration. If you use third-party integrations, please first ensure that they support the new Cloud API.

So here is my request to impement the new API.

[lastsamurai26]

Supposedly, DNS multi can already do this, but it doesn't work with the plugin via NPM or certbot :-(

[Saetron]

Supposedly, DNS multi can already do this, but it doesn't work with the plugin via NPM or certbot :-(

DNSmulti on NPM v2.12.6 worked for me without issues for Hetzner Cloud DNS (with a Read Write API Key)

[lastsamurai26]

ok how did you updatet the certbot plugin to version 4.27.0 ?

because i got this

[10/23/2025] [9:13:58 AM] [Global ] › ⬤ debug CMD: . /opt/certbot/bin/activate && pip install --no-cache-dir certbot-dns-multi~=4.9 && deactivate

[Saetron]

ok how did you updatet the certbot plugin to version 4.27.0 ?

I would guess you would have to recreate the container (I am using the docker version (image: 'jc21/nginx-proxy-manager:latest'))
I am on a new setup though, saw your message and tried it and it just worked.

[lastsamurai26]

Okay, I built another complete image because, unfortunately, go is not installed, so I have to do it myself, and yet only certbot-dns-multi is installed, as can be seen here

“dnsmulti”: {
    “name”: “DnsMulti”,
    “package_name”: “certbot-dns-multi”,
		“package_name”: “certbot-dns-multi”,
        “version”: “~=4.9”,
		“dependencies”: “”,
		“credentials”: “# See https://go-acme.github.io/lego/dns/#dns-providers for list of providers and their settings\n# Example provider configuration for DreamHost\n# dns_multi_provider = dreamhost\n# DREAMHOST_API_KEY = ABCDEFG1234”,
		“full_plugin_name”: “dns-multi”
    },

https://github.com/NginxProxyManager/nginx-proxy-manager/blob/develop/global/certbot-dns-plugins.json

What am I doing wrong?

[touro411]

I have pulled a new image (latest), but it doesnt work to pull a certicate from letsencrypt

errorlog from npm:

`CommandError: Saving debug log to /tmp/letsencrypt-log/letsencrypt.log
Encountered exception during recovery: certbot.errors.PluginError: Malformed authorization or invalid API token
Malformed authorization or invalid API token
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /tmp/letsencrypt-log/letsencrypt.log or re-run Certbot with -v for more details.

at /app/lib/utils.js:16:13
at ChildProcess.exithandler (node:child_process:430:5)
at ChildProcess.emit (node:events:524:28)
at maybeClose (node:internal/child_process:1104:16)
at ChildProcess._handle.onexit (node:internal/child_process:304:5)`

ok how did you updatet the certbot plugin to version 4.27.0 ?

How can I update certbot in the nginx proxy manager container?

[Saetron]

So I just installed NPM (the container most likely pulls the newest version of DNSmulti on startup). Went to the SSL tab on NPM -> Add SSL Certificate, Lets Encrypt, DNS Challenge -> DNSmulti.
In the file config i added:
dns_multi_provider = hetzner
HETZNER_API_TOKEN = myToken

And submitted it, took like 30-40 seconds until i got the cert.
Got the API token under https://console.hetzner.com/ -> DNS Migrated -> Security -> API tokens

[touro411]

So I just installed NPM (the container most likely pulls the newest version of DNSmulti on startup). Went to the SSL tab on NPM -> Add SSL Certificate, Lets Encrypt, DNS Challenge -> DNSmulti.
In the file config i added:
dns_multi_provider = hetzner
HETZNER_API_TOKEN = myToken

And submitted it, took like 30-40 seconds until i got the cert.
Got the API token under https://console.hetzner.com/ -> DNS Migrated -> Security -> API tokens

Yes, this works! Thanks

[lastsamurai26]

i tried it but i need to install go inside of the docker ... and this only works if i create my own images.
That's why I always got the latest version, but for some reason, it still only gets version 4.9 of the DNS Mutli plugin.

directly with certbot on the server with the newst dns multi plugin works but not with the one inside of the docker because it is version 4.9 not 4.27.0