Go to Cloudflare API Tokens:
Use the “Create Custom Token” option.
Choose template: Edit zone DNS
Permissions:
Bash
Zone: DNS → Edit
Zone: Zone → Read
Zone Resources: Include only the domain(s) you needSave the token somewhere secure.
Create a file with restricted permissions:
Bash
sudo mkdir -p /etc/letsencrypt
sudo nano /etc/letsencrypt/cloudflare.iniAdd the following to the file:
Bash
dns_cloudflare_api_token = YOUR_API_TOKENSecure the file
Bash
sudo chmod 600 /etc/letsencrypt/cloudflare.iniLets install certbot with the cloudflare options
Bash
sudo apt install python3-certbot-dns-cloudflareAlrights lets goooo
Bash
sudo certbot certonly \
--dns-cloudflare \
--dns-cloudflare-credentials /etc/letsencrypt/cloudflare.ini \
-d yourdomain.com -d *.yourdomain.com