Cant get hetzner DNS chan

Nielsasdasd

Can’t get Hetzner DNS challenge to work after Hetzner changed their DNS API.
Certwarden worked before the update.
I have a new Hetzner API key, and tested it with lego v5.4.0 (pulled latest from git and build it). I’m able to get a certificate for my domain after creating the .lego.yml file.

I have updated certwarden to version 0.29.7 running the image from docker hub.
Provider configuration:
Type: DNS-01 Go acme le-go
Domain1: mydomain.dk
Post provision wait:300s
Provider code: hetzner
HETZNER_API_KEY=<new key>

Failed with: "deprovision failed (hetzner (legacy): unable to unmarshal response: "
Why does it say hetzner (legacy)? The old API does not work anymore, and thus should not be used?

Log:

8/29/2026, 11:20:52 AM, info, orders/fulfilling_do.go:227, orders: fulfilling worker 0: order 17 done 8/29/2026, 11:20:50 AM, info, orders/fulfilling_do.go:24, orders: fulfilling worker 0: ordering order id 17 (certificate name: deadzone.dk, subject: deadzone.dk) 8/29/2026, 11:20:50 AM, info, orders/auto_ordering.go:92, orders: 1 incomplete orders added to order queue 8/29/2026, 10:20:40 AM, error, challenges/solver.go:74, challenges: deprovision failed (hetzner (legacy): unable to unmarshal response: [status code: 200] body: 
    <link rel="stylesheet" href="/assets/outdated.css?v=1.0.8">
    <link rel="search" type="application/opensearchdescription+xml" title="Hetzner Console" href="/assets/opensearch.xml?v=6">
    <script src="/assets/outdated.min.js?v=1.0.8"></script>
    <script>
        checkOutdatedBrowser();
    </script>
    <script type="text/javascript"> var hcAppConfig = function () { return {
"login_url": "https://accounts.hetzner.com/oauth/authorize", "logout_url": "https://accounts.hetzner.com/logout", "api_base_url": "https://api.hetzner.cloud/v1", "hetzner_online_api_base_url": "https://api.hetzner.com/v1", "log_level": 4, "environment": "production", "sentry_dsn": "https://xxxxxxxxxxxxxxxxxxxxxxxxxxx@sentry.hetzner.com/134", "version": "control-panel_25.10.1", "content_api_url": "https://docs-content.hetzner.cloud", "support_suggestions_api_url": "https://doc-search-api.hetzner.com/api/v1"

Nielsasdasd

I have also tried with DNS-01 acme.sh
hookname: dns_hetznercloud
Variable 1: HETZNER_TOKEN=<token>

8/29/2026, 7:46:34 PM, error, dns01acmesh/resources_otheros.go:54, acme.sh dns deprovision script error: exit status 1 8/29/2026, 7:46:34 PM, error, dns01acmesh/resources_otheros.go:51, acme.sh dns deprovision script std err: [Sat Aug 29 17:46:34 UTC 2026] Config file is empty, cannot save SAVED_HETZNER_TOKEN=QcIR9XDiXk82JpfNO5lmjBfeE9UV2PQY033Z5TpETyUt8UMqYjRI2sKVUjk8BraD [Sat Aug 29 17:46:34 UTC 2026] Config file is empty, cannot clear [Sat Aug 29 17:46:34 UTC 2026] Config file is empty, cannot save SAVED_HETZNER_API=https://api.hetzner.cloud/v1 [Sat Aug 29 17:46:34 UTC 2026] Config file is empty, cannot clear [Sat Aug 29 17:46:34 UTC 2026] Config file is empty, cannot save SAVED_HETZNER_TTL=120 [Sat Aug 29 17:46:34 UTC 2026] Config file is empty, cannot clear [Sat Aug 29 17:46:34 UTC 2026] Config file is empty, cannot save SAVED_HETZNER_MAX_ATTEMPTS=120 [Sat Aug 29 17:46:34 UTC 2026] Config file is empty, cannot clear ./scripts/acme.sh/dnsapi_cw/dns_hetznercloud.sh: line 429: : No such file or directory grep: : No such file or directory [Sat Aug 29 17:46:34 UTC 2026] Hetzner Cloud zone lookup failed (HTTP ) ./scripts/acme.sh/dnsapi_cw/dns_hetznercloud.sh: line 429: : No such file or directory grep: : No such file or directory [Sat Aug 29 17:46:34 UTC 2026] Hetzner Cloud zone lookup failed (HTTP ): Zone not found [Sat Aug 29 17:46:34 UTC 2026] Unable to determine Hetzner Cloud zone for _acme-challenge.xxxxxx.dk

Nielsasdasd

acme.sh reports:

Config file is empty, cannot clear ./scripts/acme.sh/dnsapi_cw/dns_hetznercloud.sh: line 437: : No such file or directory

I have tried to figure out how acme.sh works, it seems like is calls dns_hetznercloud.sh, directly without calling acme.sh ?

I have tested acme.sh inside my docker instance:

./acme.sh --register-account  -m acme@xxx.dk --server  letsencrypt
export HETZNER_TOKEN="redacted"
./acme.sh --issue --dns dns_hetznercloud -d xxxx.dk --server  letsencrypt

This creates the certificates, and create the missing configuration files in /root/.acme.sh/ including account.conf
But those are not in the persistent /app/data and will get lost on restart, my guess is that certwarden tries to build the configuration file (but fails?), and override the path somehow.

Is there a method to move the configfile so that acme.sh will work ?
Or better to get the le-go client to work.

gregtwallace

acme.sh is definitely flaky for some providers and I've seen that config error before. I don't think there's really a way to fix it, unfortunately, which is why the docs suggest lego acme (which I know you tried first).

As for lego, I'm not really sure why it would be throwing this error. The current build is using lego version 5.3.1. Can you check if that version works? It may just be a case of me needing to update the dependency to the latest version.

Nielsasdasd

I have tested the lego 3.5.1 cli, and it works correct.

From the change log there are no hint about Hetzner specific changes since 4.31.0.
v4.31.0 hetzner: fix compatibility with _FILE suffix
v4.27.0 hetzner: update to new API
v4.8.0 hetzner: set min TTL to 60s
v3.7.0 Heztner: Implementation

Nielsasdasd

I have found the problem.
The enviroment variable had changed from HETZNER_API_KEY to HETZNER_API_TOKEN.
Now it works again.