Support · Requirements · Installation · License · Related Integrations
The IBM NS1 DNS Provider plugin enables automated DNS-based domain validation for Keyfactor certificate lifecycle management through IBM NS1 Connect (formerly NS1 Managed DNS). This plugin integrates with the NS1 REST API to automatically create, verify, and delete DNS TXT records required for domain validation during certificate issuance and renewal.
- Automated DNS TXT record creation and deletion in IBM NS1
- API key authentication scoped per-token at the NS1 account level
- Automatic zone discovery via the NS1 zone listing API
- Works with both public and private NS1 zones the API key is permitted to access
- Keyfactor AnyCA Gateway REST 26.2 or later (DNS validation support was added in AnyCA Gateway 26.2)
- A gateway product that supports DNS-01 domain validation (ACME REST Gateway, DigiCert, Sectigo, etc.)
- An IBM NS1 Connect account with at least one zone hosted on NS1
- An NS1 API key with permission to read zones and create/delete records (Account > API Keys in the NS1 portal)
- Network reachability from the gateway server to
api.nsone.neton HTTPS/443
- .NET 10.0 runtime (provided by the gateway server)
- Network connectivity to api.nsone.net (HTTPS/443)
This plugin is installed alongside any Keyfactor gateway server that supports DNS-01 domain validation (ACME REST Gateway, DigiCert, Sectigo, etc.). The same DLL works with every supported gateway.
See the official Keyfactor AnyCA Gateway REST installation documentation for the authoritative install instructions: . The steps below are a general guide; defer to the official docs if they diverge.
Download the latest release from the Releases page.
On the server hosting your gateway, unzip the release and copy the contents of the net10.0 directory into the gateway's Extensions folder.
Windows (example path — substitute the gateway product folder for your install):
C:\Program Files\Keyfactor\<GatewayName>\AnyGatewayREST\net10.0\Extensions\
Linux:
/opt/keyfactor/<gateway-name>/AnyGatewayREST/net10.0/Extensions/
Replace <GatewayName> (or <gateway-name> on Linux) with the gateway you are installing into (e.g. AcmeGwDns, DigiCert, Sectigo).
Restart the AnyGatewayREST Windows service for the gateway you installed the plugin into so the Extensions folder is rescanned.
After installing the plugin DLL into the gateway's Extensions folder, configure a new DNS Provider entry in the AnyCA Gateway REST UI and select IBM NS1 as the provider type. See the official Keyfactor AnyCA Gateway REST documentation for the canonical UI walkthrough: .
- Sign in to the NS1 portal
- Navigate to Account > API Keys
- Click Add API Key and choose a least-privilege permission set:
- DNS > Zones: View
- DNS > Records: Create, Update, Delete on the zones used for ACME validation
- Copy the key value — NS1 displays it only at creation time
- Provide the key as
Ns1_ApiKeyin the plugin configuration below
| Parameter | Description | Required | Example |
|---|---|---|---|
Ns1_ApiKey |
NS1 (IBM NS1 Connect) API key. Create under Account > API Keys in the NS1 portal with permissions to read zones and create/delete TXT records. | Yes | |
Standard configuration:
{
"Ns1_ApiKey": "your-ns1-api-key",
"PropagationWaitSeconds": 60,
"MaxWaitSeconds": 300,
"RetryAttempts": 3
}Once configured, the plugin automatically handles DNS validation during certificate enrollment and renewal:
- Record Creation: Plugin creates a DNS TXT record with the validation challenge
- Propagation Wait: Plugin waits for DNS propagation
- Verification: Plugin verifies the record exists on IBM NS1 nameservers
- Cleanup: Plugin deletes the validation record after successful validation
The plugin queries the NS1 API for all zones accessible to the configured key and selects the longest-suffix match for each target domain.
Test NS1 API access using curl:
# Replace with your API key
API_KEY=your-ns1-api-key
# List zones visible to this API key
curl -s -H "X-NSONE-Key: $API_KEY" https://api.nsone.net/v1/zones
# Inspect a specific zone
curl -s -H "X-NSONE-Key: $API_KEY" https://api.nsone.net/v1/zones/example.comAuthentication Failures
Symptom: 401 Unauthorized from api.nsone.net
- Verify the API key has not been deleted or rotated in the NS1 portal
- Check that the key has not been IP-restricted in a way that excludes the gateway server's outbound IP
- Confirm the gateway server's clock is roughly accurate
Insufficient Permissions
Symptom: 403 Forbidden on TXT record creation
- Confirm the API key has Create/Update/Delete permissions on records for the target zone
- Permissions are scoped per-zone — a key restricted to specific zones cannot modify zones outside its allow-list
Zone Not Found
Symptom: No NS1 zone found for example.com
- Verify the zone exists in NS1 and is in an active state
- Confirm the API key's permissions include the zone
- For zones using NS1's "Networks" feature (split-view), the key must be permitted on the network you intend to update
Enable debug logging in the gateway's logging configuration:
{
"Logging": {
"LogLevel": {
"Keyfactor.Extensions.DomainValidator.Ns1": "Debug"
}
}
}Check IBM NS1 service status: https://status.ns1.com/
The IBM NS1 DNS Provider plugin is supported by Keyfactor for Keyfactor customers. If you have a support issue, please open a support ticket via the Keyfactor Support Portal at https://support.keyfactor.com.
To report a problem or suggest a new feature, use the Issues tab. If you want to contribute actual bug fixes or proposed enhancements, use the Pull requests tab.
Apache License 2.0, see LICENSE.
See all Keyfactor DNS Provider plugins.