Install LEGO

LEGO_VERSION=$(curl -s https://api.github.com/repos/go-acme/lego/releases/latest | grep '"tag_name"' | cut -d'"' -f4)
curl -L "https://github.com/go-acme/lego/releases/download/${LEGO_VERSION}/lego_${LEGO_VERSION}_linux_amd64.tar.gz" | tar -xz
sudo mv lego /usr/local/sbin
sudo chown root:root /usr/local/sbin
sudo chmod 644 /usr/local/sbin

LEGO with Hetzner

# https://console.hetzner.cloud/ dSecurity → API tokens → Generate (Read & Write)
export HETZNER_API_TOKEN="xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
export HETZNER_PROPAGATION_TIMEOUT=600

LEGO confiuration file

# .lego.yml
accounts:
  default:
    email: mail@example.com
    acceptsTermsOfService: true

challenges:
  hetzner:
    dns:
      provider: hetzner
      #envFile: /root/.lego/hetzner.env
      dnsTimeout: 600

certificates:
  example.com:
    challenge: hetzner
    domains:
      - example.com
      - '*.example.com'
  i.example.com:
    challenge: hetzner
    domains:
      - i.example.com
      - '*.i.example.com'

LEGO CLI

DOMAINS="--domains example.com --domains *.example.com --domains example.com

lego run \
  --dns hetzner \
  --email it@example.com \
  --accept-tos \
  ${DOMAINS}

Debug

lego certificates list
--server https://acme-staging-v02.api.letsencrypt.org/directory \
curl -s -H "Authorization: Bearer $HETZNER_API_TOKEN" "https://api.hetzner.cloud/v1/zones"

Links
https://github.com/go-acme/lego
https://go-acme.github.io/lego/dns/