From d3a658462f773c31a68d5202e591f1446d3848ba Mon Sep 17 00:00:00 2001 From: Gitead Date: Tue, 6 Oct 2026 22:12:00 -0400 Subject: [PATCH] docs: step-by-step Cloudflare API token setup for LAN HTTPS, with token check and 6003 error fix Co-Authored-By: Claude Opus 5.5 --- README.md | 28 +++++++++++++++++++++++++--- 1 file changed, 25 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index 312b52fb..aa94d3e3 100644 --- a/README.md +++ b/README.md @@ -814,24 +814,46 @@ sudo apt install -y certbot python3-certbot-dns-cloudflare ### Step 4 — Create a scoped Cloudflare API token -Cloudflare dashboard → profile icon → **My Profile** → **API Tokens** → **Create Token** → use the -**"Edit zone DNS"** template, restricted to **Specific zone → mydentalofficemanagement.com**. +**4a. Create the token (in a browser):** -Save it in a credentials file, root-only: +1. Go to `dash.cloudflare.com` → profile icon (top right) → **My Profile** → **API Tokens** → **Create Token** +2. Use the **Edit zone DNS** template +3. Under **Zone Resources**, choose **Specific zone** → `mydentalofficemanagement.com` +4. Click **Continue to summary** → **Create Token**, then copy the token. It's only shown once. + +**4b. Check the token works** (replace `YOUR_TOKEN`): + +```sh +curl -s -H "Authorization: Bearer YOUR_TOKEN" https://api.cloudflare.com/client/v4/user/tokens/verify +# should include: "status":"active" +``` + +**4c. Save it in a root-only credentials file:** ```sh sudo mkdir -p /etc/letsencrypt sudo nano /etc/letsencrypt/cloudflare.ini ``` +Make the file exactly this one line, with your token pasted after `= ` (paste in the terminal with `Ctrl+Shift+V`; clear old lines with `Ctrl+K`): + ```ini dns_cloudflare_api_token = ``` +No quote marks, and no spaces or line breaks after the token. Save and exit with `Ctrl+O`, `Enter`, `Ctrl+X`, then lock the file: + ```sh sudo chmod 600 /etc/letsencrypt/cloudflare.ini ``` +> **If certbot fails with `Error determining zone_id: 6003 Invalid request headers`,** the token in +> this file is malformed: the `` placeholder was left in, there are extra +> characters or quotes, or the token ID / Global API Key was copied instead of the token itself. +> Check it with `sudo cat /etc/letsencrypt/cloudflare.ini`, re-test with 4b, fix the file, and run +> Step 5 again. (The yellow `PendingDeprecationWarning` box certbot prints about the `cloudflare` +> Python package is harmless.) + > The same token can be reused across offices (Cloudflare tokens are scoped to the whole zone, > not a single subdomain) — but issuing one token per server makes it easy to revoke just one if > a machine is ever decommissioned.