---
title: Charmhub | Deploy LEGO using Charmhub - The Open Operator Collection
description: Deploy the latest version of LEGO on any cloud.
url: https://charmhub.io/lego/configurations
---

# LEGO

[Canonical Telco](https://charmhub.io/publisher/telco-charmers "View all packages from Canonical Telco")

* [Canonical Telco](https://charmhub.io/publisher/telco-charmers "View all packages from Canonical Telco")

Platform:

24.04

22.04

4/stable 510

```
juju deploy lego --channel 4/stable
```

[Learn to deploy on juju >](https://juju.is/docs/juju/manage-applications)

* [acme-ca-certificates](https://charmhub.io/lego/configurations#acme-ca-certificates)
* [dns-nameservers](https://charmhub.io/lego/configurations#dns-nameservers)
* [dns-propagation-wait](https://charmhub.io/lego/configurations#dns-propagation-wait)
* [eab-secret-id](https://charmhub.io/lego/configurations#eab-secret-id)
* [email](https://charmhub.io/lego/configurations#email)
* [expiry\_ratio](https://charmhub.io/lego/configurations#expiry_ratio)
* [plugin](https://charmhub.io/lego/configurations#plugin)
* [plugin-config-secret-id](https://charmhub.io/lego/configurations#plugin-config-secret-id)
* [server](https://charmhub.io/lego/configurations#server)

[Learn about configurations >](https://juju.is/docs/juju/configuration#heading--application-configuration)

* acme-ca-certificates | string

  PEM-encoded CA certificates that can be used to authenticate an ACME server with an HTTPS certificate not issued by a CA in the system-wide trusted root list.
  This should only be used for ACME servers that are not in the system-wide trusted root list and not operated by a charm.
  Otherwise, use the `receive-ca-cert` relation to get the CAs from the ACME provider charm.
  Example usage: `juju config lego acme-ca-certificate="$(cat /path/to/ca-bundle.pem)"`
* dns-nameservers | string

  Comma-separated list of DNS nameserver addresses to use for DNS-01 challenge verification.
  Can include ports (e.g., "8.8.8.8:53,8.8.4.4:53") or just IP addresses (port 53 assumed).
  If not set, the system's default nameservers will be used.
* dns-propagation-wait | int

  DNS propagation timeout in seconds. How long to wait for DNS records to propagate before ACME verification attempts.
  Must be a positive integer. Useful in environments with slow DNS propagation or caching issues.
  If not set, LEGO's default timeout will be used.
* eab-secret-id | string

  The secret id of a Juju user secret containing External Account Binding (EAB) credentials. Required for ACME servers that mandate EAB, such as DigiCert or ZeroSSL. The secret must contain exactly two keys: `eab-kid` (the key identifier) and `eab-hmac` (the base64url-encoded HMAC key), both as provided by the CA dashboard. Both keys must be present; providing only one will put the charm in a blocked state. Example: `juju add-secret my-eab eab-kid=<KID> eab-hmac=<HMAC>` then `juju config lego eab-secret-id=<secret-id>`.
* email | string

  Account email address to receive notifications from Let's Encrypt.
* expiry\_ratio | float

  Default: 0.15

  Ratio (fraction) of certificate lifetime remaining below which the charm logs the expiring certificate.
  Must be > 0 and <= 1. For example, 0.15 means "15% or less of the certificate lifetime remaining".
* plugin | string

  The DNS plugin to use with LEGO. You can choose from a list of supported plugins documented on the [LEGO website](https://go-acme.github.io/lego/dns).
* plugin-config-secret-id | string

  The secret id of the secret that contains all of the configuration options required to get a certificate. The dictionary inside the secret should be key-value pairs that map directly to the options required by the plugin. All keys are expected to be in lowercase with dashes instead of underscores. You can find the required options for your chosen plugin in the [LEGO documentation](https://go-acme.github.io/lego/dns). For example, the `route53` plugin requires a `secret-access-key` and `access-key-id` to be set.
* server | string

  Default: https://acme-v02.api.letsencrypt.org/directory

  Certificate authority ACME server