thanks for your suggestion

i used the Cloudflare Origin CA Certificates on my webservers and it worked but on this server i have also mail service postfix and dovecot. When i access my mail in mail client , i got the error message show that this cert is not trusted. So i think this solution isn't the best in my case.

I choose the second solution using the DNS hooks bash script. When i run the ./dehydrated -c -t dns-01 -k 'hooks/cfhookbash/hook.sh' , i got another error message like this

=================================

Processing mail.vidtubeworld.com
 + Signing domains...
 + Generating private key...
 + Generating signing request...
 + Requesting new certificate order from CA...
 + Received 1 authorizations URLs from the CA
 + Handling authorization for mail.vidtubeworld.com
 + 1 pending challenge(s)
 + Deploying challenge tokens...
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   371    0   214  100   157   1491   1094 --:--:-- --:--:-- --:--:--  1496
+++ Wait for 10 seconds. +++
 + Responding to challenge for mail.vidtubeworld.com authorization...
 + Cleaning challenge tokens...
id: null
{"success":false,"errors":[{"code":7003,"message":"Could not route to \/zones\/dns_records\/null, perhaps your object identifier is invalid?"},{"code":7000,"message":"No route for that URI"}],"messages":[],"result":null} + Challenge validation has failed :(
ERROR: Challenge is invalid! (returned: invalid) (result: {
  "type": "dns-01",
  "status": "invalid",
  "error": {
    "type": "urn:ietf:params:acme:error:dns",
    "detail": "DNS problem: NXDOMAIN looking up TXT for _acme-challenge.mail.vidtubeworld.com - check that a DNS record exists for this domain",
    "status": 400
  },
  "url": "https://acme-v02.api.letsencrypt.org/acme/chall-v3/6547262320/5WU_Qw",
  "token": "p_WvHMKzHhA2_u1_o2oO18RHsDiFUUSCTdGsJFGixJA"
})

================================

The problem is that i dont have the token to add into a TXT record for _acme-challenge.mail.vidtubeworld.com on Cloudflare DNS

Do you have any suggestion ?

Hi everyone,

After checking some config files, i edited the config.sh file in cfhookbash folder 

case ${1} in
    "www.yourdomain.com")
        global_api_key="api"
        zones="zone id"
        email="email registered cloudflare account"
    ;;

    "yourdomain.com")
        global_api_key="api"
        zones="zone id"
        email="email registered cloudflare account"
    ;;

    "mail.yourdomain.com")
        global_api_key="api"
        zones="zone id"
        email="email registered cloudflare account"
    ;;

    # if you have another subdomains else, put them here also

    "sub.yourdomain.com")
        global_api_key="api"
        zones="zone id"
        email="email registered cloudflare account"
    ;;

....
esac

After that i run the command again and it worked for me :)

./dehydrated -c -t dns-01 -k 'hooks/cfhookbash/hook.sh'

Now i'm configuring the rest and i will update infor when i finish 

Thanks again :)

Finally i finish the task. I summarize here step by step the method i used, that may help someone else

Take the snapshot for container or vm that you do the test

1. Disable auto renew cert in confconsole

2. Setup

cd ~
git clone https://github.com/sineverba/cfhookbash.git

3.Configuration

• Create a file domains.txt in the folder of dehydrated
• Put inside a list (one for line) of domains that need certificates.

nano /etc/dehydrated/domains.txt

www.example.com
home.example.net
[...]

• or use the old one 

cp /etc/dehydrated/confconsole.domains.txt /etc/dehydrated/domains.txt

• Move to the folder of cfhookbash

cd cfhookbash/ 

• Copy config.default.sh to config.sh

cp config.default.sh config.sh

• Edit config.sh. To get values:

nano config.sh

case ${1} in

    "domain.com")
        global_api_key="key"
        zones="zone-id"
        email="email registered cloudflare"
    ;;

    "sub.domain.com")
        global_api_key="key"
        zones="zone-id"
        email="email registered cloudflare"
    ;;

    "sub2.domain.com")
        global_api_key="key"
        zones="zone-id"
        email="email registered cloudflare"
    ;;
esac

4. Usage

cd /etc/dehydrated
dehydrated --register --accept-terms

./dehydrated -c -t dns-01 -k '${PATH_WHERE_YOU_CLONED_CFHOOKBASH}/cfhookbash/hook.sh'

In my case

dehydrated -c -t dns-01 -k '/root/cfhookbash/hook.sh'

!!!!! Check carefully api-key, zone-id and email in the config.sh file, else you would got the error message

5. Post deploy

cd cfhookbash/
cp deploy.config.sh deploy.sh && rm deploy.config.sh && nano deploy.sh

case ${1} in

        "domain.com")
        #move certificate to private

        cp /var/lib/dehydrated/certs/domain.com/fullchain.pem /etc/ssl/private/cert.pem
        cp /var/lib/dehydrated/certs/domain.com/privkey.pem /etc/ssl/private/cert.key
        cp /var/lib/dehydrated/certs/domain.com/fullchain.pem /etc/ssl/certs/ca-certificates.crt

        #restart nginx
        #service nginx restart
    # for apache
    service apache2 restart
======================
the below part is not necessary for my case
        #exchange certificate for domoticz
        rm /home/sineverba/domoticz/server_cert.pem
        cat /var/www/domain/private/privkey.pem >> /home/sineverba/domoticz/server_cert.pem
        cat /var/www/domain/private/fullchain.pem >> /home/sineverba/domoticz/server_cert.pem
        cp /home/sineverba/domoticz/server_cert.pem /home/sineverba/domoticz/letsencrypt_server_cert.pem

        #restart domoticz
        /etc/init.d/domoticz.sh restart

    #restart mysensors
    service mysgw restart
========================
        ;;

esac

6. Cronjob

crontab -e

0 4 * * 1 cd /home/YOUR_USER/dehydrated && /home/YOUR_USER/dehydrated/dehydrated -c -t dns-01 -k '/home/YOUR_USER/dehydrated/hooks/cfhookbash/hook.sh' >> /home/YOUR_USER/cfhookbash.log

in my case

0 4 * * 1 cd /etc/dehydrated && /etc/dehydrated/dehydrated -c -t dns-01 -k '/path/to/folder/cfhookbash/hook.sh' >> /path/to/folder/cfhookbash/cfhookbash.log

7. Update / upgrade

• Move to folder where you downloaded the hook bash

cd cfhookbash/

• Type 

git checkout master && git pull

If service apache2 start fail, you should check the path to cert files and the following recommended apache config

https://community.letsencrypt.org/t/recommended-apache-config/58294

nano /etc/apache2/mods-enabled/ssl.conf

    #   Default certificate file
    SSLCertificateFile /path/to/cert/file/cert.pem
    SSLCertificateKeyFile /path/to/cert/file/cert.key

service apache2 restart

Because i installed also postfix and dovecot so i must re-check paths to the cert files (cert.pem, cert.key, ca-certification.crt) again on the following config files

/etc/dovecot/conf.d/10-ssl.conf

/etc/postfix/master.cf

/etc/postfix/main.cf

After that everything work fine 

!!!!! Attention

==========================

I got cert with the official url (https://acme-v02.api.letsencrypt.org/directory) and it working without error

The ACME URL for our ACME v2 staging environment is

https://acme-staging-v02.api.letsencrypt.org/directory

if you use this acme url for testing you will get the error message in mail client , show that the cert is not trust. After testing you can edit this url to official url in /path/to/folder/cfhookbash/config

CA="https://acme-v02.api.letsencrypt.org/directory"

then re-run

dehydrated -c -t dns-01 -k '/path/to/folder/cfhookbash/hook.sh'

==========================

I hope this instruction may help someone else