diff --git a/certbot-dns-ovh/Dockerfile b/certbot-dns-ovh/Dockerfile
new file mode 100644
index 000000000..e8da96d95
--- /dev/null
+++ b/certbot-dns-ovh/Dockerfile
@@ -0,0 +1,5 @@
+FROM certbot/certbot
+
+COPY . src/certbot-dns-ovh
+
+RUN pip install --no-cache-dir --editable src/certbot-dns-ovh
diff --git a/certbot-dns-ovh/LICENSE.txt b/certbot-dns-ovh/LICENSE.txt
new file mode 100644
index 000000000..981c46c9f
--- /dev/null
+++ b/certbot-dns-ovh/LICENSE.txt
@@ -0,0 +1,190 @@
+   Copyright 2015 Electronic Frontier Foundation and others
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
diff --git a/certbot-dns-ovh/MANIFEST.in b/certbot-dns-ovh/MANIFEST.in
new file mode 100644
index 000000000..18f018c08
--- /dev/null
+++ b/certbot-dns-ovh/MANIFEST.in
@@ -0,0 +1,3 @@
+include LICENSE.txt
+include README.rst
+recursive-include docs *
diff --git a/certbot-dns-ovh/README.rst b/certbot-dns-ovh/README.rst
new file mode 100644
index 000000000..05ffe2a16
--- /dev/null
+++ b/certbot-dns-ovh/README.rst
@@ -0,0 +1 @@
+OVH DNS Authenticator plugin for Certbot
diff --git a/certbot-dns-ovh/certbot_dns_ovh/__init__.py b/certbot-dns-ovh/certbot_dns_ovh/__init__.py
new file mode 100644
index 000000000..47f8bda9f
--- /dev/null
+++ b/certbot-dns-ovh/certbot_dns_ovh/__init__.py
@@ -0,0 +1,98 @@
+"""
+The `~certbot_dns_ovh.dns_ovh` plugin automates the process of
+completing a ``dns-01`` challenge (`~acme.challenges.DNS01`) by creating, and
+subsequently removing, TXT records using the OVH API.
+
+
+Named Arguments
+---------------
+
+===================================  ==========================================
+``--dns-ovh-credentials``            OVH credentials_ INI file.
+                                     (Required)
+``--dns-ovh-propagation-seconds``    The number of seconds to wait for DNS
+                                     to propagate before asking the ACME
+                                     server to verify the DNS record.
+                                     (Default: 30)
+===================================  ==========================================
+
+
+Credentials
+-----------
+
+Use of this plugin requires a configuration file containing OVH API
+credentials for an account with the following access rules:
+
+* ``GET /domain/zone/*``
+* ``PUT /domain/zone/*``
+* ``POST /domain/zone/*``
+* ``DELETE /domain/zone/*``
+
+These credentials can be obtained there:
+
+* `OVH Europe <https://eu.api.ovh.com/createToken/>`_ (endpoint: ``ovh-eu``)
+* `OVH North America <https://ca.api.ovh.com/createToken/>`_ (endpoint:
+  ``ovh-ca``)
+
+.. code-block:: ini
+   :name: credentials.ini
+   :caption: Example credentials file:
+
+   # OVH API credentials used by Certbot
+   dns_ovh_endpoint = ovh-eu
+   dns_ovh_application_key = MDAwMDAwMDAwMDAw
+   dns_ovh_application_secret = MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAw
+   dns_ovh_consumer_key = MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAw
+
+The path to this file can be provided interactively or using the
+``--dns-ovh-credentials`` command-line argument. Certbot records the path
+to this file for use during renewal, but does not store the file's contents.
+
+.. caution::
+   You should protect these API credentials as you would the password to your
+   OVH account. Users who can read this file can use these credentials
+   to issue arbitrary API calls on your behalf. Users who can cause Certbot to
+   run using these credentials can complete a ``dns-01`` challenge to acquire
+   new certificates or revoke existing certificates for associated domains,
+   even if those domains aren't being managed by this server.
+
+Certbot will emit a warning if it detects that the credentials file can be
+accessed by other users on your system. The warning reads "Unsafe permissions
+on credentials configuration file", followed by the path to the credentials
+file. This warning will be emitted each time Certbot uses the credentials file,
+including for renewal, and cannot be silenced except by addressing the issue
+(e.g., by using a command like ``chmod 600`` to restrict access to the file).
+
+
+Examples
+--------
+
+.. code-block:: bash
+   :caption: To acquire a certificate for ``example.com``
+
+   certbot certonly \\
+     --dns-ovh \\
+     --dns-ovh-credentials ~/.secrets/certbot/ohv.ini \\
+     -d example.com
+
+.. code-block:: bash
+   :caption: To acquire a single certificate for both ``example.com`` and
+             ``www.example.com``
+
+   certbot certonly \\
+     --dns-ovh \\
+     --dns-ovh-credentials ~/.secrets/certbot/ovh.ini \\
+     -d example.com \\
+     -d www.example.com
+
+.. code-block:: bash
+   :caption: To acquire a certificate for ``example.com``, waiting 60 seconds
+             for DNS propagation
+
+   certbot certonly \\
+     --dns-ovh \\
+     --dns-ovh-credentials ~/.secrets/certbot/ovh.ini \\
+     --dns-ovh-propagation-seconds 60 \\
+     -d example.com
+
+"""
diff --git a/certbot-dns-ovh/certbot_dns_ovh/dns_ovh.py b/certbot-dns-ovh/certbot_dns_ovh/dns_ovh.py
new file mode 100644
index 000000000..c4ded7748
--- /dev/null
+++ b/certbot-dns-ovh/certbot_dns_ovh/dns_ovh.py
@@ -0,0 +1,102 @@
+"""DNS Authenticator for OVH DNS."""
+import logging
+
+import zope.interface
+from lexicon.providers import ovh
+
+from certbot import errors
+from certbot import interfaces
+from certbot.plugins import dns_common
+from certbot.plugins import dns_common_lexicon
+
+logger = logging.getLogger(__name__)
+
+TOKEN_URL = 'https://eu.api.ovh.com/createToken/ or https://ca.api.ovh.com/createToken/'
+
+
+@zope.interface.implementer(interfaces.IAuthenticator)
+@zope.interface.provider(interfaces.IPluginFactory)
+class Authenticator(dns_common.DNSAuthenticator):
+    """DNS Authenticator for OVH
+
+    This Authenticator uses the OVH API to fulfill a dns-01 challenge.
+    """
+
+    description = 'Obtain certificates using a DNS TXT record (if you are using OVH for DNS).'
+    ttl = 60
+
+    def __init__(self, *args, **kwargs):
+        super(Authenticator, self).__init__(*args, **kwargs)
+        self.credentials = None
+
+    @classmethod
+    def add_parser_arguments(cls, add):  # pylint: disable=arguments-differ
+        super(Authenticator, cls).add_parser_arguments(add, default_propagation_seconds=30)
+        add('credentials', help='OVH credentials INI file.')
+
+    def more_info(self):  # pylint: disable=missing-docstring,no-self-use
+        return 'This plugin configures a DNS TXT record to respond to a dns-01 challenge using ' + \
+               'the OVH API.'
+
+    def _setup_credentials(self):
+        self.credentials = self._configure_credentials(
+            'credentials',
+            'OVH credentials INI file',
+            {
+                'endpoint': 'OVH API endpoint (ovh-eu or ovh-ca)',
+                'application-key': 'Application key for OVH API, obtained from {0}'
+                .format(TOKEN_URL),
+                'application-secret': 'Application secret for OVH API, obtained from {0}'
+                .format(TOKEN_URL),
+                'consumer-key': 'Consumer key for OVH API, obtained from {0}'
+                .format(TOKEN_URL),
+            }
+        )
+
+    def _perform(self, domain, validation_name, validation):
+        self._get_ovh_client().add_txt_record(domain, validation_name, validation)
+
+    def _cleanup(self, domain, validation_name, validation):
+        self._get_ovh_client().del_txt_record(domain, validation_name, validation)
+
+    def _get_ovh_client(self):
+        return _OVHLexiconClient(
+            self.credentials.conf('endpoint'),
+            self.credentials.conf('application-key'),
+            self.credentials.conf('application-secret'),
+            self.credentials.conf('consumer-key'),
+            self.ttl
+        )
+
+
+class _OVHLexiconClient(dns_common_lexicon.LexiconClient):
+    """
+    Encapsulates all communication with the OVH API via Lexicon.
+    """
+
+    def __init__(self, endpoint, application_key, application_secret, consumer_key, ttl):
+        super(_OVHLexiconClient, self).__init__()
+
+        self.provider = ovh.Provider({
+            'auth_entrypoint': endpoint,
+            'auth_application_key': application_key,
+            'auth_application_secret': application_secret,
+            'auth_consumer_key': consumer_key,
+            'ttl': ttl,
+        })
+
+    def _handle_http_error(self, e, domain_name):
+        hint = None
+        if str(e).startswith('400 Client Error:'):
+            hint = 'Is your Application Secret value correct?'
+        if str(e).startswith('403 Client Error:'):
+            hint = 'Are your Application Key and Consumer Key values correct?'
+
+        return errors.PluginError('Error determining zone identifier for {0}: {1}.{2}'
+                                  .format(domain_name, e, ' ({0})'.format(hint) if hint else ''))
+
+    def _handle_general_error(self, e, domain_name):
+        if domain_name in str(e) and str(e).endswith('not found'):
+            return
+
+        super(_OVHLexiconClient, self)._handle_general_error(e, domain_name)
diff --git a/certbot-dns-ovh/certbot_dns_ovh/dns_ovh_test.py b/certbot-dns-ovh/certbot_dns_ovh/dns_ovh_test.py
new file mode 100644
index 000000000..f2a10485d
--- /dev/null
+++ b/certbot-dns-ovh/certbot_dns_ovh/dns_ovh_test.py
@@ -0,0 +1,62 @@
+"""Tests for certbot_dns_ovh.dns_ovh."""
+
+import os
+import unittest
+
+import mock
+from requests.exceptions import HTTPError
+
+from certbot.plugins import dns_test_common
+from certbot.plugins import dns_test_common_lexicon
+from certbot.tests import util as test_util
+
+ENDPOINT = 'ovh-eu'
+APPLICATION_KEY = 'foo'
+APPLICATION_SECRET = 'bar'
+CONSUMER_KEY = 'spam'
+
+
+class AuthenticatorTest(test_util.TempDirTestCase,
+                        dns_test_common_lexicon.BaseLexiconAuthenticatorTest):
+
+    def setUp(self):
+        super(AuthenticatorTest, self).setUp()
+
+        from certbot_dns_ovh.dns_ovh import Authenticator
+
+        path = os.path.join(self.tempdir, 'file.ini')
+        credentials = {
+            "ovh_endpoint": ENDPOINT,
+            "ovh_application_key": APPLICATION_KEY,
+            "ovh_application_secret": APPLICATION_SECRET,
+            "ovh_consumer_key": CONSUMER_KEY,
+        }
+        dns_test_common.write(credentials, path)
+
+        self.config = mock.MagicMock(ovh_credentials=path,
+                                     ovh_propagation_seconds=0)  # don't wait during tests
+
+        self.auth = Authenticator(self.config, "ovh")
+
+        self.mock_client = mock.MagicMock()
+        # _get_ovh_client | pylint: disable=protected-access
+        self.auth._get_ovh_client = mock.MagicMock(return_value=self.mock_client)
+
+
+class OVHLexiconClientTest(unittest.TestCase, dns_test_common_lexicon.BaseLexiconClientTest):
+    DOMAIN_NOT_FOUND = Exception('Domain example.com not found')
+    LOGIN_ERROR = HTTPError('403 Client Error: Forbidden for url: https://eu.api.ovh.com/1.0/...')
+
+    def setUp(self):
+        from certbot_dns_ovh.dns_ovh import _OVHLexiconClient
+
+        self.client = _OVHLexiconClient(
+            ENDPOINT, APPLICATION_KEY, APPLICATION_SECRET, CONSUMER_KEY, 0
+        )
+
+        self.provider_mock = mock.MagicMock()
+        self.client.provider = self.provider_mock
+
+
+if __name__ == "__main__":
+    unittest.main()  # pragma: no cover
diff --git a/certbot-dns-ovh/docs/.gitignore b/certbot-dns-ovh/docs/.gitignore
new file mode 100644
index 000000000..ba65b13af
--- /dev/null
+++ b/certbot-dns-ovh/docs/.gitignore
@@ -0,0 +1 @@
+/_build/
diff --git a/certbot-dns-ovh/docs/Makefile b/certbot-dns-ovh/docs/Makefile
new file mode 100644
index 000000000..38f6a9159
--- /dev/null
+++ b/certbot-dns-ovh/docs/Makefile
@@ -0,0 +1,20 @@
+# Minimal makefile for Sphinx documentation
+#
+
+# You can set these variables from the command line.
+SPHINXOPTS    =
+SPHINXBUILD   = sphinx-build
+SPHINXPROJ    = certbot-dns-ovh
+SOURCEDIR     = .
+BUILDDIR      = _build
+
+# Put it first so that "make" without argument is like "make help".
+help:
+	@$(SPHINXBUILD) -M help "$(SOURCEDIR)" "$(BUILDDIR)" $(SPHINXOPTS) $(O)
+
+.PHONY: help Makefile
+
+# Catch-all target: route all unknown targets to Sphinx using the new
+# "make mode" option.  $(O) is meant as a shortcut for $(SPHINXOPTS).
+%: Makefile
+	@$(SPHINXBUILD) -M $@ "$(SOURCEDIR)" "$(BUILDDIR)" $(SPHINXOPTS) $(O)
\ No newline at end of file
diff --git a/certbot-dns-ovh/docs/api.rst b/certbot-dns-ovh/docs/api.rst
new file mode 100644
index 000000000..8668ec5d8
--- /dev/null
+++ b/certbot-dns-ovh/docs/api.rst
@@ -0,0 +1,8 @@
+=================
+API Documentation
+=================
+
+.. toctree::
+   :glob:
+
+   api/**
diff --git a/certbot-dns-ovh/docs/api/dns_ovh.rst b/certbot-dns-ovh/docs/api/dns_ovh.rst
new file mode 100644
index 000000000..79863d05f
--- /dev/null
+++ b/certbot-dns-ovh/docs/api/dns_ovh.rst
@@ -0,0 +1,5 @@
+:mod:`certbot_dns_ovh.dns_ovh`
+------------------------------
+
+.. automodule:: certbot_dns_ovh.dns_ovh
+   :members:
diff --git a/certbot-dns-ovh/docs/conf.py b/certbot-dns-ovh/docs/conf.py
new file mode 100644
index 000000000..57194666e
--- /dev/null
+++ b/certbot-dns-ovh/docs/conf.py
@@ -0,0 +1,180 @@
+# -*- coding: utf-8 -*-
+#
+# certbot-dns-ovh documentation build configuration file, created by
+# sphinx-quickstart on Fri Jan 12 10:14:31 2018.
+#
+# This file is execfile()d with the current directory set to its
+# containing dir.
+#
+# Note that not all possible configuration values are present in this
+# autogenerated file.
+#
+# All configuration values have a default; values that are commented out
+# serve to show the default.
+
+# If extensions (or modules to document with autodoc) are in another directory,
+# add these directories to sys.path here. If the directory is relative to the
+# documentation root, use os.path.abspath to make it absolute, like shown here.
+#
+import os
+# import sys
+# sys.path.insert(0, os.path.abspath('.'))
+
+
+# -- General configuration ------------------------------------------------
+
+# If your documentation needs a minimal Sphinx version, state it here.
+#
+needs_sphinx = '1.0'
+
+# Add any Sphinx extension module names here, as strings. They can be
+# extensions coming with Sphinx (named 'sphinx.ext.*') or your custom
+# ones.
+extensions = ['sphinx.ext.autodoc',
+    'sphinx.ext.intersphinx',
+    'sphinx.ext.todo',
+    'sphinx.ext.coverage',
+    'sphinx.ext.viewcode']
+
+autodoc_member_order = 'bysource'
+autodoc_default_flags = ['show-inheritance', 'private-members']
+
+# Add any paths that contain templates here, relative to this directory.
+templates_path = ['_templates']
+
+# The suffix(es) of source filenames.
+# You can specify multiple suffix as a list of string:
+#
+# source_suffix = ['.rst', '.md']
+source_suffix = '.rst'
+
+# The master toctree document.
+master_doc = 'index'
+
+# General information about the project.
+project = u'certbot-dns-ovh'
+copyright = u'2018, Certbot Project'
+author = u'Certbot Project'
+
+# The version info for the project you're documenting, acts as replacement for
+# |version| and |release|, also used in various other places throughout the
+# built documents.
+#
+# The short X.Y version.
+version = u'0'
+# The full version, including alpha/beta/rc tags.
+release = u'0'
+
+# The language for content autogenerated by Sphinx. Refer to documentation
+# for a list of supported languages.
+#
+# This is also used if you do content translation via gettext catalogs.
+# Usually you set "language" from the command line for these cases.
+language = 'en'
+
+# List of patterns, relative to source directory, that match files and
+# directories to ignore when looking for source files.
+# This patterns also effect to html_static_path and html_extra_path
+exclude_patterns = ['_build', 'Thumbs.db', '.DS_Store']
+
+default_role = 'py:obj'
+
+# The name of the Pygments (syntax highlighting) style to use.
+pygments_style = 'sphinx'
+
+# If true, `todo` and `todoList` produce output, else they produce nothing.
+todo_include_todos = True
+
+
+# -- Options for HTML output ----------------------------------------------
+
+# The theme to use for HTML and HTML Help pages.  See the documentation for
+# a list of builtin themes.
+#
+
+# http://docs.readthedocs.org/en/latest/theme.html#how-do-i-use-this-locally-and-on-read-the-docs
+# on_rtd is whether we are on readthedocs.org
+on_rtd = os.environ.get('READTHEDOCS', None) == 'True'
+if not on_rtd:  # only import and set the theme if we're building docs locally
+    import sphinx_rtd_theme
+    html_theme = 'sphinx_rtd_theme'
+    html_theme_path = [sphinx_rtd_theme.get_html_theme_path()]
+# otherwise, readthedocs.org uses their theme by default, so no need to specify it
+
+# Theme options are theme-specific and customize the look and feel of a theme
+# further.  For a list of options available for each theme, see the
+# documentation.
+#
+# html_theme_options = {}
+
+# Add any paths that contain custom static files (such as style sheets) here,
+# relative to this directory. They are copied after the builtin static files,
+# so a file named "default.css" will overwrite the builtin "default.css".
+html_static_path = ['_static']
+
+
+# -- Options for HTMLHelp output ------------------------------------------
+
+# Output file base name for HTML help builder.
+htmlhelp_basename = 'certbot-dns-ovhdoc'
+
+
+# -- Options for LaTeX output ---------------------------------------------
+
+latex_elements = {
+    # The paper size ('letterpaper' or 'a4paper').
+    #
+    # 'papersize': 'letterpaper',
+
+    # The font size ('10pt', '11pt' or '12pt').
+    #
+    # 'pointsize': '10pt',
+
+    # Additional stuff for the LaTeX preamble.
+    #
+    # 'preamble': '',
+
+    # Latex figure (float) alignment
+    #
+    # 'figure_align': 'htbp',
+}
+
+# Grouping the document tree into LaTeX files. List of tuples
+# (source start file, target name, title,
+#  author, documentclass [howto, manual, or own class]).
+latex_documents = [
+    (master_doc, 'certbot-dns-ovh.tex', u'certbot-dns-ovh Documentation',
+     u'Certbot Project', 'manual'),
+]
+
+
+# -- Options for manual page output ---------------------------------------
+
+# One entry per manual page. List of tuples
+# (source start file, name, description, authors, manual section).
+man_pages = [
+    (master_doc, 'certbot-dns-ovh', u'certbot-dns-ovh Documentation',
+     [author], 1)
+]
+
+
+# -- Options for Texinfo output -------------------------------------------
+
+# Grouping the document tree into Texinfo files. List of tuples
+# (source start file, target name, title, author,
+#  dir menu entry, description, category)
+texinfo_documents = [
+    (master_doc, 'certbot-dns-ovh', u'certbot-dns-ovh Documentation',
+     author, 'certbot-dns-ovh', 'One line description of project.',
+     'Miscellaneous'),
+]
+
+
+
+
+# Example configuration for intersphinx: refer to the Python standard library.
+intersphinx_mapping = {
+    'python': ('https://docs.python.org/', None),
+    'acme': ('https://acme-python.readthedocs.org/en/latest/', None),
+    'certbot': ('https://certbot.eff.org/docs/', None),
+}
diff --git a/certbot-dns-ovh/docs/index.rst b/certbot-dns-ovh/docs/index.rst
new file mode 100644
index 000000000..ad5860289
--- /dev/null
+++ b/certbot-dns-ovh/docs/index.rst
@@ -0,0 +1,28 @@
+.. certbot-dns-ovh documentation master file, created by
+   sphinx-quickstart on Fri Jan 12 10:14:31 2018.
+   You can adapt this file completely to your liking, but it should at least
+   contain the root `toctree` directive.
+
+Welcome to certbot-dns-ovh's documentation!
+===========================================
+
+.. toctree::
+   :maxdepth: 2
+   :caption: Contents:
+
+.. automodule:: certbot_dns_ovh
+   :members:
+
+.. toctree::
+   :maxdepth: 1
+
+   api
+
+
+
+Indices and tables
+==================
+
+* :ref:`genindex`
+* :ref:`modindex`
+* :ref:`search`
diff --git a/certbot-dns-ovh/docs/make.bat b/certbot-dns-ovh/docs/make.bat
new file mode 100644
index 000000000..78f7dd669
--- /dev/null
+++ b/certbot-dns-ovh/docs/make.bat
@@ -0,0 +1,36 @@
+@ECHO OFF
+
+pushd %~dp0
+
+REM Command file for Sphinx documentation
+
+if "%SPHINXBUILD%" == "" (
+	set SPHINXBUILD=sphinx-build
+)
+set SOURCEDIR=.
+set BUILDDIR=_build
+set SPHINXPROJ=certbot-dns-ovh
+
+if "%1" == "" goto help
+
+%SPHINXBUILD% >NUL 2>NUL
+if errorlevel 9009 (
+	echo.
+	echo.The 'sphinx-build' command was not found. Make sure you have Sphinx
+	echo.installed, then set the SPHINXBUILD environment variable to point
+	echo.to the full path of the 'sphinx-build' executable. Alternatively you
+	echo.may add the Sphinx directory to PATH.
+	echo.
+	echo.If you don't have Sphinx installed, grab it from
+	echo.http://sphinx-doc.org/
+	exit /b 1
+)
+
+%SPHINXBUILD% -M %1 %SOURCEDIR% %BUILDDIR% %SPHINXOPTS%
+goto end
+
+:help
+%SPHINXBUILD% -M help %SOURCEDIR% %BUILDDIR% %SPHINXOPTS%
+
+:end
+popd
diff --git a/certbot-dns-ovh/local-oldest-requirements.txt b/certbot-dns-ovh/local-oldest-requirements.txt
new file mode 100644
index 000000000..8368d266e
--- /dev/null
+++ b/certbot-dns-ovh/local-oldest-requirements.txt
@@ -0,0 +1,2 @@
+acme[dev]==0.21.1
+certbot[dev]==0.21.1
diff --git a/certbot-dns-ovh/readthedocs.org.requirements.txt b/certbot-dns-ovh/readthedocs.org.requirements.txt
new file mode 100644
index 000000000..0780e12a1
--- /dev/null
+++ b/certbot-dns-ovh/readthedocs.org.requirements.txt
@@ -0,0 +1,12 @@
+# readthedocs.org gives no way to change the install command to "pip
+# install -e .[docs]" (that would in turn install documentation
+# dependencies), but it allows to specify a requirements.txt file at
+# https://readthedocs.org/dashboard/letsencrypt/advanced/ (c.f. #259)
+
+# Although ReadTheDocs certainly doesn't need to install the project
+# in --editable mode (-e), just "pip install .[docs]" does not work as
+# expected and "pip install -e .[docs]" must be used instead
+
+-e acme
+-e .
+-e certbot-dns-ovh[docs]
diff --git a/certbot-dns-ovh/setup.cfg b/certbot-dns-ovh/setup.cfg
new file mode 100644
index 000000000..2a9acf13d
--- /dev/null
+++ b/certbot-dns-ovh/setup.cfg
@@ -0,0 +1,2 @@
+[bdist_wheel]
+universal = 1
diff --git a/certbot-dns-ovh/setup.py b/certbot-dns-ovh/setup.py
new file mode 100644
index 000000000..4e2e664a4
--- /dev/null
+++ b/certbot-dns-ovh/setup.py
@@ -0,0 +1,69 @@
+import sys
+
+from setuptools import setup
+from setuptools import find_packages
+
+
+version = '0.25.0.dev0'
+
+# Remember to update local-oldest-requirements.txt when changing the minimum
+# acme/certbot version.
+install_requires = [
+    'acme>=0.21.1',
+    'certbot>=0.21.1',
+    'dns-lexicon>=2.2.1', # Support for >1 TXT record per name
+    'mock',
+    # For pkg_resources. >=1.0 so pip resolves it to a version cryptography
+    # will tolerate; see #2599:
+    'setuptools>=1.0',
+    'zope.interface',
+]
+
+docs_extras = [
+    'Sphinx>=1.0',  # autodoc_member_order = 'bysource', autodoc_default_flags
+    'sphinx_rtd_theme',
+]
+
+setup(
+    name='certbot-dns-ovh',
+    version=version,
+    description="OVH DNS Authenticator plugin for Certbot",
+    url='https://github.com/certbot/certbot',
+    author="Certbot Project",
+    author_email='client-dev@letsencrypt.org',
+    license='Apache License 2.0',
+    python_requires='>=2.7, !=3.0.*, !=3.1.*, !=3.2.*, !=3.3.*',
+    classifiers=[
+        'Development Status :: 3 - Alpha',
+        'Environment :: Plugins',
+        'Intended Audience :: System Administrators',
+        'License :: OSI Approved :: Apache Software License',
+        'Operating System :: POSIX :: Linux',
+        'Programming Language :: Python',
+        'Programming Language :: Python :: 2',
+        'Programming Language :: Python :: 2.7',
+        'Programming Language :: Python :: 3',
+        'Programming Language :: Python :: 3.4',
+        'Programming Language :: Python :: 3.5',
+        'Programming Language :: Python :: 3.6',
+        'Topic :: Internet :: WWW/HTTP',
+        'Topic :: Security',
+        'Topic :: System :: Installation/Setup',
+        'Topic :: System :: Networking',
+        'Topic :: System :: Systems Administration',
+        'Topic :: Utilities',
+    ],
+
+    packages=find_packages(),
+    include_package_data=True,
+    install_requires=install_requires,
+    extras_require={
+        'docs': docs_extras,
+    },
+    entry_points={
+        'certbot.plugins': [
+            'dns-ovh = certbot_dns_ovh.dns_ovh:Authenticator',
+        ],
+    },
+    test_suite='certbot_dns_ovh',
+)
diff --git a/certbot/cli.py b/certbot/cli.py
index 6d262ed72..2c4aa6530 100644
--- a/certbot/cli.py
+++ b/certbot/cli.py
@@ -1435,6 +1435,10 @@ def _plugins_parsing(helpful, plugins):
                 default=flag_default("dns_nsone"),
                 help=("Obtain certificates using a DNS TXT record (if you are "
                       "using NS1 for DNS)."))
+    helpful.add(["plugins", "certonly"], "--dns-ovh", action="store_true",
+                default=flag_default("dns_ovh"),
+                help=("Obtain certificates using a DNS TXT record (if you are "
+                      "using OVH for DNS)."))
     helpful.add(["plugins", "certonly"], "--dns-rfc2136", action="store_true",
                 default=flag_default("dns_rfc2136"),
                 help="Obtain certificates using a DNS TXT record (if you are using BIND for DNS).")
diff --git a/certbot/constants.py b/certbot/constants.py
index 70249b89b..46523ce4d 100644
--- a/certbot/constants.py
+++ b/certbot/constants.py
@@ -109,6 +109,7 @@ CLI_DEFAULTS = dict(
     dns_linode=False,
     dns_luadns=False,
     dns_nsone=False,
+    dns_ovh=False,
     dns_rfc2136=False,
     dns_route53=False,
     dns_sakuracloud=False
diff --git a/certbot/plugins/disco.py b/certbot/plugins/disco.py
index 6ed0cf7b7..7be320efc 100644
--- a/certbot/plugins/disco.py
+++ b/certbot/plugins/disco.py
@@ -35,6 +35,7 @@ class PluginEntryPoint(object):
         "certbot-dns-linode",
         "certbot-dns-luadns",
         "certbot-dns-nsone",
+        "certbot-dns-ovh",
         "certbot-dns-rfc2136",
         "certbot-dns-route53",
         "certbot-dns-sakuracloud",
diff --git a/certbot/plugins/selection.py b/certbot/plugins/selection.py
index 0073c99fe..9c2138247 100644
--- a/certbot/plugins/selection.py
+++ b/certbot/plugins/selection.py
@@ -165,8 +165,8 @@ def choose_plugin(prepared, question):
 
 noninstaller_plugins = ["webroot", "manual", "standalone", "dns-cloudflare", "dns-cloudxns",
                         "dns-digitalocean", "dns-dnsimple", "dns-dnsmadeeasy", "dns-gehirn",
-                        "dns-google", "dns-linode", "dns-luadns", "dns-nsone", "dns-rfc2136",
-                        "dns-route53", "dns-sakuracloud"]
+                        "dns-google", "dns-linode", "dns-luadns", "dns-nsone", "dns-ovh",
+                        "dns-rfc2136", "dns-route53", "dns-sakuracloud"]
 
 def record_chosen_plugins(config, plugins, auth, inst):
     "Update the config entries to reflect the plugins we actually selected."
@@ -299,6 +299,8 @@ def cli_plugin_requests(config):  # pylint: disable=too-many-branches
         req_auth = set_configurator(req_auth, "dns-luadns")
     if config.dns_nsone:
         req_auth = set_configurator(req_auth, "dns-nsone")
+    if config.dns_ovh:
+        req_auth = set_configurator(req_auth, "dns-ovh")
     if config.dns_rfc2136:
         req_auth = set_configurator(req_auth, "dns-rfc2136")
     if config.dns_route53:
diff --git a/docs/cli-help.txt b/docs/cli-help.txt
index 7b8b522c9..8bba718d5 100644
--- a/docs/cli-help.txt
+++ b/docs/cli-help.txt
@@ -454,6 +454,8 @@ plugins:
                         using LuaDNS for DNS). (default: False)
   --dns-nsone           Obtain certificates using a DNS TXT record (if you are
                         using NS1 for DNS). (default: False)
+  --dns-ovh             Obtain certificates using a DNS TXT record (if you are
+                        using OVH for DNS). (default: False)
   --dns-rfc2136         Obtain certificates using a DNS TXT record (if you are
                         using BIND for DNS). (default: False)
   --dns-route53         Obtain certificates using a DNS TXT record (if you are
@@ -589,6 +591,16 @@ dns-nsone:
   --dns-nsone-credentials DNS_NSONE_CREDENTIALS
                         NS1 credentials file. (default: None)
 
+dns-ovh:
+  Obtain certificates using a DNS TXT record (if you are using OVH for DNS).
+
+  --dns-ovh-propagation-seconds DNS_OVH_PROPAGATION_SECONDS
+                        The number of seconds to wait for DNS to propagate
+                        before asking the ACME server to verify the DNS
+                        record. (default: 30)
+  --dns-ovh-credentials DNS_OVH_CREDENTIALS
+                        OVH credentials file. (default: None)
+
 dns-rfc2136:
   Obtain certificates using a DNS TXT record (if you are using BIND for
   DNS).
diff --git a/docs/packaging.rst b/docs/packaging.rst
index 48ea02ae7..a86b770c5 100644
--- a/docs/packaging.rst
+++ b/docs/packaging.rst
@@ -20,6 +20,7 @@ We release packages and upload them to PyPI (wheels and source tarballs).
 - https://pypi.python.org/pypi/certbot-dns-linode
 - https://pypi.python.org/pypi/certbot-dns-luadns
 - https://pypi.python.org/pypi/certbot-dns-nsone
+- https://pypi.python.org/pypi/certbot-dns-ovh
 - https://pypi.python.org/pypi/certbot-dns-rfc2136
 - https://pypi.python.org/pypi/certbot-dns-route53
 
@@ -67,6 +68,7 @@ From our official releases:
 - https://www.archlinux.org/packages/community/any/certbot-dns-linode
 - https://www.archlinux.org/packages/community/any/certbot-dns-luadns
 - https://www.archlinux.org/packages/community/any/certbot-dns-nsone
+- https://www.archlinux.org/packages/community/any/certbot-dns-ovh
 - https://www.archlinux.org/packages/community/any/certbot-dns-rfc2136
 - https://www.archlinux.org/packages/community/any/certbot-dns-route53
 
diff --git a/docs/using.rst b/docs/using.rst
index 50c27d45e..946c12bc6 100644
--- a/docs/using.rst
+++ b/docs/using.rst
@@ -206,6 +206,7 @@ Once installed, you can find documentation on how to use each plugin at:
 * `certbot-dns-linode <https://certbot-dns-linode.readthedocs.io>`_
 * `certbot-dns-luadns <https://certbot-dns-luadns.readthedocs.io>`_
 * `certbot-dns-nsone <https://certbot-dns-nsone.readthedocs.io>`_
+* `certbot-dns-ovh <https://certbot-dns-ovh.readthedocs.io>`_
 * `certbot-dns-rfc2136 <https://certbot-dns-rfc2136.readthedocs.io>`_
 * `certbot-dns-route53 <https://certbot-dns-route53.readthedocs.io>`_
 
diff --git a/tools/release.sh b/tools/release.sh
index 0d42bc22a..880563b4b 100755
--- a/tools/release.sh
+++ b/tools/release.sh
@@ -46,7 +46,7 @@ PORT=${PORT:-1234}
 
 # subpackages to be released (the way developers think about them)
 SUBPKGS_IN_AUTO_NO_CERTBOT="acme certbot-apache certbot-nginx"
-SUBPKGS_NOT_IN_AUTO="certbot-dns-cloudflare certbot-dns-cloudxns certbot-dns-digitalocean certbot-dns-dnsimple certbot-dns-dnsmadeeasy certbot-dns-gehirn certbot-dns-google certbot-dns-linode certbot-dns-luadns certbot-dns-nsone certbot-dns-rfc2136 certbot-dns-route53 certbot-dns-sakuracloud"
+SUBPKGS_NOT_IN_AUTO="certbot-dns-cloudflare certbot-dns-cloudxns certbot-dns-digitalocean certbot-dns-dnsimple certbot-dns-dnsmadeeasy certbot-dns-gehirn certbot-dns-google certbot-dns-linode certbot-dns-luadns certbot-dns-nsone certbot-dns-ovh certbot-dns-rfc2136 certbot-dns-route53 certbot-dns-sakuracloud"
 
 # subpackages to be released (the way the script thinks about them)
 SUBPKGS_IN_AUTO="certbot $SUBPKGS_IN_AUTO_NO_CERTBOT"
diff --git a/tools/venv.sh b/tools/venv.sh
index 159fc16fb..5692f9ebf 100755
--- a/tools/venv.sh
+++ b/tools/venv.sh
@@ -24,6 +24,7 @@ fi
   -e certbot-dns-linode \
   -e certbot-dns-luadns \
   -e certbot-dns-nsone \
+  -e certbot-dns-ovh \
   -e certbot-dns-rfc2136 \
   -e certbot-dns-route53 \
   -e certbot-dns-sakuracloud \
diff --git a/tools/venv3.sh b/tools/venv3.sh
index a1489df22..784fc42e8 100755
--- a/tools/venv3.sh
+++ b/tools/venv3.sh
@@ -23,6 +23,7 @@ fi
   -e certbot-dns-linode \
   -e certbot-dns-luadns \
   -e certbot-dns-nsone \
+  -e certbot-dns-ovh \
   -e certbot-dns-route53 \
   -e certbot-dns-sakuracloud \
   -e certbot-nginx \
diff --git a/tox.cover.sh b/tox.cover.sh
index cccaf6103..c713327c5 100755
--- a/tox.cover.sh
+++ b/tox.cover.sh
@@ -9,7 +9,7 @@
 # -e makes sure we fail fast and don't submit coveralls submit
 
 if [ "xxx$1" = "xxx" ]; then
-  pkgs="certbot acme certbot_apache certbot_dns_cloudflare certbot_dns_cloudxns certbot_dns_digitalocean certbot_dns_dnsimple certbot_dns_dnsmadeeasy certbot_dns_gehirn certbot_dns_google certbot_dns_linode certbot_dns_luadns certbot_dns_nsone certbot_dns_rfc2136 certbot_dns_route53 certbot_dns_sakuracloud certbot_nginx certbot_postfix letshelp_certbot"
+  pkgs="certbot acme certbot_apache certbot_dns_cloudflare certbot_dns_cloudxns certbot_dns_digitalocean certbot_dns_dnsimple certbot_dns_dnsmadeeasy certbot_dns_gehirn certbot_dns_google certbot_dns_linode certbot_dns_luadns certbot_dns_nsone certbot_dns_ovh certbot_dns_rfc2136 certbot_dns_route53 certbot_dns_sakuracloud certbot_nginx certbot_postfix letshelp_certbot"
 else
   pkgs="$@"
 fi
@@ -41,6 +41,8 @@ cover () {
     min=98
   elif [ "$1" = "certbot_dns_nsone" ]; then
     min=99
+  elif [ "$1" = "certbot_dns_ovh" ]; then
+    min=97
   elif [ "$1" = "certbot_dns_rfc2136" ]; then
     min=99
   elif [ "$1" = "certbot_dns_route53" ]; then
diff --git a/tox.ini b/tox.ini
index 32020cf14..482c65c36 100644
--- a/tox.ini
+++ b/tox.ini
@@ -25,6 +25,7 @@ dns_packages =
     certbot-dns-linode \
     certbot-dns-luadns \
     certbot-dns-nsone \
+    certbot-dns-ovh \
     certbot-dns-rfc2136 \
     certbot-dns-route53 \
     certbot-dns-sakuracloud
@@ -53,6 +54,7 @@ source_paths =
     certbot-dns-linode/certbot_dns_linode
     certbot-dns-luadns/certbot_dns_luadns
     certbot-dns-nsone/certbot_dns_nsone
+    certbot-dns-ovh/certbot_dns_ovh
     certbot-dns-rfc2136/certbot_dns_rfc2136
     certbot-dns-route53/certbot_dns_route53
     certbot-dns-sakuracloud/certbot_dns_sakuracloud