3 ms·
I think you could always get a cert via the ACME DNS challenge for an IPv6-only/AAAA-only domain. But you could not talk to the ACME/API endpoint from an IPv6-o
by jo909 10y ago
I think you could always get a cert via the ACME DNS challenge for an IPv6-only/AAAA-only domain. But you could not talk to the ACME/API endpoint from an IPv6-only system, so actually requesting and retrieving the cert would have to happen on another, IPv4, system.
(Just as a sidenote: you _never_ need to request and retrieve the cert on the system that the domain name points to. That is just the easiest way and the workflow most clients suggest, since it also makes a lot of sense.)
- voltagex_ 10y agoWould it be possible to set up a somewhat isolated VM that has the sole purpose of requesting certs? I get stuck on needing either the webroot or standalone method of certbot-auto.
- majewsky 10y agoWhat's your specific problem with the webroot method? I'm using it on my systems, and contrary to popular belief, the certbot can easily run as a non-root user when using the webroot method. (My configuration is at https://github.com/majewsky/system-configuration/blob/master/hologram-letsencrypt.pkg.toml https://github.com/majewsky/system-configuration/blob/master... .)