3 ms·
Another similar option would presumably be to delegate _acme-challenge.example.com to different nameservers with an NS record, then give your application the re
by BillinghamJ 9y ago
Another similar option would presumably be to delegate _acme-challenge.example.com to different nameservers with an NS record, then give your application the required privileges to control solely that nameserver.
- mdhardeman 9y agoYes. Or even to the same name server, breaking out each whole label starting with _acme-challenge as its own independent zone, with its own access policies.
- teddyh 9y agoYes, but there’s no need to have separate zones; you can grant update access to subdomains and have the CNAMES point into one zone with a subdomain dedicated to each separate actor which needs access. Like so: Assume that Actor 1 has example.com and example.net. You then add this to the example.com and example.net zones, respectively: _acme_challenge.example.com. CNAME example.com._.actor1._.your-special-domain.com. _acme_challenge.example.net. CNAME example.net._.actor1._.your-special-domain.com. Then you give update access to Actor 1, but not to the whole “your-special-domain.com” zone, but to the “_.actor1._.your-special-domain.com” subdomain. The ACME system would then be configured to send updates to the correct subdomains of that subdomain. Or “your-special-domain.com” could even be a subdomain itself of another domain; it doesn’t matter.