2 ms·
Yes. Or even to the same name server, breaking out each whole label starting with _acme-challenge as its own independent zone, with its own access policies.
by mdhardeman 9y ago
Yes. Or even to the same name server, breaking out each whole label starting with _acme-challenge as its own independent zone, with its own access policies.
- teddyh 9y agoYes, but there’s no need to have separate zones; you can grant update access to subdomains and have the CNAMES point into one zone with a subdomain dedicated to each separate actor which needs access. Like so: Assume that Actor 1 has example.com and example.net. You then add this to the example.com and example.net zones, respectively: _acme_challenge.example.com. CNAME example.com._.actor1._.your-special-domain.com. _acme_challenge.example.net. CNAME example.net._.actor1._.your-special-domain.com. Then you give update access to Actor 1, but not to the whole “your-special-domain.com” zone, but to the “_.actor1._.your-special-domain.com” subdomain. The ACME system would then be configured to send updates to the correct subdomains of that subdomain. Or “your-special-domain.com” could even be a subdomain itself of another domain; it doesn’t matter.