3 ms·
> The easiest way is just having the sudo ability to temporarily open port 80 for the challenge/response process. The easiest way is to forget about HTTP and u
by zAy0LfpBZLC8mAC 8y ago
> The easiest way is just having the sudo ability to temporarily open port 80 for the challenge/response process.
The easiest way is to forget about HTTP and use DNS verification. Just create a dynamically updateable TXT record in your zone that the LE client can update and then point CNAMEs for the names that you want to create certificates for to that TXT record.
- walrus01 8y agoI am too paranoid and untrusting to give the LE automated tool the ability to edit DNS zonefiles. My DNS setup is quite far removed logically from the mail server setup, intentionally.
- zAy0LfpBZLC8mAC 8y agoYou don't need to "edit zonefiles", and whether it's "logically removed" is kinda irrelevant? You simply set up a dynamically updateable zone and then have the LE client call nsupdate, it couldn't be any easier, you don't even need sudo. You could also delegate DNS for your MX to the MX itself, of course, then you'd have pretty much the same setup as with the HTTP server on the MX, just using a DNS server instead. But that's just too complicated, really, using dynamic DNS is flexible and allows you to easily add other services that need certificates on any machine whatsoever with no need to have an HTTP (or any other) server running on the machine reachable from the outside.