5 ms·
You don’t need to if you use ACME DNS challenge. I have split horizon where the ACME creates the temporary challenge record, LetsEncrypt sees it, and then the r
by amarshall 5y ago
You don’t need to if you use ACME DNS challenge. I have split horizon where the ACME creates the temporary challenge record, LetsEncrypt sees it, and then the record is removed. There is never a public A record, and the window for enumerating the challenge record is short.
That said, I never really understood worrying about exposing DNS records because someone has to brute-force enumerate the domain names, and because it just obfuscates. I do split horizon for different reasons and am currently moving away from it.
Regardless, if you do care, you should be concerned about certificate transparency logs. The “workaround” for that is wildcard certs.
- hultner 5y agoLE publishes all issued certs so you might as well just keep it public anyway in that case.
- Hamuko 5y agoWildcard certs?
- edoceo 5y agoYep. The CN is something like "*.edoceo.com" And you can make self-signed too.
- amarshall 5y agoYes, I said this. Wildcard certs, as I mention, largely avoid the issue because it’s just one cert for a higher-level domain and largely uninteresting from an information disclosure perspective, at least compared with individual domain certs.