4 ms·

Depends on your domain/dns provider, I use cloudflare so I can add an API key to the config in certbot and the DNS updates are automated then.

• Semaphor 5y ago
  Yeah, it’s the same for gandi.net, plug the API key in and you are done.
  • account42 5y ago
    Great and now your application server has control over your DNS which it otherwise would not need.
    • tialaramex 5y ago
      You can delegate authentication via a permanent DNS record to another DNS hierarchy and give your certificate software authority to change that for ACME purposes. This fixes both the "My API key is allowed to change anything" problem and the "I can't get an API key for the DNS domains I need certificates for" problem, albeit at the cost of needing that one-time setup to tell ACME where to look in DNS. To do this you need a CNAME from the _acme_challenge DNS name you're being challenged on, to a DNS name you're going to use for this purpose. It needn't be in the same domain or indeed even the same TLD but of course it does need to be a public DNS name.
      • remram 5y ago
        Couldn't they just build a DNS responder into the ACME client? That way you can put an NS record delegating _acme_challenge to your application server/web server, so it can reply during validation?
        • tialaramex 5y ago
          Nobody stops you building an ACME client that does this. However I expect it would mostly accumulate confused bug reports from users who don't know their IP address, or don't even have a public IP address, and certainly can't unblock UDP port 53 on their device.
          • remram 5y ago
            certbot already has a "stand-alone" authorization mechanism that has all those drawbacks, so doing a similar thing for DNS might not be too terrible... kro pointed out (in this thread) this plugin that is more or less what I described: https://github.com/pawitp/acme-dns-server https://github.com/pawitp/acme-dns-server