3 ms·
Couldn't they just build a DNS responder into the ACME client? That way you can put an NS record delegating _acme_challenge to your application server/web serve
by remram 5y ago
Couldn't they just build a DNS responder into the ACME client? That way you can put an NS record delegating _acme_challenge to your application server/web server, so it can reply during validation?
- tialaramex 5y agoNobody stops you building an ACME client that does this. However I expect it would mostly accumulate confused bug reports from users who don't know their IP address, or don't even have a public IP address, and certainly can't unblock UDP port 53 on their device.
- remram 5y agocertbot already has a "stand-alone" authorization mechanism that has all those drawbacks, so doing a similar thing for DNS might not be too terrible... kro pointed out (in this thread) this plugin that is more or less what I described: https://github.com/pawitp/acme-dns-server https://github.com/pawitp/acme-dns-server