4 ms·

This sounds great, although I haven't tried it myself. I have a few domains where I want/need wildcard certs and even though my registrar has API access, it's b

This sounds great, although I haven't tried it myself. I have a few domains where I want/need wildcard certs and even though my registrar has API access, it's basically a god mode token that can do anything my logged in account can. So my only choices are, take the risk and save that API token on my server, or just manually run a script that renews the certs on my own computer every three months. If this works, we can create a new account on the registrar with just the one (not so important) domain, and create an API token for only that account. However, it still doesn't seem like a perfect solution to me. For example, if that API token does get leaked, someone else could still create a certificate for your domain. But I guess that's still a lot better than using your token to transfer the domain to another person. It would be great if registrars provided more fine grained control over the access an API token is granted.

X-Istence 5y ago
Use route 53 and create an iam policy that locks down access to a specific hosted zone.
l33tman 5y ago
Yes you can do all of this on AWS with Route 53, AWS CLI/API and AWS fine-grained policies. You can integrate it with the Lets Encrypt pre/post hooks and setup domain-specific keys for each specific update server.
Havoc 5y ago
>it's basically a god mode token that can do anything my logged in account can. If you add cloudflare you can use their DNS challenge. Most of the tutorials out there reference the global API key, but the more restricted one works too.
- jffry 5y ago
  You can make a Cloudflare API token that allows editing all DNS records for a specific zone, but I don't see a way to make a token that is restricted to updating a specific record. Setting up a subdomain as a separate zone within Cloudflare is only available to Enterprise customers. But yes you could register a separate challenge domain for the trick described in this article, add it to Cloudflare, and then use a token scoped to only that challenge domain, and it'd be a reasonably safe thing to do.

X-Istence 5y ago

Use route 53 and create an iam policy that locks down access to a specific hosted zone.

l33tman 5y ago

Yes you can do all of this on AWS with Route 53, AWS CLI/API and AWS fine-grained policies. You can integrate it with the Lets Encrypt pre/post hooks and setup domain-specific keys for each specific update server.

Havoc 5y ago

>it's basically a god mode token that can do anything my logged in account can. If you add cloudflare you can use their DNS challenge. Most of the tutorials out there reference the global API key, but the more restricted one works too.

jffry 5y ago
You can make a Cloudflare API token that allows editing all DNS records for a specific zone, but I don't see a way to make a token that is restricted to updating a specific record. Setting up a subdomain as a separate zone within Cloudflare is only available to Enterprise customers. But yes you could register a separate challenge domain for the trick described in this article, add it to Cloudflare, and then use a token scoped to only that challenge domain, and it'd be a reasonably safe thing to do.