3 ms·

Could you instead set a _acme-challenge.example.com NS record and let the other DNS provider handle only _acme-challenge.example.com that way?

X-Istence 5y ago
Yes. I use hosted zones in Route53 to do this automation and use iam to limit access to that one zone.
dgl 5y ago
I use the NS approach too at the moment, it does feel like the natural way to do it with DNS. One downside is if your cloud provider charges per zone you end up paying for twice as many zones.
- chrismorgan 5y ago
  That’d be no different with the CNAME alias technique, right? I’m not seeing any reason for the CNAME technique; seems like the NS technique should be every bit as good, without needing another domain name (which costs money and is another moving part). I’d like to know if I’m misreading anything.
- throw0101a 5y ago
  You can use sub-domains as well: _acme-challenge.example.com -> _acme-challenge.DNSAUTH.example.com, _acme-challenge.foo.example.com -> _acme-challenge.foo.dnsauth.example.com. You can then have a small VM handle answering DNS queries just for dnsauth.example.com. Folks have written servers to do just this: * https://github.com/joohoi/acme-dns https://github.com/joohoi/acme-dns
tehbeard 5y ago
That.... Might solve an issue we have at work where a client's DNS provider is... Extremely janky, I tried for the CNAME record but it only allows internal ( to that zone) CNAMEs.. didn't look at the NS records..
throw0101a 5y ago
A deep dive on how ACME DNS validation works: * https://www.eff.org/deeplinks/2018/02/technical-deep-dive-securing-automation-acme-dns-challenge-validation https://www.eff.org/deeplinks/2018/02/technical-deep-dive-se... You can have a CNAME _acme-challenge.example.COM point to _acme-challenge.example.ORG or a sub-domain like _acme-challenge.DNSAUTH.example.com. At work we use the sub-domain method and just have a small non-HA VM with some scripts that allow ACME clients to update particular TXT records. Each ACME client is given an individual key and allowed to only update a particular record. Folks have specifically written DNS servers to do just this: * https://github.com/joohoi/acme-dns https://github.com/joohoi/acme-dns However we used BIND with some custom scripting.
kuschku 5y ago
Yes. That's how I handle acme verification for quasseldroid.info, I just have NS records for the acme-challenge subdomain pointing to my own powerdns server.

X-Istence 5y ago

Yes. I use hosted zones in Route53 to do this automation and use iam to limit access to that one zone.

dgl 5y ago

I use the NS approach too at the moment, it does feel like the natural way to do it with DNS. One downside is if your cloud provider charges per zone you end up paying for twice as many zones.

chrismorgan 5y ago
That’d be no different with the CNAME alias technique, right? I’m not seeing any reason for the CNAME technique; seems like the NS technique should be every bit as good, without needing another domain name (which costs money and is another moving part). I’d like to know if I’m misreading anything.
throw0101a 5y ago
You can use sub-domains as well: _acme-challenge.example.com -> _acme-challenge.DNSAUTH.example.com, _acme-challenge.foo.example.com -> _acme-challenge.foo.dnsauth.example.com. You can then have a small VM handle answering DNS queries just for dnsauth.example.com. Folks have written servers to do just this: * https://github.com/joohoi/acme-dns https://github.com/joohoi/acme-dns

tehbeard 5y ago

That.... Might solve an issue we have at work where a client's DNS provider is... Extremely janky, I tried for the CNAME record but it only allows internal ( to that zone) CNAMEs.. didn't look at the NS records..

throw0101a 5y ago

A deep dive on how ACME DNS validation works: * https://www.eff.org/deeplinks/2018/02/technical-deep-dive-securing-automation-acme-dns-challenge-validation https://www.eff.org/deeplinks/2018/02/technical-deep-dive-se... You can have a CNAME _acme-challenge.example.COM point to _acme-challenge.example.ORG or a sub-domain like _acme-challenge.DNSAUTH.example.com. At work we use the sub-domain method and just have a small non-HA VM with some scripts that allow ACME clients to update particular TXT records. Each ACME client is given an individual key and allowed to only update a particular record. Folks have specifically written DNS servers to do just this: * https://github.com/joohoi/acme-dns https://github.com/joohoi/acme-dns However we used BIND with some custom scripting.

kuschku 5y ago

Yes. That's how I handle acme verification for quasseldroid.info, I just have NS records for the acme-challenge subdomain pointing to my own powerdns server.