4 ms·

Frustratingly, the problem with automated DNS-based is that it doesn't work with all domain registrars, which is a showstopper when you are not allowed to chang

Frustratingly, the problem with automated DNS-based is that it doesn't work with all domain registrars, which is a showstopper when you are not allowed to change a customer's existing registrar nor move its NS records.

GhettoComputers 5y ago
Its one of those problems blockchain is actually a good solution for but theres no money you can tokenize to sell to others on this idea.
AlbinoDrought 5y ago
One workaround can be picking up a cheap domain and CNAMEing _acme-challenge.unsupported-provider.com to _acme-challenge.supported-provider-cheap-domain.com. The rest of the records can be left alone. This is listed on LetsEncrypt as a "delegate" subdomain [1] and on an EFF article as a "throwaway" domain [2]. Some clients just call it "CNAME support" [3]. All the different names muddle search results. I've used a Reddit guide [4] for Cloudflare + goacme/lego. [1] https://letsencrypt.org/docs/challenge-types/#dns-01-challenge https://letsencrypt.org/docs/challenge-types/#dns-01-challen... [2] https://www.eff.org/deeplinks/2018/02/technical-deep-dive-securing-automation-acme-dns-challenge-validation https://www.eff.org/deeplinks/2018/02/technical-deep-dive-se... [3] https://go-acme.github.io/lego/dns/#experimental-features https://go-acme.github.io/lego/dns/#experimental-features [4] https://old.reddit.com/r/selfhosted/comments/je2041/how_do_you_go_about_getting_lets_encrypt_working/g9ec3z0/ https://old.reddit.com/r/selfhosted/comments/je2041/how_do_y...
ignoramous 5y ago
> automated DNS-based is that it doesn't work with all domain registrars https://acme.sh https://acme.sh automates dns01 challenges with support for over 100+ registrars: https://github.com/acmesh-official/acme.sh/wiki/dnsapi https://github.com/acmesh-official/acme.sh/wiki/dnsapi. Another good thing is that one can move their registrations and change their nameservers, at will.

GhettoComputers 5y ago

Its one of those problems blockchain is actually a good solution for but theres no money you can tokenize to sell to others on this idea.

AlbinoDrought 5y ago

One workaround can be picking up a cheap domain and CNAMEing _acme-challenge.unsupported-provider.com to _acme-challenge.supported-provider-cheap-domain.com. The rest of the records can be left alone. This is listed on LetsEncrypt as a "delegate" subdomain [1] and on an EFF article as a "throwaway" domain [2]. Some clients just call it "CNAME support" [3]. All the different names muddle search results. I've used a Reddit guide [4] for Cloudflare + goacme/lego. [1] https://letsencrypt.org/docs/challenge-types/#dns-01-challenge https://letsencrypt.org/docs/challenge-types/#dns-01-challen... [2] https://www.eff.org/deeplinks/2018/02/technical-deep-dive-securing-automation-acme-dns-challenge-validation https://www.eff.org/deeplinks/2018/02/technical-deep-dive-se... [3] https://go-acme.github.io/lego/dns/#experimental-features https://go-acme.github.io/lego/dns/#experimental-features [4] https://old.reddit.com/r/selfhosted/comments/je2041/how_do_you_go_about_getting_lets_encrypt_working/g9ec3z0/ https://old.reddit.com/r/selfhosted/comments/je2041/how_do_y...

ignoramous 5y ago

> automated DNS-based is that it doesn't work with all domain registrars https://acme.sh https://acme.sh automates dns01 challenges with support for over 100+ registrars: https://github.com/acmesh-official/acme.sh/wiki/dnsapi https://github.com/acmesh-official/acme.sh/wiki/dnsapi. Another good thing is that one can move their registrations and change their nameservers, at will.