4 ms·
From the FAQ: >"Each of these have different scenarios where their use makes the most sense, for example TLS-ALPN-01 might make sense in cases where HTTPS is n
by bogomipz 5y ago
From the FAQ:
>"Each of these have different scenarios where their use makes the most sense, for example TLS-ALPN-01 might make sense in cases where HTTPS is not used and the requestor does not have access to dynamically update DNS records."
I'm confused by TLS-ALPN-01. I understand the idea of using certs for domain verification but if there is no TLS in use how does the client verify this after the cert has been issued exactly?
- zinekeller 5y agoThis is usually used by TLS terminators, which don't have an HTTP server available (can understand TLS but not HTTP). ALPN here is a property of TLS ClientHello which specifies the capabilities of the client, usually used to signal support for HTTP 2 but in this specific case signals that the TLS client is an ACME verier on behalf of a CA, so the TLS server only sends the validator certificate when the validators specifically requesting it (ensuring interruption-free validation). The important part here is that a TLS server is available but HTTPS is not available as it is either only a TLS terminator or something that operates a non-HTTPS TLS server (for example, RTMPS).
- bogomipz 5y ago>"The important part here is that a TLS server is available but HTTPS is not available as it is either only a TLS terminator or something that operates a non-HTTPS TLS server (for example, RTMPS)." That makes good sense. Thanks for putting it so succinctly. Cheers.