2 ms·
It seems that lexicon is handy to use dns-01 instead of DNS aliasing. If you do aliasing, you can serve the DNS challenge from the server you want and that you
by remram 4y ago
It seems that lexicon is handy to use dns-01 instead of DNS aliasing.
If you do aliasing, you can serve the DNS challenge from the server you want and that you fully control. You don't need to interface with your registrar, you just add an NS record once (manually).
You need lexicon if you want to serve the challenge from your registrar instead, and lexicon is the tool that will allow you to talk to many registrars.
- throw0101a 4y ago> It seems that lexicon is handy to use dns-01 instead of DNS aliasing. Say I own example.com, but because it lives on a DNS server that does not have an API, or changes to the company's domain need to go through change control, I cannot easily change it. But I want an ACME/LE cert for foo.example.com, which could be an internal-only service so http-01 is not available. So I can set up a CNAME/alias at _acme-challenge.foo.example.com and point it to (e.g.) foo.example.org. Now I also own example.org, but because it's not the 'main' domain the controls on it are less onerous. So when I request "foo.example.com", it finds the CNAME and heads over to "foo.example.org", where I've update the ACME nonce dynamically. The CNAME setup is a one-time thing, and can go through the 'regular' steps initially, and can then just be left alone. Or, instead of a entire new domain (example.org), I can delegate things to a sub-domain (dnsauth.example.com) as well.
- remram 4y agoAs you can see in your own summary, it doesn't require talking with example.com's provider's awkward API, which was my point. Instead you can subvert that and use a DNS you can easily update or even run DNS temporarily from your ACME client, so implementing many APIs (what lexicon does) is not required.