3 ms·

This actually really annoys me about AWS route53 private hosted zones. It makes perfect sense that a general-purpose ACME service can only query public DNS serv

This actually really annoys me about AWS route53 private hosted zones. It makes perfect sense that a general-purpose ACME service can only query public DNS servers, but it doesn't make nearly as much sense when getting certificates through Amazon Certificate Manager. AWS clearly has the ability to hit private IPs in your VPC; otherwise, basic EC2 healthchecks would not be possible. Yet they require you to create a DNS record in a public hosted zone anyway. This becomes particularly annoying when you're operating in GovCloud because GovCloud doesn't offer public hosted zones at all, so your organization has to maintain a separate commercial account and create a public hosted zone there that acts as a second authoritative name server for your otherwise private domain. Then you run into an additional annoyance when using IaC tooling to provision certificates and DNS records because GovCloud and commercial IAM services are air-gapped from each other, so you can't use an assume role. Instead, whatever user account runs your IaC tool needs to keep separate AWS SDK profiles for GovCloud and Commercial and, assuming you want your IaC to be runnable by multiple users, you have to externally prescribe how these profiles are named. There are so many levels of leaky abstraction here.

agwa 3y ago
Amazon Certificate Manager issues publicly-trusted certificates, so they have to abide by the validation rules mandated by the Baseline Requirements, which do not permit what you desire. CAs have often sought to bypass domain or CAA validation for domains which they believe are hosted with them, and this has repeatedly proven to be a bad idea because it relies on the CA to maintain accurate records about what domains are hosted with them. The source of truth for this information is in the public DNS, so it's more robust to require CAs to check public DNS records. See for example the now-forbidden DNS Operator Exemption to CAA, which I advocated to be banned after Microsoft bypassed CAA checking for domains which they thought they controlled but really didn't: https://groups.google.com/g/mozilla.dev.security.policy/c/0TfT9BziQVc https://groups.google.com/g/mozilla.dev.security.policy/c/0T... If your domains don't otherwise have public DNS records, maybe you should be using private certificates instead of publicly-trusted ones?

agwa 3y ago

Amazon Certificate Manager issues publicly-trusted certificates, so they have to abide by the validation rules mandated by the Baseline Requirements, which do not permit what you desire. CAs have often sought to bypass domain or CAA validation for domains which they believe are hosted with them, and this has repeatedly proven to be a bad idea because it relies on the CA to maintain accurate records about what domains are hosted with them. The source of truth for this information is in the public DNS, so it's more robust to require CAs to check public DNS records. See for example the now-forbidden DNS Operator Exemption to CAA, which I advocated to be banned after Microsoft bypassed CAA checking for domains which they thought they controlled but really didn't: https://groups.google.com/g/mozilla.dev.security.policy/c/0TfT9BziQVc https://groups.google.com/g/mozilla.dev.security.policy/c/0T... If your domains don't otherwise have public DNS records, maybe you should be using private certificates instead of publicly-trusted ones?