4 ms·

I wish there were an alternative to the DNS-01 challenge for wildcard certs, most common DNS providers APIs are all-or-nothing so you have to leave the keys to

I wish there were an alternative to the DNS-01 challenge for wildcard certs, most common DNS providers APIs are all-or-nothing so you have to leave the keys to the kingdom lying around on whatever machine is acquiring the certs, or use a convoluted workaround like acmeproxy to avoid that exposure.

diarrhea 2y ago
Yeah, the landscape is horrible. I created NS records on example.com to delegate all of home.example.com to a wholly different DNS provider. That provider then manages (all of) that zone, but nothing more (important records such as MX remain on example.com).
yjftsjthsd-h 2y ago
> so you have to leave the keys to the kingdom lying around on whatever machine is acquiring the certs, or use a convoluted workaround like acmeproxy to avoid that exposure. I thought you just created the TXT record once (manually if need be) and it didn't change when the cert is renewed?
- jsheard 2y ago
  Nah, the value of the TXT record has to be changed every time you pull a new certificate. https://letsencrypt.org/docs/challenge-types/ https://letsencrypt.org/docs/challenge-types/ > it only makes sense to use DNS-01 challenges if your DNS provider has an API you can use to automate updates.
synchrone 2y ago
> Let’s Encrypt follows the DNS standards when looking up TXT records for DNS-01 validation, you can use CNAME records or NS records to delegate answering the challenge to other DNS zones. This can be used to delegate the _acme-challenge subdomain to a validation-specific server or zone. It can also be used if your DNS provider is slow to update, and you want to delegate to a quicker-updating server. https://www.eff.org/deeplinks/2018/02/technical-deep-dive-securing-automation-acme-dns-challenge-validation https://www.eff.org/deeplinks/2018/02/technical-deep-dive-se...
extraduder_ire 2y ago
I do wonder if they considered any alternatives to requiring DNS challenges. I'd like to know the reasoning. I have a domain set up where every subdomain not otherwise specified gives a CNAME to one of the subdomains. (gandi lets me do it, don't know if it's standard) Certbot could easily serve the response to any challenge issued to <random number>.example.com as many times as it takes to be sure.

diarrhea 2y ago

Yeah, the landscape is horrible. I created NS records on example.com to delegate all of home.example.com to a wholly different DNS provider. That provider then manages (all of) that zone, but nothing more (important records such as MX remain on example.com).

yjftsjthsd-h 2y ago

> so you have to leave the keys to the kingdom lying around on whatever machine is acquiring the certs, or use a convoluted workaround like acmeproxy to avoid that exposure. I thought you just created the TXT record once (manually if need be) and it didn't change when the cert is renewed?

jsheard 2y ago
Nah, the value of the TXT record has to be changed every time you pull a new certificate. https://letsencrypt.org/docs/challenge-types/ https://letsencrypt.org/docs/challenge-types/ > it only makes sense to use DNS-01 challenges if your DNS provider has an API you can use to automate updates.

synchrone 2y ago

> Let’s Encrypt follows the DNS standards when looking up TXT records for DNS-01 validation, you can use CNAME records or NS records to delegate answering the challenge to other DNS zones. This can be used to delegate the _acme-challenge subdomain to a validation-specific server or zone. It can also be used if your DNS provider is slow to update, and you want to delegate to a quicker-updating server. https://www.eff.org/deeplinks/2018/02/technical-deep-dive-securing-automation-acme-dns-challenge-validation https://www.eff.org/deeplinks/2018/02/technical-deep-dive-se...

extraduder_ire 2y ago

I do wonder if they considered any alternatives to requiring DNS challenges. I'd like to know the reasoning. I have a domain set up where every subdomain not otherwise specified gives a CNAME to one of the subdomains. (gandi lets me do it, don't know if it's standard) Certbot could easily serve the response to any challenge issued to <random number>.example.com as many times as it takes to be sure.