3 ms·

no you don't, you can just run https://github.com/joohoi/acme-dns https://github.com/joohoi/acme-dns anywhere, and then CNAME _acme_challenge.realdomain.com to

no you don't, you can just run https://github.com/joohoi/acme-dns https://github.com/joohoi/acme-dns anywhere, and then CNAME _acme_challenge.realdomain.com to aklsfdsdl239072109387219038712.acme-dns.anywhere.com. then your ACME client just talks to the ACME DNS api, which let's it do nothing at all aside from deal with challenges for that one long random domain.

rglullis 1y ago
I've been hoping to get ACME challenge delegation on traefik working for years already. The documentation says it supports it, but it simply fails every time. If you have any idea how this tool would work on a docker swarm cluster, I'm all ears.
Arnavion 1y ago
You can do it with an NS record, ie _acme_challenge.realdomain.com pointing to the DNS server that you can program to serve the challenge response. No need to make a CNAME and involve an additional domain in the middle.
- aflukasz 1y ago
  Yeah, but then you can just as well use http-01 with like same effort.
  - gruez 1y ago
    no, because dns supports wildcard certificates, unlike http.
    - aflukasz 1y ago
      Ah, good point.
    - cpach 1y ago
      dns-01 is also good for services on a private network.
8organicbits 1y ago
There's a SaaS version as well, if you don't want to self-host. https://docs.certifytheweb.com/docs/dns/providers/certifydns/ https://docs.certifytheweb.com/docs/dns/providers/certifydns...