4 ms·

The ACME provider makes a query to the DNS server to validate the record exists and contains the right "funny string". Parent's question was whether that query

The ACME provider makes a query to the DNS server to validate the record exists and contains the right "funny string". Parent's question was whether that query is/can be made via DoH.

cpach 1y ago
Perhaps I have poor imagination, but I fail to see why why it would matter?
- 0x0000000 1y ago
  Because nginx, as an HTTP server, could answer the query?
  - Arrowmaster 1y ago
    You want to build a DNS server into nginx so you can respond to DoH query's for the domain you are hosting on that nginx server? Let's ignore that DoH is a client oriented protocol and there's no same way to only run a DoH server without an underlying DNS server. How do you plan to get the first certificate so the query to the DoH server doesn't get rejected for invalid certificate?
  - xg15 1y ago
    At that point you might as well use the HTTP-01 challenge. I think the whole utility of DNS-01 is that you can use it if you don't want to expose the HTTP server to the internet.
    - jcgl 1y ago
      No, that’s just one of the use-cases. Also: - wildcard certs. DNS-01 is a strict requirement here. - certs for a service whose TLS is terminated by multiple servers (e.g. load balancers). DNS-01 is a practical requirement here because only one of the terminating servers would be able to respond during an HTTP or ALPN challenge.
      - xg15 1y ago
        Ah, that makes sense. Thanks!
      - account42 1y ago
        > DNS-01 is a practical requirement here because only one of the terminating servers would be able to respond during an HTTP or ALPN challenge. Reverse-proxying or otherwise forwarding requests for .well-known/acme-challenge/ to a single server should be just as easy to set up as DNS-01.
        jcgl 1y ago
        But then you have to redistribute the cert from that single server to all the others. Which, yes, can be done. But then you've gotta write that glue yourself. What's more, you've now chosen a special snowflake server on whom renewals depend. In other words, no, it's not just as easy as setting up DNS-01. Different operational characteristics, and a need for bespoke glue code.
        xg15 1y ago
        > But then you have to redistribute the cert from that single server to all the others. Wouldn't you have to do that anyway? Or is the idea that each server requests and renews a separate cert for itself? That sounds as if you'd have to watch out for multiple servers stepping on each other's toes during the DNS-01 challenge, if there is ever a situation where two or more servers want to renew their cert at the same time.
        cpach 1y ago
        Yup. There’s an RFC draft that addresses this dilemma. https://datatracker.ietf.org/doc/draft-ietf-acme-dns-account-label/ https://datatracker.ietf.org/doc/draft-ietf-acme-dns-account...
        jcgl 1y ago
        Afaiu, that's only a problem for trying to _delegate_ to multiple clients. But routine operation with multiple clients works just fine in my experience (doing multi-region load balancing). Multiple TXT records are created, I think (speaking off the top of my head).

The ACME provider makes a query to the DNS server to validate the record exists and contains the right "funny string". Parent's question was whether that query is/can be made via DoH.

cpach 1y ago

Perhaps I have poor imagination, but I fail to see why why it would matter?

0x0000000 1y ago
Because nginx, as an HTTP server, could answer the query?
- Arrowmaster 1y ago
  You want to build a DNS server into nginx so you can respond to DoH query's for the domain you are hosting on that nginx server? Let's ignore that DoH is a client oriented protocol and there's no same way to only run a DoH server without an underlying DNS server. How do you plan to get the first certificate so the query to the DoH server doesn't get rejected for invalid certificate?
- xg15 1y ago
  At that point you might as well use the HTTP-01 challenge. I think the whole utility of DNS-01 is that you can use it if you don't want to expose the HTTP server to the internet.
  - jcgl 1y ago
    No, that’s just one of the use-cases. Also: - wildcard certs. DNS-01 is a strict requirement here. - certs for a service whose TLS is terminated by multiple servers (e.g. load balancers). DNS-01 is a practical requirement here because only one of the terminating servers would be able to respond during an HTTP or ALPN challenge.
    - xg15 1y ago
      Ah, that makes sense. Thanks!
    - account42 1y ago
      > DNS-01 is a practical requirement here because only one of the terminating servers would be able to respond during an HTTP or ALPN challenge. Reverse-proxying or otherwise forwarding requests for .well-known/acme-challenge/ to a single server should be just as easy to set up as DNS-01.
      - jcgl 1y ago
        But then you have to redistribute the cert from that single server to all the others. Which, yes, can be done. But then you've gotta write that glue yourself. What's more, you've now chosen a special snowflake server on whom renewals depend. In other words, no, it's not just as easy as setting up DNS-01. Different operational characteristics, and a need for bespoke glue code.
        xg15 1y ago
        > But then you have to redistribute the cert from that single server to all the others. Wouldn't you have to do that anyway? Or is the idea that each server requests and renews a separate cert for itself? That sounds as if you'd have to watch out for multiple servers stepping on each other's toes during the DNS-01 challenge, if there is ever a situation where two or more servers want to renew their cert at the same time.
        cpach 1y ago
        Yup. There’s an RFC draft that addresses this dilemma. https://datatracker.ietf.org/doc/draft-ietf-acme-dns-account-label/ https://datatracker.ietf.org/doc/draft-ietf-acme-dns-account...
        jcgl 1y ago
        Afaiu, that's only a problem for trying to _delegate_ to multiple clients. But routine operation with multiple clients works just fine in my experience (doing multi-region load balancing). Multiple TXT records are created, I think (speaking off the top of my head).