5 ms·

Unfortunately they are a bit extra bothersome to automate (depending on your DNS provider/setup) because of the DNS CNAME-method validation requirement.

by lysace 10mo ago

jsheard 10mo ago
Yep, but next year they intend to launch an alternative DNS challenge which doesn't require changing DNS records with every renewal. Instead you'll create a persistent TXT record containing a public key, and then any ACME client which has the private key can keep requesting new certs forever. https://letsencrypt.org/2025/12/02/from-90-to-45#making-automation-easier-with-a-new-dns-challenge-type https://letsencrypt.org/2025/12/02/from-90-to-45#making-auto...
- deleted 10mo ago
  [deleted]
- Ajedi32 10mo ago
  Oh, sweet! I didn't know about this. I have no need of wildcard certs, but this will greatly simplify the process of issuing certificates for internal services behind my local firewall. No need to maintain an acme-dns server; just configure the ACME client, set the DNS record and you're done? Very nice.
- 8cvor6j844qw_d6 10mo ago
  Great to hear, one less API keys needed for the DNS records.
cortesoft 10mo ago
If you are using a non-standard DNS provider that doesn’t have integration with certbot or cert-manager or whatever you are using, it is pretty easy to set up an acme-dns server to handle it https://github.com/joohoi/acme-dns https://github.com/joohoi/acme-dns
Reventlov 10mo ago
also you can use https://github.com/krtab/agnos https://github.com/krtab/agnos if you don't have any api access
- Ajedi32 10mo ago
  I hadn't heard of Agnos before, interesting alternative to ACME-DNS. Looking at the README, is the idea that the certificates get generated on the DNS server itself? Not by the ACME client on each machine that needs a certificate? That seems like a confusing design choice to me. How do you get the certificate back to the web server that actually needs it? Or is the idea that you'd have a single server which acts as both the DNS server and the web server?
ls612 10mo ago
When I set up a wildcard cert for my homelab services it was easy to have Cloudflare give me an API token to do the DNS validation for LE.

Unfortunately they are a bit extra bothersome to automate (depending on your DNS provider/setup) because of the DNS CNAME-method validation requirement.

by lysace 10mo ago

Unfortunately they are a bit extra bothersome to automate (depending on your DNS provider/setup) because of the DNS CNAME-method validation requirement.

jsheard 10mo ago

Yep, but next year they intend to launch an alternative DNS challenge which doesn't require changing DNS records with every renewal. Instead you'll create a persistent TXT record containing a public key, and then any ACME client which has the private key can keep requesting new certs forever. https://letsencrypt.org/2025/12/02/from-90-to-45#making-automation-easier-with-a-new-dns-challenge-type https://letsencrypt.org/2025/12/02/from-90-to-45#making-auto...

deleted 10mo ago
[deleted]
Ajedi32 10mo ago
Oh, sweet! I didn't know about this. I have no need of wildcard certs, but this will greatly simplify the process of issuing certificates for internal services behind my local firewall. No need to maintain an acme-dns server; just configure the ACME client, set the DNS record and you're done? Very nice.
8cvor6j844qw_d6 10mo ago
Great to hear, one less API keys needed for the DNS records.

cortesoft 10mo ago

If you are using a non-standard DNS provider that doesn’t have integration with certbot or cert-manager or whatever you are using, it is pretty easy to set up an acme-dns server to handle it https://github.com/joohoi/acme-dns https://github.com/joohoi/acme-dns

Reventlov 10mo ago

also you can use https://github.com/krtab/agnos https://github.com/krtab/agnos if you don't have any api access

Ajedi32 10mo ago
I hadn't heard of Agnos before, interesting alternative to ACME-DNS. Looking at the README, is the idea that the certificates get generated on the DNS server itself? Not by the ACME client on each machine that needs a certificate? That seems like a confusing design choice to me. How do you get the certificate back to the web server that actually needs it? Or is the idea that you'd have a single server which acts as both the DNS server and the web server?

ls612 10mo ago

When I set up a wildcard cert for my homelab services it was easy to have Cloudflare give me an API token to do the DNS validation for LE.