4 ms·

I really like and hate this at the same time. Years ago, I had a really fubar shell script for generating the DNS-01 records on my own (non-cloud) run authorit

by mmh0000 8mo ago

I really like and hate this at the same time. Years ago, I had a really fubar shell script for generating the DNS-01 records on my own (non-cloud) run authoritative nameserver. It "worked," but its reliability was highly questionable. I like this DNS-PERSIST fixes that. But I don't understand why they chose to include the account as a plain-text string in the DNS record. Seems they could have just as easily used a randomly generated key that wouldn't mean anything to anyone outside Let's Encrypt, and without exposing my account to every privacy-invasive bot and hacker.

ragall 8mo ago
Those who choose to use DNS-PERSIST-01 should fully commit to automation and create one LetsEncrypt account per FQDN (or at least per loadbalancer), using a UUID as username.
- mcpherrinm 8mo ago
  There is no username in ACME besides the account URI, so the UUID you’re suggesting isn’t needed. The account uri themselves just have a number (db primary key). If you’re worried about correlating between domains, then yes just make multiple accounts. There is an email field in ACME account registration but we don’t persist that since we dropped sending expiry emails.
  - glzone1 8mo ago
    Interesting. I didn't realize the email field wasn't persisted. I assumed it could be used in some type of account recovery scenario.
  - 9dev 8mo ago
    It’s still a valid point IMHO - why not just use the public key directly? It seems like the account URI just adds problems instead of resolving any.
    - mcpherrinm 8mo ago
      It has these primary advantages: 1. It matches what the CAA accounturi field has 2. Its consistent across an account, making it easier to set up new domains without needing to make any API calls 3. It doesn’t pin a users key, so they can rotate it without needing to update DNS records - which this method assumes is nontrivial, otherwise you’d use the classic DNS validation method
Ajedi32 8mo ago
> they could have just as easily used a randomly generated key Isn't that pretty much what an accounturi is in the context of ACME? Who goes around manually creating Let's Encrypt accounts and re-using them on every server they manage?
bflesch 8mo ago
> But I don't understand why they chose to include the account as a plain-text string in the DNS record. Simple: it's for tracking. Someone paid for that.

by mmh0000 8mo ago

ragall 8mo ago

Those who choose to use DNS-PERSIST-01 should fully commit to automation and create one LetsEncrypt account per FQDN (or at least per loadbalancer), using a UUID as username.

mcpherrinm 8mo ago
There is no username in ACME besides the account URI, so the UUID you’re suggesting isn’t needed. The account uri themselves just have a number (db primary key). If you’re worried about correlating between domains, then yes just make multiple accounts. There is an email field in ACME account registration but we don’t persist that since we dropped sending expiry emails.
- glzone1 8mo ago
  Interesting. I didn't realize the email field wasn't persisted. I assumed it could be used in some type of account recovery scenario.
- 9dev 8mo ago
  It’s still a valid point IMHO - why not just use the public key directly? It seems like the account URI just adds problems instead of resolving any.
  - mcpherrinm 8mo ago
    It has these primary advantages: 1. It matches what the CAA accounturi field has 2. Its consistent across an account, making it easier to set up new domains without needing to make any API calls 3. It doesn’t pin a users key, so they can rotate it without needing to update DNS records - which this method assumes is nontrivial, otherwise you’d use the classic DNS validation method

Ajedi32 8mo ago

> they could have just as easily used a randomly generated key Isn't that pretty much what an accounturi is in the context of ACME? Who goes around manually creating Let's Encrypt accounts and re-using them on every server they manage?

bflesch 8mo ago

> But I don't understand why they chose to include the account as a plain-text string in the DNS record. Simple: it's for tracking. Someone paid for that.