4 ms·
Really happy to see this. In the meantime, if you use bind as your authoritative nameserver, you can limit an hmac-secret to one TXT record, so each webserver
by jcalvinowens 8mo ago
Really happy to see this.
In the meantime, if you use bind as your authoritative nameserver, you can limit an hmac-secret to one TXT record, so each webserver that uses rfc2136 for certificate renewals is only capable of updating its specific record:
key "bob.acme." {
algorithm hmac-sha512;
secret "blahblahblah";
};
key "joe.acme." {
algorithm hmac-sha512;
secret "blahblahblah2";
};
zone "example.com" IN {
type master;
file "/var/lib/bind/example.com.zone";
update-policy {
grant bob.acme. name _acme-challenge.bob.acme.example.com. TXT;
grant joe.acme. name _acme-challenge.joe.acme.example.com. TXT;
};
key-directory "/var/lib/bind/keys-acme.example.com";
dnssec-policy "acme";
inline-signing yes;
};
I like this because it means an attacker who compromises "bob" can only get certs for "bob". The server part looks like this:
export LE_CONFIG_HOME="/etc/acme-sh/"
export NSUPDATE_SERVER="${YOUR_NS_ADDR}"
export NSUPDATE_KEY="/var/lib/bob-nsupdate.key"
export NSUPDATE_KEY_NAME="bob.acme."
export NSUPDATE_ZONE="acme.example.com."
acme.sh --issue --server letsencrypt -d 'bob.example.com' \
--certificate-profile shortlived \
--days 6 \
--dns dns_nsupdate
- xav0989 8mo agoIf not using something like bind, but willing to run a dedicated dns server for acme challenges, acmedns offers something similar. When you generate a new account, it gets given a unique subdomain. You then cname the challenge domain to the acmedns subdomain and the account can only affect the associated subdomain.