Hacker News new | past | comments | ask | show | jobs | submit login

Doing it this way is also more secure, since it means you don't have to give your web server unrestricted write access to every DNS record under your domain.

acme-dns is specifically designed for this purpose: https://github.com/joohoi/acme-dns




If you use BIND you can set an UPDATE ACL that allows your web server access to change acme challenges only: https://fanf.dreamwidth.org/123294.html


BIND looks fantastic but I really like the restricted nature of acme-dns -- I don't know much about DNS and I don't want to inherit a huge amount of functionality that I don't know how to properly administer -- I really only want to manage a nameserver for acme challenges.

By "UPDATE ACL" I believe that you are referring to the DNS UPDATE RFC[0] -- it looks like cert-manager doesn't support generic UPDATEs yet[1].

[0]: https://tools.ietf.org/html/rfc2136

[1]: https://github.com/jetstack/cert-manager/issues/468


It’s pretty easy to make `dehydrated` use `nsupdate` for DNS challenges: https://github.com/fanf2/doh101/blob/master/roles/doh101/fil...


This is huge, thanks! It looks like there's also a PR into to cert-manager to support it:

https://github.com/jetstack/cert-manager/pull/787




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: