Hacker News Reader

Comment by nickjj | Hacker News Reader

I've been using LE from the start and it's been awesome (especially with clients like acme-tiny), but wildcards changes everything.

How many of you are really going to set up a custom DNS updating script?

Maybe I misread something but I remember hearing wildcard certs will only work with DNS based challenges.

Wouldn't that mean the verification tool would need to support every single registrar's / DNS provider's API?

For example, I host my domains (and DNS) with namesilo.com. Is a challenge script really going to know how to interface with their API to add / remove the TXT records?

What about the 50 other popular DNS providers?

View on HN

Yes, but there's already scripts handling many of the most popular.

Check out acme.sh and remember, changing your DNS provider or hosting it yourself really isn't that bad.

https://github.com/Neilpang/acme.sh

Nice, it looks like they support namesilo and ~40 others.

So my suspicion seems accurate. The script will need to know how to interface with each provider and you (as an end user) will also need to be responsible for setting up your own API keys for whatever provider you use.

If you're up for the task, I've wanted to write a script (POSIX /bin/sh certainly) for interaction with DNS providers. Basically lower the entry barrier, and avoid the web interface:

    $ foo mydomain.org --init ovh
    $ foo mydomain.org my.sub A 1.2.3.4
    $ foo mydomain.org my.sub AAAA 1234::abcd
    $ foo mydomain.org --remove my.sub A [1.2.3.4]

etc.

I have yet to find anything that handles any DNS changes in a simple, stupid way. Most API clients I've seen only handle one kind of request: acme.sh only does TXT challenges. DynDNS endpoint only does A records. Etc.

It'd be cool to have and it's relatively straightforward from a software engineering perspective, but it's so much boring grunt work that finding someone who wants to implement it might be challenging.

If this is something you need to do a regular basis, you might consider hosting your own DNS and using BIND's nsupdate tool.

> hosting your own DNS

meh. There are some things that I'd gladly host, but DNS clerly isn't among them. Too many ways to screw up, probable breakage ahead (only 1 dedicated @ OVH), so many rate-limits to implement; DNS servers a re filled with RCEs... (bind being the worst).

Clearly, nope. Not doing this ;)

pfSense has a dynamic DNS updater built in with support for a huge number of services - https://doc.pfsense.org/index.php/Dynamic_DNS . There's also an ACME client and HAProxy packages and a built in CA and cert handler.

Its all open source, so grab their scripts ...

If only there was an existing standardized way to transfer zone updates to an existing DNS server...

Reply on news.ycombinator.com