Hacker News Reader

Comment by chrismorgan | Hacker News Reader

Could you instead set a _acme-challenge.example.com NS record and let the other DNS provider handle only _acme-challenge.example.com that way?

View on HN

A deep dive on how ACME DNS validation works:

* https://www.eff.org/deeplinks/2018/02/technical-deep-dive-se...

You can have a CNAME _acme-challenge.example.COM point to _acme-challenge.example.ORG or a sub-domain like _acme-challenge.DNSAUTH.example.com.

At work we use the sub-domain method and just have a small non-HA VM with some scripts that allow ACME clients to update particular TXT records. Each ACME client is given an individual key and allowed to only update a particular record.

Folks have specifically written DNS servers to do just this:

* https://github.com/joohoi/acme-dns

However we used BIND with some custom scripting.

I use the NS approach too at the moment, it does feel like the natural way to do it with DNS. One downside is if your cloud provider charges per zone you end up paying for twice as many zones.

That’d be no different with the CNAME alias technique, right?

I’m not seeing any reason for the CNAME technique; seems like the NS technique should be every bit as good, without needing another domain name (which costs money and is another moving part). I’d like to know if I’m misreading anything.

You can use sub-domains as well: _acme-challenge.example.com -> _acme-challenge.DNSAUTH.example.com, _acme-challenge.foo.example.com -> _acme-challenge.foo.dnsauth.example.com.

You can then have a small VM handle answering DNS queries just for dnsauth.example.com. Folks have written servers to do just this:

* https://github.com/joohoi/acme-dns

Yes. That's how I handle acme verification for quasseldroid.info, I just have NS records for the acme-challenge subdomain pointing to my own powerdns server.

That.... Might solve an issue we have at work where a client's DNS provider is... Extremely janky, I tried for the CNAME record but it only allows internal ( to that zone) CNAMEs.. didn't look at the NS records..

Yes. I use hosted zones in Route53 to do this automation and use iam to limit access to that one zone.

Reply on news.ycombinator.com