Post #2563467
2026-05-10 23:14 UTC
@dalias@hachyderm.io @ryanc@infosec.exchange @owen@mastodon.transneptune.net I completely agree, which is why I CNAME the _acme-challenge records off to a distinct zone, which the automated process DOES have access to modify. 😀
Replies (1)
-
@dalias@hachyderm.io 2026-05-10 23:38
@jima@mspsocial.net @ryanc@infosec.exchange @owen@mastodon.transneptune.net Yep, that's the right way to do it. Prior to DNS-PERSIST-01 announcement, I had an even fancier plan in the works: delegating _acme_challenge to a public server (run as a public service) with a DS whose key is held by your device that wants certs. When you need to do the ACME dance, the device would send a DNS packet to the public service, which would cache and serve it for up to some short time limit. I never got around to implementing it, and once DNS-PERSIST-01 was announced, I dropped the idea because it's no longer needed.