Post #2563468

@jima@mspsocial.net @ryanc@infosec.exchange @owen@mastodon.transneptune.net Yep, that's the right way to do it. Prior to DNS-PERSIST-01 announcement, I had an even fancier plan in the works: delegating _acme_challenge to a public server (run as a public service) with a DS whose key is held by your device that wants certs. When you need to do the ACME dance, the device would send a DNS packet to the public service, which would cache and serve it for up to some short time limit. I never got around to implementing it, and once DNS-PERSIST-01 was announced, I dropped the idea because it's no longer needed.