Elektrine lite

← Feed

@ska@social.treehouse.systems

Post #3233790

2026-04-27 20:16 UTC

@dalias@hachyderm.io I had taken a look at DNS-01 and discarded it because it was easier for me to grant the ACME client write access to a place in my served HTTP data (just a directory in the filesystem made writable to the acme user) than to my served DNS data (need to edit or assemble text files then compile a constant database, need root privileges to install the new cdb). I took a look at DNS-PERSIST-01 and yes, that looks much better on the ACME client side, but it looks like it does require more persistent state on the ACME server side. It's a tradeoff I'd be happy to make as a client, but does it really reduce the overall complexity? (Edit: typo)

Replies (1)

  • @dalias@hachyderm.io 2026-04-27 20:43

    @ska@social.treehouse.systems What persistent state does it require on the server side? They're already persisting account IDs. And you could get rid of that by having virtual accounts whose account ID is just the public key for the certificate. In that case, DNS-PERSIST-01 is just publishing your public key in DNS. 😁

    Open ##3233791