Post #3233791
2026-04-27 20:43 UTC
@ska@social.treehouse.systems What persistent state does it require on the server side? They're already persisting account IDs. And you could get rid of that by having virtual accounts whose account ID is just the public key for the certificate. In that case, DNS-PERSIST-01 is just publishing your public key in DNS. 😁
Replies (1)
-
@ska@social.treehouse.systems 2026-04-27 20:49
@dalias@hachyderm.io Well as it's currently written, the account needs to be identifiable via a URL, so it forces the ACME server to have its account tied to something in the web server. The API keys for ACME exchanges are URLs, so ACME is already tied to a web server because nobody designs anything outside of the web anymore 😭, but that's one more dependency. Having the equivalent of public keys directly in the DNS, as you suggest, would be conceptually cleaner.