DNS-01 challenge allows for domain ownership verification without open ports and instead looks for a txt record. Using a tool like lego[1] with the respective dns provider’s API automatically creates and deletes the txt record after generating a certificate.
Because ownership is verified by dns txt entry, the (sub-)domain doesn’t have to point to a publicly routable host. This allows for using any IP, so I’m using a local ip only available through wireguard or my local network (E.g. bitwarden.example.com points to 192.168.1.123).
The disadvantage is that the provider has to be supported and you have to store an API key for your domain on the server.
that’s genius. i have never even considered that you could use a (sub)domain with a local ip like that to get a certificate from a trusted ca.
i ma not sure i understand the neccessity for api access to your dns service. is the txt record for LE different every time you have to pass a challenge? otherwise i imagine you could just set and forget the record.
Yes it’s awesome. I never even considered that it’s possible to add not publicly routable IP’s to public DNS server, until I recently read a post about dns-01 challenge.
You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: !selfhosted@lemmy.world
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don’t control.
Rules:
Be civil: we’re here to support and learn from one another. Insults won’t be tolerated. Flame wars are frowned upon.
No spam posting.
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it’s not obvious why your post topic revolves around selfhosting, please include details to make it clear.
Don’t duplicate the full text of your blog or github here. Just post the link for folks to click.
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
DNS-01 challenge allows for domain ownership verification without open ports and instead looks for a txt record. Using a tool like lego[1] with the respective dns provider’s API automatically creates and deletes the txt record after generating a certificate.
Because ownership is verified by dns txt entry, the (sub-)domain doesn’t have to point to a publicly routable host. This allows for using any IP, so I’m using a local ip only available through wireguard or my local network (E.g. bitwarden.example.com points to 192.168.1.123).
The disadvantage is that the provider has to be supported and you have to store an API key for your domain on the server.
[1] https://github.com/go-acme/lego
that’s genius. i have never even considered that you could use a (sub)domain with a local ip like that to get a certificate from a trusted ca. i ma not sure i understand the neccessity for api access to your dns service. is the txt record for LE different every time you have to pass a challenge? otherwise i imagine you could just set and forget the record.
thank you for the explanation, well appreciated!
Yes it’s awesome. I never even considered that it’s possible to add not publicly routable IP’s to public DNS server, until I recently read a post about dns-01 challenge.
I believe the txt record is different every time.