[feature] dns-01 challenge

[abdeldjalil-fellah]

• add support for the DNS-01 challenge

[knrdl]

Hello, this is currently out of scope. What is your use case to require this?

[loxK]

I personally use the dns-rfc2136 a lot. It prevents the hassle of configuring an HTTP path for validation.

[collinwebdesigns]

@knrdl do you think this is possible?

I would also find this very practical, especially in relation to my local network.
I would then implement a UniFi client for acme.sh, which would then set the DNS records.
This would make it easy and practical to certify your entire home network.

[knrdl]

Currently I only see 2 use cases for the DNS-01 challenge:

1. Avoiding disclosure of individual subdomains in certificate transparency log by using wildcard certificates (e.g. *.mydomain.org instead of app1.mydomain.org, app2.mydomain.org, ...)
2. Obtaining certs without opening the firewall for inbound traffic (no port 80 open to the internet). E.g. *.intranet.mycompany.com might only be routed in the intranet but could have a cert signed by Let's encrypt.

However, in the context this software is designed for, neither of these provides a strong advantage. In controlled networks subdomain enumeration shouldn't be a concern. The ACME server is part of the network, so no firewall changes are required. And certificate automation already makes it trivial to issue separate certificates per domain (or combine them via SANs).

Because of this, I currently don’t see sufficient benefit to justify the added complexity. While it would certainly be a nice feature to have, I don’t have the time or motivation to work on it.

[collinwebdesigns]

@loxK, @abdeldjalil-fellah I am over to add support for DNS-01 and also migrate to SQLAlchemy.
Maybe I'll get around to pushing it next week if you Are interested.

[loxK]

@collinwebdesigns awesome. I'll be happy to test and report about DNS-NSupdate / RFC 2136

[collinwebdesigns]

@loxK Here is my current code. It works, but I still have a few things to do.

I use it together with dns_unifi in my home network. I only install the public CA as trusted on my clients and can simply use the acme client for my services.