Another free CA as an alternative to Let's Encrypt

Re:Another free CA as an alternative to Let's Encrypt by remram on Friday August 20, 2021 @12:14PM (#28247729)

Oh that is really smart. Is there a way to build a simple DNS server into a certbot (or other client) plugin? That DNS server doesn't really have to be available outside of the verification time window.

DNS validation has been a thorn in my side for a while. Not only do I use DNS hosts that don't have APIs (like Google Domains), I also don't really want to give every web server access to my entire zone. That seems like a huge attack surface.

[ Parent | on HN ]

Re:Another free CA as an alternative to Let's Encrypt by kro on Friday August 20, 2021 @02:02PM (#28249308)

I already had Bind on the machine so it was logical to add the zone there and utilize nsupdate : https://gist.github.com/kronthto/893715f12cc0b1cda9fcfdbd8dc...

But what you are suggesting should work just fine aswell - there should be no need for a persistent service. Of course the service would need to run on port 53, so you actually cannot have another nameserver on that machine already, and also require CAP_NET_BIND_SERVICE .

A quick search lead me to this python project that could be an inspiration: https://github.com/pawitp/acme-dns-server

[ Parent | on HN ]

Re:Another free CA as an alternative to Let's Encrypt by snowzach on Friday August 20, 2021 @05:53PM (#28251837)

I run this one: https://github.com/joohoi/acme-dns It's super simple and has a REST API for updating records.

[ Parent | on HN ]