News for hackers. Stuff that matters.

A comment on Let's Encrypt posts letter from executive director. Parent comment

Re:Let's Encrypt posts letter from executive director by rossy on Monday December 05, 2022 @09:22PM (#33875072)
If your concern is that certbot has access to your DNS records, you can set up a CNAME or NS record on _acme-challenge.your-domain and serve the TXT record from a separate, isolated DNS server.
[ Parent | on HN ]
Re:Let's Encrypt posts letter from executive director by iuafhiuah on Tuesday December 06, 2022 @10:55AM (#33882071)
That's an interesting solution to mitigating risk. I wasn't aware that LE would follow a CNAME to a different TXT record.

Although it does require an additional NS which is an additional maintenance overhead - that is preferable to leaving automated services sitting around with write access to important domains. At least until I can stop regularly writing DNS records.

[ Parent | on HN ]