Re:Free DDNS with Cloudflare and a Cronjob
by TheNewsIsHere on Saturday July 27, 2024 @05:55PM
(#41089605)
Using CNAME delegation for the ACME challenge domain and directing that to a Route 53 zone is my preferred approach. Then (as long as you have CloudWatch configured) you get inherent auditing and very flexible privilege management.
That wouldn't work for this use case though would it? AWS doesn't allow downloading the certificate (I could be wrong)? Typically certificates can only be used with other AWS services. E.g. you can't download the certificate and serve it from a home server.
Re:Free DDNS with Cloudflare and a Cronjob
by vladvasiliu on Sunday July 28, 2024 @08:27AM
(#41092772)
You're not wrong, but the idea here is not to use AWS' certificate manager but their DNS service on which you would only handle the acme-challenge subdomain. This would allow you to limit who can update which subdomain. The LE cert is obtained normally.
Re:Free DDNS with Cloudflare and a Cronjob
by attentive on Saturday July 27, 2024 @08:17PM
(#41090339)
there is also https://github.com/joohoi/acme-dns and LE clients like lego supporting it.
Afaik, every major registrar allows you to add an NS record for the _acme-challenge subdomain, allowing you to put the _acme-challenge subdomain on a custom, self-hosted DNS server.
That in turn allows you to make the permissions as specific as you'd like. Personally I just run powerdns in docker for this.