-
Couldn't load subscription status.
- Fork 3
Open
Description
There is one more DNS-based ACME challenge type dns-account-01 being introduced. It's using DNS record "_" || base32(SHA-256(<ACCOUNT_URL>)[0:10]) || "._acme-challenge".
- https://datatracker.ietf.org/doc/draft-ietf-acme-dns-account-label/01/
- feat: Support for dns-account-01 Challenge letsencrypt/boulder#8149
When looking up ACME-DNS account via domain name, libdns/acmedns strips _acme-challenge. prefix before performing the lookup.
Lines 67 to 72 in 55d190b
| func (p *Provider) selectAccount(zone string, name string) (*account, error) { | |
| if p.Configs != nil { | |
| domain := libdns.AbsoluteName(name, zone) | |
| domain = strings.Trim(domain, ".") | |
| domain = strings.TrimPrefix(domain, acmePrefix) | |
| config, found := p.Configs[domain] |
This stripping should be discouraged, to avoid inconsistency that dns-01 challange type needs to be configured in example.com entry while dns-account-01 challenge type needs to be configured in _XXXXXXXXXXXXXXXX._acme-challenge.example.com.
Metadata
Metadata
Assignees
Labels
No labels