Binding our AccountKey with our domain so no one else can generate a certificate

[Jyrj]

We use LE certificates in our organization and with the domain we own we are thinking if there is a way to bind our LE Account with the domain.

Expectations on binding:
1). Only our LE Account should be able to generate certificates for our domain.
2). Even if someone is able to generate a certificate, we should be having the access to directly revoke it without going through the process of Challenge validations.
3). (Similar to first point) Basically One-to-One mapping of the Domain with LE Account.

Is there LE provision to achieve any of these? If yes, what is the process?

[MikeMcQ]

@Jyrj

1). Only our LE Account should be able to generate certificates for our domain

Can do this with CAA record and accounturi. See Certificate Authority Authorization (CAA) - Let's Encrypt

[Osiris]

@Jyrj

2). Even if someone is able to generate a certificate, we should be having the access to directly revoke it without going through the process of Challenge validations.

This is not possible. Only the original account and an account with valid authorizations can revoke the cert.

[orangepizza]

well not by API but I think with right CAA record I think they can trigger 24 hour misissurance revocation by sending mail to LE security team

[Osiris]

@orangepizza

but I think with right CAA record I think they can trigger 24 hour misissurance revocation by sending mail to LE security team

How do you mean?

[9peppe]

Please note that there's no way to use CAA to block somebody from issuing a certificate for a subdomain if that somebody has DNS access to put their own CAA record on said subdomain.