For the ACME v2 DNS-01 Challenge we all know " ACME client a token, your client will create a TXT record derived from that token and your account key, and put that record at _acme-challenge.<YOUR_DOMAIN> ." But will the ACME v2 DNS-01 Challenge allow for more than just the DNS TXT record for _acme-…

[image] Bruce5051: If I were to try a DNS-01 Challenge and update _acme-challenge.zjhzcrxvjcidp.ml TXT field with the Challenge Token should the challenge succeed? I would expect so. The spec says that the ACME server will "Query for TXT records for the validation domain name", so I don't se…

[image] petercooperjr: I would expect so. Thanks @petercooperjr ! :slight_smile: Well it worked using https://gethttpsforfree.com/ and manually editing the _acme-challenge.zjhzcrxvjcidp.ml TXT Record. Here is the Precertificate crt.sh | 8601507005

Yeah, I mean you could always try against LE Staging, Pebble, and maybe even some actual CAs if you want to see how it works in practice, rather than relying on my quick glancing through the spec.

I would love to hear more thoughts and opinions on this Topic; even though @petercooperjr seems to have nailed it on Post #2.

I believe you can also have multiple completing TXT records as well. IIRC, LetsEncrypt will inspect all the DNS records for a match but some providers will only support one or their own maximum number of records.

[image] jvanasco: TXT records Since I was doing it all manually with https://gethttpsforfree.com/ just had 1 TXT Record that I edited and updated (and wait for propagation), and for the second challenge just reedited the TXT Record again.

At this point I am not going to challenge fate by trying a DNS TXT Record and a DNS CNAME Record together; TXT & A are enough for me today. :slight_smile:

You can't have a CNAME at the same time as any other type of record for the same name, but that's nothing specific to ACME. :slight_smile:

[image] Bruce5051: a DNS TXT Record and a DNS CNAME Record together That should fail big time. Having the CNAME record should void all other records. See: CNAME record - Wikipedia [image]

DNS-01 Challenge including more DNS Records than TXT

Issuance Tech

Bruce5051 February 8, 2023, 12:47am 5

I had asked due to this Help Topic Nextjs-nginx:No TXT record found at _acme-challenge.agoratsp.com - #30 by rg305

Topic		Replies	Views
ACME v2 will ask two different dns TXT for a.com and *.a.com, but only one _acme-challenge.a.com is asked Help	2	1245	March 16, 2018
DNS-01 challenge for wildcard cert - explanation? Client dev	8	6832	September 12, 2018
Two _acme-challenge dns records and letsencrypt failing with DNS problem: server failure at resolver looking up TXT for _acme-challenge Help	10	11221	February 27, 2018
Generate dns-01 TXT challenge with ACME-python Help	10	1987	February 1, 2023
Dns-01 challenge failure / wildcard certificate Client dev	2	2310	May 16, 2018

DNS-01 Challenge including more DNS Records than TXT

Related topics