DNS-PERSIST-01 and _validation-persist CNAME

Issuance Tech
1

DNS-01 allows CNAME _acme-challenge to elsewhere, does DNS-PERSIST-01 allow CNAME _validation-persist to one single TXT record?

I am thinking if I can simplifying the way of configuring DNS-PERSIST-01 _validation-persist records, avoiding duplicating account ID to multiple _validation-persist records

For example, I am having 30 domains, each having its own _validation-persist CNAME record.
(Yes, I am currently having about 30 domains, all validated using DNS-01. I am planning to change all them to DNS-PERSIST-01.

_validation-persist.domain01.example.com CNAME _validation-persist.example.com
_validation-persist.domain02.example.com CNAME _validation-persist.example.com
.....
_validation-persist.domain30.example.com CNAME _validation-persist.example.com

And _validation-persist.example.com provides the actual TXT entry for DNS-PERSIST-01.

Is it allowed?

Currently I am using DNS-01 and CNAME _acme-challenge to DESEC (workaround not to actually allowing certbot touching my main DNS zone), but it's simply way too slow to wait DNS to propagate. (Yes, DESEC now requires at least 300 seconds to propagate confidently.) And I am not a fan letting an automated program to change DNS record unsupervised. DNS-PERSIST-01 solves my problem and simplifies deployment.

2

I don't see any rule forbid cname at that level:
there is this clause at CA/B TLS BR, but it doesn't apply to cname at that level.

For this method, the CA MUST NOT use the FQDN returned from a DNS CNAME lookup as the FQDN for the purposes of domain validation. This prohibition overrides the Authorization Domain Name definition. CNAME records MAY be followed when resolving the Persistent DCV TXT Record.

3 Likes
3

Your quote already answered the question :joy:

Actually, it explicitly allows CNAME when resolving the record (but not guaranteed, since BR only says "MAY"), it only forbids using the FQDN returned from CNAME as the domain name to be validated.

2 Likes
4

FYI, I tested DNS-PERSIST-01 with posh-acme, and it works as I thought.
(Although posh-acme doesn't have built-in support yet, it exposes the lower level API as Powershell cmdlet, so I can break down the issuance into individual steps and trigger the verification URL manually.)

1 Like