Ho do you get dns-persist-01 account uri in this challenge?

Help
1

Hello all.
I was interessed in trying the new DNS-PERSIST challeng but I can't figure out how to get the uri to insert in the TXT record.
It could be a really problem solver for thos ( like me ) that cannot create an NS record in their registrar, and would like to have a wildcard certificate.
In this page from LE it is mentioned that you have to create a TXT record with the following values:
_validation-persist.example.com. IN TXT ( "letsencrypt.org;" " accounturi=https://acme-v02.api.letsencrypt.org/acme/acct/1234567890" )
Obviously in this example is using letsencrypt url but in real life there is no way ( that I know of ) to create an account on LE itself.
Should I run an acme-dns locally to create this account or what ?

Thanks to anyone who can explain me ( as if I was a 2 year child :grin: ) .

Pigi_102

2

Your ACME client should be able to provide the Let's Encrypt account URI. While you cannot create an account on the LE website, like you often do with services, the ACME protocol actually uses (automated) accounts under the hood.

So depending on which ACME client you used, it might be easy or not so easy to get the account URI to put in the TXT RR.

Edit:
If you're using Certbot, I actually added the usage of the show_account command I built into Certbot to Finding Account IDs - Let's Encrypt :slight_smile:

2 Likes
3

Thanks for your ( superfast ) reply.
If I understand correctly, then, I have to first get a certificate in some other ways ( like DNS-01 ) or I don't have any other way ?
Is that correct ?

What if I start from no certificate at all ?

Thanks again.
Pigi_102

4

Your ACME client will create an ACME account just for even trying to get a certificate. So no, you don't need to get a certificate first.

And usually an ACME client would have a separate command so you could just tell it to register an account and nothing more. Certbot can anyway.

3 Likes
5

Also note that Let's Encrypt does not yet support that. Staging system support is planned by the end of this month with production Q2 2026 per this rollout section: DNS-PERSIST-01: A New Model for DNS-based Challenge Validation - Let's Encrypt

It is fine to be planning ahead :slight_smile: I agree this will be very useful to many and look forward to when it is supported by many ACME Clients and other Certificate Authorities

2 Likes
6

Thanks to everyone.
Sad to know that is not yest supported, but nice to have understood how to get those values.
Another 2 o 3 manual renews then I should be good to go !

Thanks again.

1 Like
7

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.