Has LetsEncrypt released any documentation on how to invoke the DNS-PERSIST challenge with the client?

The type field in the new order request refers to what identifiers you want in the certificate i.e. a domain name, not the challenge type ( RFC 8555 section 7.4 ). The available challenges are in the responses to requests to the provided authorizations ( RFC 8555 section 7.5 ).

the domain name is in there too, but I just showed the type. the type value in the un-mod'ed getssl script is "dns".

[image] hickersj: Has LetsEncrypt released any documentation on how to invoke the DNS-PERSIST challenge That challenge is described in the draft RFC here: draft-ietf-acme-dns-persist-01 - Automated Certificate Management Environment (ACME) Challenge for Persistent DNS TXT Record Validation T…

The type field should be left as dns unless you're getting an IP address certificate. Selecting a challenge is performed after fetching the pending authorization ( RFC 8555 section 7.5 ), you might want to check where http-01 or dns-01 appears in getssl.

If you are open to other ACME Clients the lego client already has support for the draft dns-persist. used in LE Staging Correction: The current lego requires draft v01 and does not work with LE Staging dns-persist based on v00. See: How code the dns-persist-01 challenge - #15 by tob . Ob…

[image] MikeMcQ: It offers a CLI which shouldn't be that difficult to use instead of getssl CLI. Isn't getssl mostly in maintenance mode? Sort of? It gets commits every few weeks; it has profile support on the master branch but I think it's slightly wrong (if you don't specify a profile it pi…

[image] kenh1: the maintainer said he was going to commit it, but that was two weeks ago. I know life gets busy sometimes for people so I'm not holding it against him. Fingers crossed. I used getssl for a while but quit almost 5 years ago. I vaguely recall Tim saying he didn't have much tim…

Correct, the client should not select a default profile. For example, the server might select a different default for you, depending on what's in the rest of your order (e.g. defaulting to classic for most orders, but defaulting to shortlived if the order contains an IP address). If the client selec…

[image] MikeMcQ: If you are open to other ACME Clients the lego client already has support for the draft dns-persist used in LE Staging Unfortunately not. Lego expects draft 01, but Let's Encrypt Staging uses draft 00. Error message: "dnspersist01: missing accounturi in challenge object" …

How code the dns-persist-01 challenge

Client dev

tob May 22, 2026, 6:11am 15

Unfortunately not. Lego expects draft 01, but Let's Encrypt Staging uses draft 00. Error message: "dnspersist01: missing accounturi in challenge object"

Topic		Replies	Views
Problem finding dns-persist-01 in staging Client dev	25	1396	April 8, 2026
Dns-persist-01 challenge Client dev	19	1175	March 3, 2026
Does Certbot currently support the ACME `dns-persist-01` challenge? Help	1	866	June 26, 2026
DNS-PERSIST without spending an Order Client dev	13	1249	May 5, 2026
DNS challenge is in staging Feature Requests	48	28207	February 10, 2016

How code the dns-persist-01 challenge

Related topics