# Just one \_acme-challenge value for all domains in same DNS validation

**URL:** <https://community.letsencrypt.org/t/just-one-acme-challenge-value-for-all-domains-in-same-dns-validation/156231>\
**Category:** Feature Requests\
**Created:** [July 22, 2021, 8:37am UTC](https://community.letsencrypt.org/t/just-one-acme-challenge-value-for-all-domains-in-same-dns-validation/156231 "2021-07-22T08:37:59Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![kongen](https://avatars.discourse-cdn.com/v4/letter/k/b487fb/32.png) [@kongen](https://community.letsencrypt.org/u/kongen)\
**Post date:** [July 22, 2021, 8:37am UTC](https://community.letsencrypt.org/t/just-one-acme-challenge-value-for-all-domains-in-same-dns-validation/156231/1 "2021-07-22T08:37:59Z")

</div>

I'm trying to create a certificate for 13 domains on a mail server with no web server. Port 80 is directed to another server that I don't have direct access to.

With wildcard certbot generates 26 \_acme-challenge values that must be inserted into DNS.

On my DNS service this shouldn't be a big problem as they allow use of a template where all 26 can be inserted, except certbot only can handle 10 \_acme-challenge values on the same domain.

If I didn't use the template I should insert the 26 values in 13 different DNS records. There is a high risk for cut/paste errors.

If it was the same \_acme-challenge value set for all the domains in the same validation it would be much simpler, and I can't see how it would be less safe.

In my case with the DNS template I would only have to insert a single value to one DNS entry, and without template feature, you would have to update 13 records, but with the same \_acme-challenge value i.e. smaller risk for cut/paste errors.

best regards  
Ulrik

---

<div class="post-metadata">

**Author:** ![jvanasco](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jvanasco/32/55900_2.png) [@jvanasco](https://community.letsencrypt.org/u/jvanasco)\
**Post date:** [July 22, 2021, 4:34pm UTC](https://community.letsencrypt.org/t/just-one-acme-challenge-value-for-all-domains-in-same-dns-validation/156231/2 "2021-07-22T16:34:52Z")

</div>

I am not addressing any security implications in the following:

LetsEncrypt currently reuses non-triggered authorizations across account orders as a resource optimization. To get the flow you want, Boulder would either have to expire all non-triggered authorizations and no longer have the re-use optimization, or there would be a potential mixture of validations that would be a constant source of complaints and confusion. Because of that, I don't realistically see this feature implemented.

For your situation, I suggest using acme-dns. After setting up an acme-dns server, you can create an account for each of the 13 domains and update the main DNS once to delegate their \_acme-challenge to a specific acme-dns account. A certbot plugin will handle automating the DNS challenge updates when you obtain and renew certificates. You will only update the main DNS records once - everything else happens on acme-dns and automatically.

---

<div class="post-metadata">

**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\
**Post date:** [July 22, 2021, 6:23pm UTC](https://community.letsencrypt.org/t/just-one-acme-challenge-value-for-all-domains-in-same-dns-validation/156231/3 "2021-07-22T18:23:15Z")

</div>

> [@kongen](#):
>
> (…) except certbot only can handle 10 \_acme-challenge values on the same domain.

How do you mean? I'm not aware of any limitation of 10 for the DNS challenges in certbot.

> [@kongen](#):
>
> If I didn't use the template I should insert the 26 values in 13 different DNS records. There is a high risk for cut/paste errors.

Let's Encrypt strongly promotes **automation** for their service, which also applies to certbot. With DNS this _can_ be tricky, as not every DNS provider has an API to automate the DNS challenge. But as @jvanasco already pointed out there are solutions for this.

---

<div class="post-metadata">

**Author:** ![danb35](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/danb35/32/70869_2.png) [@danb35](https://community.letsencrypt.org/u/danb35)\
**Post date:** [July 22, 2021, 6:45pm UTC](https://community.letsencrypt.org/t/just-one-acme-challenge-value-for-all-domains-in-same-dns-validation/156231/4 "2021-07-22T18:45:46Z")

</div>

> [@Osiris](#):
>
> I'm not aware of any limitation of 10 for the DNS challenges in certbot.

See also:

> [@Max 10 domains in DNS verification](https://community.letsencrypt.org/t/max-10-domains-in-dns-verification/156172):
>
> P…

---

<div class="post-metadata">

**Author:** ![kongen](https://avatars.discourse-cdn.com/v4/letter/k/b487fb/32.png) [@kongen](https://community.letsencrypt.org/u/kongen)\
**Post date:** [July 23, 2021, 7:41am UTC](https://community.letsencrypt.org/t/just-one-acme-challenge-value-for-all-domains-in-same-dns-validation/156231/5 "2021-07-23T07:41:05Z")

</div>

> [@Osiris](#):
>
> How do you mean? I'm not aware of any limitation of 10 for the DNS challenges in certbot.

When using the DNS template all the DNS validation TXT values are put into the same place resulting in a lookop like this for one of the 13 domains:

 ![image](https://global.discourse-cdn.com/letsencrypt/original/3X/7/e/7e1b6c36f27d6720ceec0b6d2ce51f4b05480189.png)

Here is only 10 because I split it up to make it work. If there are more than 10 certbot will give this output:  
Domain: odds-on.dk  
Type: unauthorized  
Detail: Incorrect TXT record  
"cO5tDqemdlCNTmmLvgyk-CU4hVdQNuPPQj3\_fWa3-CQ" **(and 9 more)** found at  
\_acme-challenge.odds-on.dk

So there is a maximum of 10 \_acme-challenge values in one DNS lookup in certbot.

---

<div class="post-metadata">

**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\
**Post date:** [July 23, 2021, 7:44am UTC](https://community.letsencrypt.org/t/just-one-acme-challenge-value-for-all-domains-in-same-dns-validation/156231/6 "2021-07-23T07:44:34Z")

</div>

> [@kongen](#):
>
> So there is a maximum of 10 \_acme-challenge values in one DNS lookup in certbot.

I think that's not correct: the error you've shown with the "and 9 more" text is produced by the Let's Encrypt validation server and not certbot. Certbot is just showing you the error from the validation server, but does not generate it.  
And the Let's Encrypt validation server just tells you what it found when it queried for the TXT records: it found 10 TXT records.  
Therefore, I'm stil enclined to think it has something to do with your DNS provider: the screenshot you're showing also shows **just 10 TXT records** and _not_ 13.

Also, I've shown [in your other thread about the max. 10 issue](https://community.letsencrypt.org/t/max-10-domains-in-dns-verification/156172/4) certbot works perfectly with 20 DNS challenges 😉

My suggestion to you is to try to automate the DNS challenge somehow as stated earlier and not to try to add the TXT records manually for two reasons:

- I think your DNS service provider is the issue here, automation through e.g. acme-dns might resolve this issue;
- renewing so much DNS challenges every 60 days is very cumbersome, so automation is also in your own best interest 😉

Also, I'm very puzzled: why would there be a need for 10+ TXT records **for the same hostname**? (Earlier I missed that it all were records for the exact same hostname..) Usually, this is maxed to just **two** similar hostnames:

- One for the "bare" apex domain `example.com`;
- and one for the wildcard `*.example.com`.

I don't see the need for more than two TXT records for the same hostname.

---

<div class="post-metadata">

**Author:** ![kongen](https://avatars.discourse-cdn.com/v4/letter/k/b487fb/32.png) [@kongen](https://community.letsencrypt.org/u/kongen)\
**Post date:** [July 23, 2021, 7:57am UTC](https://community.letsencrypt.org/t/just-one-acme-challenge-value-for-all-domains-in-same-dns-validation/156231/7 "2021-07-23T07:57:28Z")

</div>

> [@Osiris](#):
>
> the screenshot you're showing also shows **just 10 TXT records** and _not_ 13.

As I mentioned there are only 10 in the image. To make it work I split the DNS template into two.. you can see the remaining 3 here.

 ![image](https://global.discourse-cdn.com/letsencrypt/original/3X/d/a/da562110333f15753bf960f965f67271097db602.png)

Now everything works. Except I have to maintain two DNS templates. And I still think a single value for all 13 would be nice 😉

It could be a validation error from the server and not the certbot client... the result is the same for me 🙂

---

<div class="post-metadata">

**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\
**Post date:** [July 23, 2021, 8:00am UTC](https://community.letsencrypt.org/t/just-one-acme-challenge-value-for-all-domains-in-same-dns-validation/156231/8 "2021-07-23T08:00:33Z")

</div>

> [@kongen](#):
>
> And I still think a single value for all 13 would be nice 😉

I'm still puzzled why you would need 13 values for _exactly the same hostname_? It should only be two TXT records max. per (sub)domain (not counting the wildcard, as that's included in the 'two' here).

> [@kongen](#):
>
> It could be a validation error from the server and not the certbot client... the result is the same for me 🙂

If it's a bug in the client, we can try to bughunt it and try to fix it 😉 But if it's an issue on the Let's Encrypt validation side, that's way more difficult. That's why I like the distinction 🙂

Maybe you could present us with the entire certbot command and entire certbot output?

---

<div class="post-metadata">

**Author:** ![kongen](https://avatars.discourse-cdn.com/v4/letter/k/b487fb/32.png) [@kongen](https://community.letsencrypt.org/u/kongen)\
**Post date:** [July 23, 2021, 8:01am UTC](https://community.letsencrypt.org/t/just-one-acme-challenge-value-for-all-domains-in-same-dns-validation/156231/9 "2021-07-23T08:01:39Z")

</div>

> [@Osiris](#):
>
> Also, I'm very puzzled: why would there be a need for 10+ TXT records **for the same hostname**?

Because it is a DNS **template** where each TXT record looks somewhat like this:

 ![image](https://global.discourse-cdn.com/letsencrypt/original/3X/6/e/6e73715eb51ff08b8accda9dee755b962e66d99b.png)

Each domain attached to the template will get all the TXT records in the DNS lookup.  
And yes it would be nice if the DNS provider could make dedicated TXT records.

---

<div class="post-metadata">

**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\
**Post date:** [July 23, 2021, 8:07am UTC](https://community.letsencrypt.org/t/just-one-acme-challenge-value-for-all-domains-in-same-dns-validation/156231/10 "2021-07-23T08:07:47Z")

</div>

Aha, I see. I think. I'm not very familiar with "DNS templates" unfortunately, but as I'm understanding you correctly, it goes something like this:

- You're requesting a wildcard certificate for 13 domains, which are in effect 26 domains, 13x the apex domain and 13x the wildcard "sub"domain;
- Certbot is requesting you to add 26 `_acme-challenge` TXT records, 2 for every domain (one for the apex, one for the wildcard), lets call them challenges A through Z for hostnames 1 to 13;
- Your DNS service providers zone editor only lets you add TXT records through a "template";
- If you add TXT record A for hostname 1 the template will not only add the TXT record for hostname 1, but also to hostnames 2 through 13;
- If you add TXT record C for hostname 2, that TXT record will also end up at the hostnames 1 and 3 through 13?

Am I getting this right?

---

<div class="post-metadata">

**Author:** ![kongen](https://avatars.discourse-cdn.com/v4/letter/k/b487fb/32.png) [@kongen](https://community.letsencrypt.org/u/kongen)\
**Post date:** [July 23, 2021, 8:08am UTC](https://community.letsencrypt.org/t/just-one-acme-challenge-value-for-all-domains-in-same-dns-validation/156231/11 "2021-07-23T08:08:01Z")

</div>

> [@Osiris](#):
>
> Maybe you could present us with the entire certbot command and entire certbot output?

**command:**

```nohighlight
:/home/dell# certbot certonly --manual --preferred-challenges=dns
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator manual, Installer None
Please enter in your domain name(s) (comma and/or space separated) (Enter 'c'
to cancel): ezida.dk cybersite.dk furehus.dk guilds.dk kofod.me odds-on.dk oddsetligaen.dk periconsult.com periconsult.dk ring.gl same-game.dk samegame.dk xn--sbakken2800-ggb.dk
Obtaining a new certificate
Performing the following challenges:
dns-01 challenge for cybersite.dk
dns-01 challenge for ezida.dk
dns-01 challenge for furehus.dk
dns-01 challenge for guilds.dk
dns-01 challenge for kofod.me
dns-01 challenge for odds-on.dk
dns-01 challenge for oddsetligaen.dk
dns-01 challenge for periconsult.com
dns-01 challenge for periconsult.dk
dns-01 challenge for ring.gl
dns-01 challenge for same-game.dk
dns-01 challenge for samegame.dk
dns-01 challenge for xn--sbakken2800-ggb.dk
....

```

**output:**

```nohighlight
Cleaning up challenges
Failed authorization procedure. samegame.dk (dns-01): urn:ietf:params:acme:error:unauthorized :: The client lacks sufficient authorization :: Incorrect TXT record "37aetltdGOaYf77iA0KmHnJoiaJeKLk5HMjdrmpPmZc" (and 9 more) found at _acme-challenge.samegame.dk, xn--sbakken2800-ggb.dk (dns-01): urn:ietf:params:acme:error:unauthorized :: The client lacks sufficient authorization :: Incorrect TXT record "k5r9RBAIotXUvS5ySVL9owGK8_zZdm9j0CHAZKOqgBY" (and 9 more) found at _acme-challenge.xn--sbakken2800-ggb.dk

IMPORTANT NOTES:
 - The following errors were reported by the server:

   Domain: samegame.dk
   Type: unauthorized
   Detail: Incorrect TXT record
   "37aetltdGOaYf77iA0KmHnJoiaJeKLk5HMjdrmpPmZc" (and 9 more) found at
   _acme-challenge.samegame.dk

   Domain: xn--sbakken2800-ggb.dk
   Type: unauthorized
   Detail: Incorrect TXT record
   "k5r9RBAIotXUvS5ySVL9owGK8_zZdm9j0CHAZKOqgBY" (and 9 more) found at
   _acme-challenge.xn--sbakken2800-ggb.dk

   To fix these errors, please make sure that your domain name was
   entered correctly and the DNS A/AAAA record(s) for that domain
   contain(s) the right IP address.

```

---

<div class="post-metadata">

**Author:** ![kongen](https://avatars.discourse-cdn.com/v4/letter/k/b487fb/32.png) [@kongen](https://community.letsencrypt.org/u/kongen)\
**Post date:** [July 23, 2021, 8:14am UTC](https://community.letsencrypt.org/t/just-one-acme-challenge-value-for-all-domains-in-same-dns-validation/156231/12 "2021-07-23T08:14:32Z")

</div>

yes, all TXT records is applied to every domain attached to the DNS template, and somewhere there is a limit of 10 in the validation process.

I could stop using the template and just have normal DNS setup for each domain, but I really like only having to maintain the template.

---

<div class="post-metadata">

**Author:** ![kongen](https://avatars.discourse-cdn.com/v4/letter/k/b487fb/32.png) [@kongen](https://community.letsencrypt.org/u/kongen)\
**Post date:** [July 23, 2021, 8:37am UTC](https://community.letsencrypt.org/t/just-one-acme-challenge-value-for-all-domains-in-same-dns-validation/156231/13 "2021-07-23T08:37:07Z")

</div>

Solving the problem with the maximum of 10 TXT records in one DNS lookup would be nice but a bit off topic.

I just think it would make sense to have a single validation value, and not 26+ different values, for a single validation request. It is a lot of work with high risk of errors, to get it validated. It would be a lot easier if the same value could be reused on all 26 domains, using a DNS template or not.

---

<div class="post-metadata">

**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\
**Post date:** [July 23, 2021, 8:42am UTC](https://community.letsencrypt.org/t/just-one-acme-challenge-value-for-all-domains-in-same-dns-validation/156231/14 "2021-07-23T08:42:08Z")

</div>

> [@kongen](#):
>
> I just think it would make sense to have a single validation value, and not 26+ different values, for a single validation request.

If you're doing a request for X wildcard hostnames, including the apex domain, you'll have to deal with X\*2 amount of TXT records. That's not a choice of Let's Encrypt, but mandated by the CA/Browser Forum baseline requirements, the rules to which every CA and browser have to adhere.

It wouldn't make much sense to allow you to get a certificate for `example.com` when you only succesfully proved ownership over `example.net`: you'll need to prove ownership of all domains.

---

<div class="post-metadata">

**Author:** ![kongen](https://avatars.discourse-cdn.com/v4/letter/k/b487fb/32.png) [@kongen](https://community.letsencrypt.org/u/kongen)\
**Post date:** [July 23, 2021, 9:22am UTC](https://community.letsencrypt.org/t/just-one-acme-challenge-value-for-all-domains-in-same-dns-validation/156231/15 "2021-07-23T09:22:16Z")

</div>

> [@Osiris](#):
>
> you'll need to prove ownership of all domains

Sure, but I can't see it makes any difference if you prove it with one and the same key value for all 13 domains. If you have access to put the key into all 13 then the value of the key doesn't really matter.

---

<div class="post-metadata">

**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\
**Post date:** [July 23, 2021, 9:23am UTC](https://community.letsencrypt.org/t/just-one-acme-challenge-value-for-all-domains-in-same-dns-validation/156231/16 "2021-07-23T09:23:13Z")

</div>

> [@kongen](#):
>
> Sure, but I can't see it makes any difference if you prove it with one and the same key value for all 13 domains.

Every single domain requires a random token, so re-using a token for multiple domains is not allowed either. That's just the rules I'm afraid.

---

<div class="post-metadata">

**Author:** ![kongen](https://avatars.discourse-cdn.com/v4/letter/k/b487fb/32.png) [@kongen](https://community.letsencrypt.org/u/kongen)\
**Post date:** [July 23, 2021, 9:27am UTC](https://community.letsencrypt.org/t/just-one-acme-challenge-value-for-all-domains-in-same-dns-validation/156231/17 "2021-07-23T09:27:12Z")

</div>

Exactly it just a rule, that doesn't do much except making the validation more complex 🙂 The random token would work just as well for all 13 domains.

Adding more domains would of cause need a new random token. But in the exact validation process it should not make a difference.

---

<div class="post-metadata">

**Author:** ![webprofusion](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/webprofusion/32/85310_2.png) [@webprofusion](https://community.letsencrypt.org/u/webprofusion)\
**Post date:** [July 23, 2021, 9:29am UTC](https://community.letsencrypt.org/t/just-one-acme-challenge-value-for-all-domains-in-same-dns-validation/156231/18 "2021-07-23T09:29:09Z")

</div>

I think you are creating a CNAME to a shared TXT record, then stuffing that TXT record with all the challenge response values you need, then hitting a limit on how many values your DNS provider supports. If this isn't automated this would be very difficult to manage for all your renewals.

acme-dns is a good solution for this and is automated once you setup the initial CNAMEs for each domain. If not hosting it yourself, see also Certify DNS ([certifydns | Certify The Web Docs](https://docs.certifytheweb.com/docs/dns/providers/certifydns)) which does the same thing. There are security caveats to not hosting your own service however (as noted in the docs).

Some acme clients also support using an alias domain (so updates can be automated against a surrogate domain which supports API automation, and instead of updating `_acme-challenge.yourdomain.com` it updates `_acme-challenge.yourdomain.com.myotherdomain.com`). This means you don't need an acme-dns style service but your primary domains just need to support a CNAME pointing to your automated DNS records.

---

<div class="post-metadata">

**Author:** ![kongen](https://avatars.discourse-cdn.com/v4/letter/k/b487fb/32.png) [@kongen](https://community.letsencrypt.org/u/kongen)\
**Post date:** [July 23, 2021, 9:52am UTC](https://community.letsencrypt.org/t/just-one-acme-challenge-value-for-all-domains-in-same-dns-validation/156231/19 "2021-07-23T09:52:08Z")

</div>

The option --single-validation-token would be nice :), but I guess there is no real chance of having a single validation token for a single validation process.

It is just hassel having to update 26+ different validation tokens in DNS for a new certificate. Having a single random token value would make it easier and less prone for errors, and it would still prove you have update access to the DNS.

There is actually a acme-dns plugin for my DNS provider, so I think I will try that out.

---

<div class="post-metadata">

**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\
**Post date:** [July 23, 2021, 10:21am UTC](https://community.letsencrypt.org/t/just-one-acme-challenge-value-for-all-domains-in-same-dns-validation/156231/20 "2021-07-23T10:21:55Z")

</div>

> [@kongen](#):
>
> The option --single-validation-token would be nice :), but I guess there is no real chance of having a single validation token for a single validation process.

You'd probably have to convince the entire CA/Browser forum for that to happen I'm afraid.

[Next page](https://community.letsencrypt.org/t/just-one-acme-challenge-value-for-all-domains-in-same-dns-validation/156231.md?page=2)