I'm trying to create a certificate for 13 domains on a mail server with no web server. Port 80 is directed to another server that I don't have direct access to. With wildcard certbot generates 26 _acme-challenge values that must be inserted into DNS. On my DNS service this shouldn't be a big prob…

I am not addressing any security implications in the following: LetsEncrypt currently reuses non-triggered authorizations across account orders as a resource optimization. To get the flow you want, Boulder would either have to expire all non-triggered authorizations and no longer have the re-use op…

[image] kongen: (…) except certbot only can handle 10 _acme-challenge values on the same domain. How do you mean? I'm not aware of any limitation of 10 for the DNS challenges in certbot. [image] kongen: If I didn't use the template I should insert the 26 values in 13 different DNS record…

[image] Osiris: I'm not aware of any limitation of 10 for the DNS challenges in certbot. See also: [image] Max 10 domains in DNS verification Help P…

[image] Osiris: How do you mean? I'm not aware of any limitation of 10 for the DNS challenges in certbot. When using the DNS template all the DNS validation TXT values are put into the same place resulting in a lookop like this for one of the 13 domains: [image] Here is only 10 because I s…

[image] kongen: So there is a maximum of 10 _acme-challenge values in one DNS lookup in certbot. I think that's not correct: the error you've shown with the "and 9 more" text is produced by the Let's Encrypt validation server and not certbot. Certbot is just showing you the error from the val…

[image] Osiris: the screenshot you're showing also shows just 10 TXT records and not 13. As I mentioned there are only 10 in the image. To make it work I split the DNS template into two.. you can see the remaining 3 here. [image] Now everything works. Except I have to maintain two DNS temp…

[image] kongen: And I still think a single value for all 13 would be nice :wink: I'm still puzzled why you would need 13 values for exactly the same hostname? It should only be two TXT records max. per (sub)domain (not counting the wildcard, as that's included in the 'two' here). [image] …

[image] Osiris: Also, I'm very puzzled: why would there be a need for 10+ TXT records for the same hostname ? Because it is a DNS template where each TXT record looks somewhat like this: [image] Each domain attached to the template will get all the TXT records in the DNS lookup. And yes i…

Aha, I see. I think. I'm not very familiar with "DNS templates" unfortunately, but as I'm understanding you correctly, it goes something like this: You're requesting a wildcard certificate for 13 domains, which are in effect 26 domains, 13x the apex domain and 13x the wildcard "sub"domain; Certbot…

[image] Osiris: Maybe you could present us with the entire certbot command and entire certbot output? command: :/home/dell# certbot certonly --manual --preferred-challenges=dns Saving debug log to /var/log/letsencrypt/letsencrypt.log Plugins selected: Authenticator manual, Installer None Ple…

Just one _acme-challenge value for all domains in same DNS validation

Feature Requests

danb35 July 22, 2021, 6:45pm 4

Topic		Replies	Views
Max 10 domains in DNS verification Help	16	1622	August 22, 2021
[Suggestion] Let's Encrypt operated, TXT-only DNS Hosting for DNS challenges Feature Requests	19	8828	February 14, 2018
Help me understand acme-dns Issuance Tech	24	21113	May 31, 2018
DNS TXT - I had insert the dns entries but don't spread fast enough - What to do? Help	28	3433	January 23, 2019
Cerbot api available? gen_validation, check_validation Feature Requests	10	824	March 5, 2021

Just one _acme-challenge value for all domains in same DNS validation

Related topics