Just one _acme-challenge value for all domains in same DNS validation

danb35 · July 23, 2021, 10:23am

Not in the sense that's being discussed here. If your DNS host has an API that certbot can use to automatically update entries, that's great--you really should be using it, and in that case your issue becomes moot.

But if not, what Osiris is recommending is acme-dns:

Which is designed for exactly this purpose.

Osiris · July 23, 2021, 10:28am

Also, the ACME client acme.sh has a DNS plugin for GratisDNS.dk:

github.com

acmesh-official/acme.sh/blob/master/dnsapi/dns_gdnsdk.sh

#!/usr/bin/env sh
#Author: Herman Sletteng
#Report Bugs here: https://github.com/loial/acme.sh
#
#
# Note, gratisdns requires a login first, so the script needs to handle
# temporary cookies. Since acme.sh _get/_post currently don't directly support
# cookies, I've defined wrapper functions _myget/_mypost to set the headers

GDNSDK_API="https://admin.gratisdns.com"
########  Public functions #####################
#Usage: dns_gdnsdk_add   _acme-challenge.www.domain.com   "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
dns_gdnsdk_add() {
  fulldomain=$1
  txtvalue=$2
  _info "Using gratisdns.dk"
  _debug fulldomain "$fulldomain"
  _debug txtvalue "$txtvalue"
  if ! _gratisdns_login; then
    _err "Login failed!"

This file has been truncated. show original

And also a "third party" DNS plugin for acme.sh for GratisDNS.dk exists:

github.com

zylopfa/acme.sh_dns_gratisdns/blob/master/dns_gratisdns.sh

#!/usr/bin/env sh

# Author: Peter Bryde <bryde at bryde dot it>
# Repository: https://github.com/zylopfa/acme.sh_dns_gratisdns
#
# Instructions:
#
#   gratisdns.dk is one of the biggest free dns providers in Denmark,
#   the have a control panel at: https://admin.gratisdns.com .
#   To create a txt record this module logs in to gratisdns checks if the root domain exist
#   and then create a txt record with the given content.
#   The same is the case when deleting a TXT record.
#   the delete function looks for the given txt content and delete the record with that content.
#
#   For regular cert for subdomain:
#     ./acme.sh --issue -d test.example.com --dns dns_gratisdns --dnssleep 660
#   For wildcard cert:
#     ./acme.sh --issue -d '*.example.com' --dns  dns_gratisdns --dnssleep 660
#
#   NB. we use a dnssleep timer of 660 seconds, so we are sure the record has been updated,

This file has been truncated. show original

It shouldn't be too hard to modify those scripts slightly to work as --manual-auth-hook and --manual-cleanup-hook scripts for the manual plugin. See User Guide — Certbot 1.16.0.dev0 documentation for more about those options.

jvanasco · July 23, 2021, 3:50pm

I want to stress that all the reasons your want this feature implemented are either due to:

an incredibly bad DNS server, or
incorrect usage of your DNS server

Your posts have increasingly made it clear that you are not using your DNS server correctly. You are implementing anti-patterns.

Populating the TXT records of every domain in the AcmeOrder with each and every domain's acme_challenge is an anti-pattern. This is creating unnecessary work for you, the DNS server, and LetsEncrypt's Boulder server that verifies challenges.

And a reminder that, aside from any security concerns, what you propose would ultimately create more problems for all users than solutions - as I mentioned above.

The limit of 10 appears to be the max number of TXT records that your DNS server allows, which is very reasonable. you are using an anti-pattern to manage DNS. You should not be updating all domains with the same TXT records. You should only be updating the actual affected domains with their specific TXT records.

system · August 22, 2021, 3:51pm

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Multiple challenges when requesting wildcard certificate for 3 domains Help	4	2625	August 22, 2018
Be clearer about the TXT record(s) for multiple domains Feature Requests	8	5721	January 12, 2020
One certificate for both base domain and its wildcard Help	4	2383	April 13, 2018
Letsencrypt not asking for DNS challenge with --manual Help	13	153	January 8, 2025
Wildcard certificate on multiple web servers using DNS TXT validation Help	10	5771	June 7, 2018

Just one _acme-challenge value for all domains in same DNS validation

Related topics