Hi, I created some certificates the dns-01 challenges. But when I renew the certificate, the value for the DNS TXT record is updated. Is this normal? I have +20 certificates and updating all these TXT records is not that easy :frowning: Stef

[image] StefCoene: the value for the DNS TXT record is updated. Is this normal? Yes, it's perfectly normal. [image] StefCoene: I have +20 certificates and updating all these TXT records is not that easy That's why DNS validation is really only practical if your DNS host has an API th…

Our main DNS provider has an API, but I also maintain the certificates for a few domains that I don’t manage myself :frowning: The sites itself are for internal use only so I can only use the DNS challenge. I suppose I can not force the value of the TXT record to be the same for a renew? Stef

[image] StefCoene: I suppose I can not force the value of the TXT record to be the same for a renew? No, that would defeat the purpose of the validation.

We are going to create sub-domain for certificates and host a public DNS server that holds the required TXT records. For the few domains we don’t control the domains we are either going to buy a certificates or renew it manually. Stef

Personally I think it’s much easier to ask for those domain owners to create the txt record. (As it would save time and money) so you could automated the process. (What I did is, switch a domain deal with all auth and report to an api-supported DNS provider, map all domains I need to control under …

Hi @StefCoene , [image] StefCoene: For the few domains we don’t control the domains we are either going to buy a certificates or renew it manually. For those domains you don't control, you can ask the owner to create a CNAME record pointing to a domain you control so you could automate the pr…

I have around 50 certificates for internal hosted websites for which I control the domain. Updating 50 TXT records every 3 months via API or hosting a DNS server I control? I prefer the DNS server (bind + some 20 lines perl magic) :slight_smile: 1 or 2 websites also need an extra domain that I don…

[image] sahsanu: _acme-challenge.external.tld IN CNAME external.tld.own.tld _acme-challenge.www.external.tld IN CNAME www.external.tld.own.tld _acme-challenge.admin.external.tld IN CNAME admin.external.tld.own.tld this seems unnecessary, you could just add all txt records to the same cname …

Hi @jacobdevans , [image] jacobdevans: _acme-challenge.external.tld IN CNAME external.tld.own.tld _acme-challenge.www.external.tld IN CNAME www.external.tld.own.tld _acme-challenge.admin.external.tld IN CNAME admin.external.tld.own.tld this seems unnecessary, you could just add all txt record…

Renew using dns-01 challenge

Help

jmorahan February 19, 2018, 10:11pm 5

If you can create a CNAME record pointing to your main DNS provider, you might be able to use the method described here:

Topic		Replies	Views
Renewing certificates with dns01 challenge Help	3	678	June 5, 2020
DNS Validation - How long valid for? Renewals requiring TXT record change Help	3	6267	May 20, 2018
How renew works with dns-01 challenge? Issuance Tech	2	3595	May 24, 2016
Clarification needed on how TXT record verification works when renewing a certificate generated via dns challenge Help	12	2737	July 24, 2019
Quick question about DNS challenges Issuance Policy	7	2421	February 6, 2017

Renew using dns-01 challenge

Related topics