Shouldn't verification via DNS record be a priority?

Do you have a rough idea of what additional development will be required? Is this something where significant work has to be done, or are there just a few small missing pieces? Main reason I ask is that supporting pure-DNS validation opens up a whole range of use cases for LetsEncrypt certificates for internal servers that couldn’t ever reasonably be made directly accessible - but their names could trivially be made visible to public dns.

Obviously this is isn’t the primary use case - but I think you’ll find that there will be large numbers of people that would make use of these certificates for internal services that wouldn’t otherwise be able to use them - for internal test servers, networking infrastructure, management endpoints, etc.

In my case, I’d set up a special intermediate server that internal authenticated users could use - and would have that server perform all the interactions with LE, including updating DNS for validations.

5 Likes