Apologies if this has already been discussed and I've forgotten! Based on the most recent blog article on the topic I think subdomains should match wildcard policy: [image] Wildcard Certificates - DNS-PERSIST-01: A New Model for DNS-based Challenge... When you request a certificate from…

For LE's implementation, you would need a _validation-persist.sub.example.com You could do it by instructing your server to serve the apex _validation-persist record when queried for _validation-persist.*.example.com (which would require a DNS server able to synthesize records based on wildcards or…

wfe/ra/va/pa: Add support for draft-ietf-acme-dns-persist-00 (#8660) committed 06:01PM - 23 Mar 26 UTC (UTC) [image] beautifulentropy +1747 -2…

Thanks folks, I know my users would dearly appreciate the option to just provide one TXT record so we'll see how it goes.

Same! I am hoping for this easy outcome too.

[image] RodimusPrime: You’re probably uncovering one of the early staging inconsistencies while the feature is still evolving. Yes, Aaron Gable of LE has said they have no plans to do tree climbing for these persist validations. (sry, don't have the post url handy) They are also looking to …

[image] RodimusPrime: What you’re seeing in staging is likely one of: incomplete implementation stricter-than-intended matching logic rollout behavior differing from the draft a current bug in Boulder staging No. It's an optional feature ("may"), and it is simply not implemented - see commi…

Subdomains with dns-persist-01 (staging)

Client dev

Bruce5051 May 29, 2026, 5:13pm 8

I believe it is this one Will Let's encrypt support tree climbing for dns-persist-01 records? - #6 by aarongable

Topic		Replies	Views
Will Let's encrypt support tree climbing for dns-persist-01 records? Issuance Policy	5	377	April 1, 2026
Dns-persist-01 wildcard authorisation depth Issuance Tech	6	499	February 26, 2026
DNS-01 validation- TLD and wildcard Issuance Tech	3	2530	October 10, 2018
Dns-01 vs. Wildcard certificates Issuance Policy	4	3691	May 30, 2016
Dns-persist-01 challenge Client dev	19	1035	March 3, 2026

Subdomains with dns-persist-01 (staging)

Related topics