Support for DNS-ACCOUNT-01 along with DNS-PERSIST-01

Issuance Tech
1

Following up on the DNS-PERSIST-01 blog article published on the 18th, would it be possible to also consider adding support for DNS-ACCOUNT-01?

Here is the internet draft RFC for DNS-ACCOUNT-01. draft-ietf-acme-dns-account-label-02

Google Trust Services already supports DNS-ACCOUNT-01.
See: Google Trust Services | Updates.

This Fastly blog article explains the need for DNS-ACCOUNT-01 even with DNS-PERSIST-01 existing as an option. A Smarter ACME Challenge for a Multi-CDN World | Fastly

Looks like Fastly has already contributed the code to add support in boulder upstream. GitHub - fastly/boulder at add-dns-account-01

3

Let's Encrypt can only offer challanges that are allowed in the CA/Browser Baseline Requirements. Has there been a ballot that voted for dns-account-01 and did it pass?

1 Like
4

I didn't see any comparison of dns-persist with dns-account in that blog.

Wouldn't dns-persist give the multi-provider situation the same benefit? Instead of using a unique CNAME they have their own dns-persist record. In both cases these are tied to ACME account ID so there is no difference there.

With dns-persist there is no need to dynamically add/delete TXT records so the need to redirect requests to a DNS system the provider can modify isn't needed.

For example

_validation-persist.example.com. IN TXT (
  "letsencrypt.org;"
  " accounturi=https://acme-v02.api.letsencrypt.org/acme/acct/(Fastly_ID)"
)
_validation-persist.example.com. IN TXT (
  "letsencrypt.org;"
  " accounturi=https://acme-v02.api.letsencrypt.org/acme/acct/(SERVICE2_ID)"
)

The controller of the persist DNS records can further set expiration periods. That could align with contract terms, for example.

3 Likes
5

The dns-account-01 validation method is allowed in the BRs per Ballot SC-084 "DNS Labeled with ACME Account ID Validation Method". It is also implemented in Boulder, thanks to contributions from our friends at Certainly.

You're correct that dns-persist-01 largely obviates the need for dns-account-01, as both methods allow records for multiple ACME providers to coexist.

We have not made any public statements about whether or when we plan to enable dns-account-01 validation.

5 Likes
6

Oh wow.. The CA/Browser Forum really added some new stuff I didn't know about then :eyes:

1 Like