When performing domain validation, will the Let’s Encrypt backend support querying servers over IPv6?

Hi, i can see that there are many bad feelings in using an tunnel. But there would be two challenges that can circumvent the problem because even if the host is IPv6 they does not require an IPv6 connection: proofOfPossession-01 := here we would check that the client have the private key of an curr…

[image] tlussnig: dns-01 := here we can combine it with DNS-SEC if necessary and it work as long as there is not an IPv6 only DNS server. That's completely correct. The resolvers in use by Let's Encrypt fully support DNSSEC today, as well. Once the DNS challenge is enabled, that'll work fine…

the only problem is that DNSSec isnt widely supported, both by DNS (creation) Servers, aka those where you can manage your records, and by registrars, because you need both. cloudflare started DNSSecing some days ago but my registrar ( edis.at ) doesnt do DNSSec yet, but seems they plan it for q1 201…

I agree. DNSSec support during validation will still leave many people with IPv6-only hosts unable to validate, and will disproportionately affect those using budget providers (often they’re the ones offering IPv6-only) or with less technical skill/understanding.

@gary well I would say support of DNSSec would be great, BUT requiring is is another thing. but maybe LE should check normal DNS more thoroughly, like checking multiple different DNS Servers or similar stuff.

[image] My1: the only problem is that DNSSec isnt widely supported, both by DNS (creation) Servers, aka those where you can manage your records, and by registrars, because you need both. indeed both my domain/dns managers don't support DNSSec - using dnsmadeeasy and amazon route53 (geo/latenc…

Yes, I meant DNSSec in lieu of proper IPv6 support would be a poor workaround, but DNSSec support for the sake of itself would be a terrific innovation, and very future proof. For anyone looking for a DNS provider that supports DNSSec, I’d point you to Gandi.net , who are well respected in the commu…

unfortunately for moving dns management would be harder as i use geodns/latency based dns records for 18 servers spread around the several countries - would be a pain to move from Amazon Route53 heh

I totally understand, you’re one of those cases where DNSSec doesn’t solve the lack of IPv6-only validation :sob: In case we end up with DNSSec validation before IPv6-only, Gandi is an option for those who are already on Gandi or are shopping for a new registrar or DNS service.

Support for IPv6-only hosts

Issuance Tech

tlussnig November 17, 2015, 1:38pm 27

Possible would also to have the List of Root-DNS servers and do an DNS Lookup from Scratch and Cache only the TLD NS-Records for the Specified TTL.

Topic		Replies	Views
403 Forbidden when trying to generate new LetsEncrypt cert Help	9	4542	November 30, 2020
Server with IPv6 AAAA record only Help	20	7630	March 11, 2021
Problems validating IPv6 against host running 6to4 Help	10	3583	August 1, 2016
Unable to request cert due to IPv6 issue Help	11	800	April 6, 2021
HTTP validation failures due to timeout (IPv6 issues maybe?) Client dev	15	3449	August 3, 2017

Support for IPv6-only hosts

Related topics