When using DNS challenge, do I have to rotate secrets every renewal?

[unique_user]

Hi all, I normally use HTTP challenge, but a customer has a question about a wildcard certificate.

I have never done this so I'm trying to make a plan.

The customer hosts his DNS somewhere else. I can ask him to create a DNS record to authenticate the parent domain.

But, my question is, will this DNS record remain valid forever? Or do they need to update the DNS record at every renewal (60 days)?

Thanks!

[mcpherrinm]

Yes, each time the DNS challenge changes. However, DNS challenges will follow CNAMEs.

So one good (and common) solution here is to have your customer add a _acme-challenge record as a CNAME to a DNS server which you do control and can then update when renewing certificates.

[unique_user]

Thank you! And the CNAME trick is very clever.

[mcpherrinm]

Here's a document with more information about "the CNAME trick":

Onboarding Your Customers with Let's Encrypt and ACME - Let's Encrypt