Reading through your docs, as I understood it, one will need a new DNS token on every renewal. As you point out perfectly well, storing an API key on the webserver is much too dangerous, especialy since my domain provider also allows tranfers and deletions of domain through it. This means I will hav…

Hi, welcome to the forum! The requirement to have a fresh token on each renewal comes from the Baseline Requirements . It’s there to make sure CAs are verifying an authorization that is “fresh” - that is, that the requester is still actively in control of the domain name. I realize it’s rather compli…

Why has DNS-01 to be such complicated?

Issuance Tech

tdelmas July 30, 2019, 10:07pm 2

A beginning of explanation: Do DNS Challenge Records have an expiration?

3 Likes

Topic		Replies	Views
[Suggestion] Let's Encrypt operated, TXT-only DNS Hosting for DNS challenges Feature Requests	19	8710	February 14, 2018
Other Authentication Methods Issuance Tech	37	3435	January 21, 2019
Shouldn't verification via DNS record be a priority? Issuance Tech	62	40564	August 25, 2016
Crypto-based challenge type, please? Feature Requests	17	1504	October 28, 2021
Identifier validation in certificate renewals Issuance Policy	26	428	December 22, 2024

Why has DNS-01 to be such complicated?

Related topics