ietf draft's section 5 and 6 mentions persist record with policy=wildcard allows and nested subdomain, but nether pebble and boulder currently do that tree climbing check. so I expect they won't but I'd like to have explict word for this

We currently do not plan to do tree-climbing. We would prefer to have the client indicate to us which (parent) domain we should be looking at, confirm it is a valid ADN, and then check just that one location.

Will Let's encrypt support tree climbing for dns-persist-01 records?

Issuance Policy

dextercd March 30, 2026, 6:45pm 3

Links that may be of interest:

Dns-persist-01 wildcard authorisation depth - #2 by aarongable
Subdomain validation prompting · Issue #33 · ietf-wg-acme/draft-ietf-acme-dns-persist · GitHub

4 Likes

Topic		Replies	Views
Dns-persist-01 wildcard authorisation depth Issuance Tech	7	371	March 28, 2026
DNS-PERSIST-01 and _validation-persist CNAME Issuance Tech	3	216	April 7, 2026
Dns-persist-01 challenge Client dev	20	606	April 2, 2026
Support for DNS-ACCOUNT-01 along with DNS-PERSIST-01 Issuance Tech	5	300	March 26, 2026
Dns-persist-01 deployment status and timeline Issuance Tech	3	285	April 9, 2026

Will Let's encrypt support tree climbing for dns-persist-01 records?

Related topics