Re: [Acme] dns-01 challenge limitations

[Philipp Junghannß <[e-mail]>]

well Certificate transparency is one something should maybe keep
notifications for.

Also I can understand the problem, but I have not decided the outcome, I
merely stated what I got as an answer back then.

problem is obviously also the CA/Browser Forum has certain requirements,
and I guess having access to some kind of direct verification at the time
of issue might be probably one of these.

Am Fr., 11. Sept. 2020 um 15:21 Uhr schrieb Simon Ser <[e-mail]>:

> Hi,
>
> On Friday, September 11, 2020 3:13 PM, Philipp Junghannß <
> [e-mail]> wrote:
>
> > I have asked that question in the LE forum iirc the problem is that
> > someone could place that record once and as long as someone doesnt
> > look at it all the time one can easily miss the fact that someone can
> > create wildcards and stuff for that domain, so the point is to prove
> > that dns access is given at the time of issuance.
>
> If someone has once write access to the DNS, they can set an
> acme-challenge record, redirect all requests, and issue wildcard certs.
> That would be easy to miss, too.
>
> > you could maybe use a different DNS Server which has a better API,
> > and potentially even can be used by ACME.
>
> The issue at hand isn't that a particular DNS registry operator isn't
> supported by a particular ACME client. What I want to fix is the need
> for all ACME clients to support all DNS registry operators.
>
> Thanks,
>
> Simon
>