Re: [Acme] dns-01 challenge limitations

Simon Ser <> Sun, 13 September 2020 09:25 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id BB5643A0B92 for <>; Sun, 13 Sep 2020 02:25:08 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -2.098
X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (2048-bit key)
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id A-nxw-Cx5fZE for <>; Sun, 13 Sep 2020 02:25:06 -0700 (PDT)
Received: from ( []) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 551483A0B91 for <>; Sun, 13 Sep 2020 02:25:06 -0700 (PDT)
Date: Sun, 13 Sep 2020 09:24:57 +0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=protonmail2; t=1599989104; bh=XtX0pxP2b0l3cjcDHCC92a9zkvC+oHxcc5RqA98H5pw=; h=Date:To:From:Cc:Reply-To:Subject:In-Reply-To:References:From; b=MYwewRiVQT8e4/w9evc/C0CmmQPyNS6C0FiVAzd3b9cY92VKk8znPdKTsXWZjRtyX XWkJluoBGnyngnCloYqNpn0tZafdujgJB0BWhopEi/GJiuz0+f29MqlyIA3ret7ZFj 3o6RIBYONGc5iheuiy9/qEKjoQIqhPSE5MBuISPfOS1gfntPU2Q+EV3eHt0hSMyny+ bCpDQkwdjsPHZAHGFA30t2YVFQof/B3E9+TPoDZCJwGawyUaWZNrJBzkCIoyUHwG5b kSppuEi4gOkW2mM2n8PiIzfqZ+2nMAhABGUdNrpMwXz72r/D81VZEbO3SGdX/8D6wz csEb+hOoK5aSw==
To: Michael Richardson <>
From: Simon Ser <>
Cc: "acme\\" <>, "Matthew.Holt\\" <>
Reply-To: Simon Ser <>
Message-ID: <>
In-Reply-To: <28079.1599844001@localhost>
References: <> <28079.1599844001@localhost>
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
Archived-At: <>
Subject: Re: [Acme] dns-01 challenge limitations
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Automated Certificate Management Environment <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Sun, 13 Sep 2020 09:25:09 -0000

On Friday, September 11, 2020 7:06 PM, Michael Richardson <> wrote:

> Simon Ser <> wrote:
>     > dns-01 requires the ACME client to complete the challenge by updating a DNS
>     > record. This is bothersome because this often requires interacting with the
>     > DNS registry operator. This is typically done via vendor-specific APIs, with
>     > access control handled via vendor-specific means (tokens, public keys,
>     > etc).
> I guess if you've hosted your zone with the registrar, then that might be
> true.  my opinion: Don't do that.
> Host your own zone, and/or use Dynamic DNS update (RFC3007), which is mature technology.
> There are some annoyances with TSIG until you realize that the key name
> really matters.

That sounds like the most reasonable way to solve the dns-01 challenge indeed.
The self-hosted zome can even be limited to just _acme-challenge.

I'm still wondering whether dns-01 is an absolutely necessary evil (see other

>     > For instance, it would be possible to require users to add a short public key
>     > in a DNS TXT record, then ask the ACME client to sign challenges with that key.
>     > Something like this would significantly ease the development of ACME
>     > clients.
> So, this would be be a client key challenge.
> This would not be dns-01.  It could certainly work, but it would be a new effort.
> Maybe we could use SIG(0), I'm not sure.

Yes, this wouldn't be dns-01 or dns-02, it would be a completely separate

> The question would be whether or not it would get implemented.

Yes, this is why I'm writing to this mailing list. Maybe I should've CC'ed some
Let's Encrypt specific mailing list as well.

>     > Are there specific reasons why dns-01 requires updating a DNS record?
> Yes, because it proves you control the zone.

Right, but there could be other ways to prove this as well.