Automated LetsEncrypt DNS-Based Challenges

JohnEDee · 2020-12-27T11:55:07+00:00

Is an automatic DNS challenge via DNS provider API anywhere on the radar? The current manual DNS challenge option is appreciated, but it's still a regular manual intervention. DNS challenges are the only way to do wildcard domain certs with LetsEncrypt, and for a site like mine that has a ton of subdomain sites all with the same domain, it would save a tremendous amount of time. It would be awesome to have the Abyss ACME client be able to interact with the larger DNS providers (AWS Route 53, MS Azure DNS, GoDaddy, etc) and be able to automatically create/change the DNS TXT record when necessary. I think that process/capability is described here, and many ACME clients can apparently do that, so the code should already be written and available. I think the way it would work is that for a given LetsEncrypt cert, I'd give the Abyss ACME-bot the credentials to be able to make changes to the "_acme-challenge" TXT record in my DNS, and as long as I'm using a capable provider, it would do the TXT record thing itself whenever the cert needs to be renewed. I understand that it may not be a huge priority, but hopefully it can be worked in at some point. Thanks!

aprelium-support

JohnEDee Since it's much simpler, do you think it might make it into Abyss sooner than later, to coincide with the LE rollout of the feature?

That's the plan if there are no issues with the staging platform from Let's Encrypt.

aprelium-support

JohnEDee BTW, the Insert emoji feature isn't working, it just comes up with regional_indicator_a through regional_indicator_g. Hence the giant icon image lol.

When the drop-down is shown, start writing "hand" or "wink" and the list will change to include the actual emojis based on the typed text.

Legacy1

Hi can't seem to make a post

IONOS now has ACME but I don't think Abyss Web Server supports the way they have done it can this be looked into please
https://www.ionos.co.uk/help/index.php?id=28229&utm_rid=2ff8141a-e18e-4ab7-aead-5f90f5d9e309

thanks

aprelium-support

Legacy1

IONOS is offering ACME but with External Account Binding (EAB.) So far, Abyss Web Server has always supported free certificates with no user account, as they are offered by Let's Encrypt.

EAB will soon be available when declaring an ACME account in Abyss Web Server. We plan to make it ready for the next release due within a few weeks.

Legacy1 Hi can't seem to make a post

Posts from new users are held for approval. Sometimes, this may take up to a working day until a human validates it.

Legacy1

thanks for your reply

Ok good to hear EAB will be supported

JohnEDee

Hey Aprelium folks, I just saw that LetsEncrypt is going to be reducing their cert lifetimes from 90 days to 45 days, sigh. But it's not a LetsEncrypt thing, the entire industry will be using certs that expire after 47 days maximum by 3/15/2029.

So I wanted to check in on this thread to see what the status of deploying the DNS-PERSIST01 challenge in Abyss....

The mention of EAB is interesting to me (I first thought it was off-topic but not so), as I see that my registrar (AWS Route53) supports EAB as well. So are you saying that in this next release, if DNS-PERSIST01 isn't in there, I can use this EAB protocol with my Route53 domain to accomplish the same thing, namely an automated renewal of my domain's wildcard cert in Abyss?

aprelium-support

JohnEDee But it's not a LetsEncrypt thing, the entire industry will be using certs that expire after 47 days maximum by 3/15/2029.

Until that date, many things can change. But the writing is on the wall: Let's Encrypt is even offering now 160-hour certificates https://letsencrypt.org/2026/01/15/6day-and-ip-general-availability .

The ACME support will evolve accordingly: EAB will be first and will be soon followed by DNS-PERSIST01.

By the way, IP based ACME certificates are already possible with our implementation.

« Previous Page