Hacker News Reader

Comment by BillinghamJ | Hacker News Reader

Another similar option would presumably be to delegate _acme-challenge.example.com to different nameservers with an NS record, then give your application the required privileges to control solely that nameserver.

View on HN

Yes. Or even to the same name server, breaking out each whole label starting with _acme-challenge as its own independent zone, with its own access policies.

Yes, but there’s no need to have separate zones; you can grant update access to subdomains and have the CNAMES point into one zone with a subdomain dedicated to each separate actor which needs access.

Like so: Assume that Actor 1 has example.com and example.net. You then add this to the example.com and example.net zones, respectively:

  _acme_challenge.example.com.  CNAME  example.com._.actor1._.your-special-domain.com.

  _acme_challenge.example.net.  CNAME  example.net._.actor1._.your-special-domain.com.

Then you give update access to Actor 1, but not to the whole “your-special-domain.com” zone, but to the “_.actor1._.your-special-domain.com” subdomain. The ACME system would then be configured to send updates to the correct subdomains of that subdomain. Or “your-special-domain.com” could even be a subdomain itself of another domain; it doesn’t matter.

Reply on news.ycombinator.com