mirror of
https://github.com/dehydrated-io/dehydrated.git
synced 2026-01-13 23:23:32 +01:00
deploy and validate one-by-one #543
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @Yannik on GitHub (Jul 16, 2021).
Hi,
currently, all challenges are deployed, and then all validations are done.
When using the same acme-dns CNAME for multiple subdomains, this breaks validation, because the first challenge token is overwritten by latter ones.
Therefore, I'd like to propose a change that for each domain, the challenge is deployed and then validated.
@lukas2511 commented on GitHub (Jul 16, 2021):
If acme-dns overrides arguments instead of appending new ones that is broken behavior in acme-dns and not really a dehydrated issue.
See https://github.com/dehydrated-io/dehydrated/blob/master/docs/troubleshooting.md#dns-invalid-challenge-since-dehydrated-060--why-are-dns-challenges-deployed-first-and-verified-later
@Yannik commented on GitHub (Jul 16, 2021):
Thanks, that link was helpful. I will have a look at what exactly acme-dns is doing that leads to this.
@Yannik commented on GitHub (Jul 16, 2021):
For reference, the amount of txt records is limited to 2 by acme-dns (source).
As a letsencrypt certificate can contain 100 domain names at most, upping this limit to 100 would support all usecases.
It would unfortunately also return old records.
Do you think this would be a reasonable change or is there a better alternative?
@lukas2511 commented on GitHub (Jul 16, 2021):
With basically all other DNS implementations the flow would be to deploy tokens (either one or many, doesn't really matter), let them validate, and remove them afterwards. If acme-dns simply replaces/rotates old entries then it just sounds broken to me.