ACME in depth · 18.6
DNS-01
With DNS-01, you prove control of a name through its public DNS zone (RFC 8555, section 8.4). It is the only challenge type for wildcard names.
- The CA gives TLSPilot a token for every name of the order.
- TLSPilot creates the TXT record
_acme-challenge.<name>with the DNS provider through its API, or you create it yourself with the manual DNS validation. The value is derived from the token and the key of the ACME account. - TLSPilot waits for the propagation. Then the CA queries the TXT record in the public DNS from several network perspectives, see chapter Multi-perspective validation.
- After the validation, TLSPilot deletes the TXT record at the DNS provider again.
Settings: chapters ACME certificate (AC) and Manual DNS validation. Errors and solutions: chapter DNS-01.
| Aspect | Details |
|---|---|
| Advantages | No inbound port is needed. Works for internal servers with a public DNS name and for any number of servers behind one name. |
| Limits | Requires API access to the DNS provider, or the manual DNS validation. All authoritative nameservers must deliver the record, and the propagation takes time. The DNS credential can change the zone, so restrict it to the required zone if the provider allows it. |
| Wildcards | Yes. For *.example.com, the record is _acme-challenge.example.com. |
In TLSPilot, you select DNS-01 on the tab Settings of an ACME certificate. The section DNS-01 settings lists the required TXT records and holds the DNS provider and the DNS credential with which TLSPilot writes them, see Figure DNS-01 settings of an ACME certificate.
