Hacker News

[dead]

> I've been hesitant to set that up because I'm concerned about the potential compromise of a token that has permissions to edit my DNS zone.

Depending on your DNS provider, it may be possible to narrow the permissions to allow only updates of a particular record. Route53 as an example:

      {
         "Effect": "Allow",
         "Action": "route53:ChangeResourceRecordSets",
         "Resource": "arn:aws:route53:::hostedzone/<ZONE-ID>",
         "Condition": {
            "ForAllValues:StringEquals": {
               "route53:ChangeResourceRecordSetsNormalizedRecordNames": "_acme-challenge.<SUB>.<DOMAIN>.<TLD>"
            }
         }
      }

BIND 9 example:

* https://dan.langille.org/2020/12/19/creating-a-very-specific...

You can also point the hostname that you wish to issues certs for to another (sub-)domain completely via a CNAME, and allow updates only for that other (sub-)domain:

* https://github.com/acmesh-official/acme.sh/wiki/DNS-alias-mo...

* https://www.eff.org/deeplinks/2018/02/technical-deep-dive-se...

DNS-PERSIST-01 is coming soon https://letsencrypt.org/2026/02/18/dns-persist-01

I used to have a separate Cloudflare account with a separate DNS Zone for my internal services. Because CF PATs were free-for-all. They've improved this since, so now you can create a token scoped to a single Zone. If you really care about, you can move a subdomain to a separate zone with a child NS record, but I haven't tried it with cloudflare. If you are using something like AWS, you can create an IAM role that can only update a single DNS record.

> Am I being too paranoid here? Or is there a better way to allow DNS challenges without a token that allows too much power in editing a DNS zone?

I'd look for a custom DNS challenge provider plugin which delegates the task of creating DNS records to another machine which holds the actual token.

There is a way to delegate the DNS challenges, but you can also create a dummy Caddysite for HTTP challenge (e.g., firewall.internal.example.com resolves externally to an IP that Caddy will respond to and get the certificate, and then said certificate is copied internally to whatever needs it).

There’s a way to direct dns challenges to a dns server just for the dns acme challenges: https://blog.bryanroessler.com/2019-02-09-automatic-certbot-...

No need to give broader access

In Q2 this year, so very soon, there will be the DNS PERSIST method, which is non rotating.

Let's Enpimp!

Perhaps I'm missing something but what's special about Cloudflare here?

You can use a boatload of providers for automated DNS-01.

Cloudflare is not the only DNS provider supported for DNS-01 challenges, even if you restrict yourself to only using Certbot: https://community.letsencrypt.org/t/dns-providers-who-easily...

I have not used Cloudflare for ages, but remember the Cloudflare API key couldn't be restricted to just one domain, so if someone could get hold of the key, they could have gotten access to all your domains. So that made me not use them. Has anything changed?

Some of this might have been "because I want to see if I can". Another reason is "It bothers me to keep seeing this browser tell me my connection is insecure".

As for putting it on a separate VLAN and securing traffic with firewall rules, that may be as much or more trouble than setting up the automated certificate renewal. At least with the automated certificates there may not be any further maintenance required. With firewall rules, you'll need to open up the firewall each time you want a new device to access the printer.

Because that only protects you from a small subset of possible threats that end-to-end encryption protects you from like DNS hijacking and any MITM-type scenario.

Sticking it on a VLAN only controls access, not data secrecy.

A VLAN buys you time, not trust. Give a printer its own seprate segment and six months later you've got ad hoc firewall exceptions for scans, updates, vendor support, and some test VM nobody remmebered to remove. TLS is boring, and that's the point: it fails closed, while network policy drifts until the weird exception becomes the default.