• Elvith Ma'for@feddit.org
    link
    fedilink
    arrow-up
    1
    ·
    2 days ago

    The DNS provider needs to provide an API, but not an ACME server.

    Your server contacts Lets Encrypt and wants a certificate - say for homeserver.example.com. It tells Let’s Encrypt to use DNS based authentication. Let’s encrypt answers with a challenge code, that you now publish as a txt record with a defined name via your providers API for this (sub)domain. Let’s encrypt then checks the TXT record and if it finds the challenge there, it sends you the certificate.

    • Rob Bos@lemmy.ca
      link
      fedilink
      English
      arrow-up
      1
      ·
      edit-2
      4 hours ago

      Wouldn’t the authentication API provided by your DNS host be the ACME server?