Is there a way to turn off the dry run? #2
Loading…
Reference in New Issue
No description provided.
Delete Branch "%!s(<nil>)"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Is there any option to turn off the dry run (
_greenlock-dryrun-XXXX) in DNS-01?I'd like to understand why you want to turn off the dry run so that I can perhaps address the deeper concern and make it a general solution that benefits everyone.
What's the problem you're facing?
I am working on a service where I am serving http requests for user's domain. I wanted to secure these custom domains. I thought instead of getting the user to set 2 records I ask them to set a single
CNAMEof.acme-challenge.XXXXrecord pointing to my domain which would in turn have the acme challenge's string. This way I can myself verify the domain and then I can request the challenge and update in my DNS. With the dry run I would need to ask the user to update 2 dns records.I am pretty new to this ACME so sorry if the idea sounds stupid.
That won't work. You have to use TXT records.
Who is your DNS provider?
There are a bunch of dns providers so that you just need an API token and you don't have to have manual entry every 90 days:
https://git.rootprojects.org/root?q=acme-dns-01-&tab=&sort=recentupdate
Sorry, you got me wrong. I want to issue certificates for my user's domain by getting them to set DNS of their own domain. I thought there is a way to turn off the dry run as I couldn't see any dry run record to be set on https://greenlock.domains/ when I put my domain there. But I couldn't find an option to set it off.
If I understand right greenlock verifies the DNS ownership in the dry run itself so that we don't hit the LE's rate limits by requesting for actual certificates. I believe there should be an option to turn it off if the user of the greenlock library wants to implement this verification/dry-run manually.
I also found a
skipDryRunin the code of in acme.js or greenlock. So I thought maybe its an option.You don't need to use set DNS records for the HTTP-01 challenge, which is what you'd have to use if you're setting CNAMEs.
However, in v3, which I've already finished for the browser and will be backporting to node in August, I'll be exposing the DNS challenges different (which I had to do for browser support).
Oops, hit enter too early.
Are you using http-01 or dns-01?
If you're using dns-01, who is in control of the DNS? The user? Why not user http-01 for that?
Yes, I was wondering about that (greenlock in browser) when that when I saw requests to let's encrypt on my network tab.
The user would be in control of the DNS. I think I should be using http-01, I never really gave it a thought I always thought of using the dns-01.
Thanks
Yeah, the dryrun question comes up from time to time, but I don't answer directly because usually it's an indicator of "doing it wrong" / not understanding.
I'm glad that helped.