<!DOCTYPE html>
<html>
<head>
<title></title>
<style type="text/css">p.MsoNormal,p.MsoNoSpacing{margin:0}</style>
</head>
<body><div>On Fri, 7 Dec 2018, at 10:50 AM, Felix von Perger wrote:<br></div>
<blockquote type="cite"><p><br></p><ul><li>Attempted to migrate AD domain controller host certificates on
samson<br></li><ul><li>Using certbot and custom scripts calling samba-tool to
manually update a TXT record for
_acme-challenge.ad.ucc.gu.uwa.edu.au<br></li><li>In order to allow acme to issue a wildcard certificate for
*.ad.ucc.gu.uwa.edu.au, the TXT record must be resolvable
externally;<br></li><ul><li>Done by setting allow-recursion {any;} in
mooneye:/etc/bind/named.conf.options<br></li><li>There doesn't seem to be a way to have more fine-grained
access control to recursion/forwarding queries to forward
zones while using bind, so this seems like the only option
that would work<br></li><li>It also means that anyone can ask mooneye to do DNS
lookups for any domain. Is this a bad thing?!<br></li></ul><li>It may be possible to request certificates using HTTP port
80 as the proof of ownership mechanism - however we cannot
generate wildcard certificates this way.<br></li><ul><li>Nothing else listens on port 80 on AD DCs<br></li><li>samson.ad.ucc.gu.uwa.edu.au still needs to be externally
resolvable - which can only be done in our current software
configuration by allow-recursion {any;}<br></li></ul></ul></ul></blockquote><div><div><br></div>
<div><br></div>
<div>Can you use have the CNAME method for pointing the _acme_challenge elsewhere so you don't have to have recursion turned on?<br></div>
<div><br></div>
</div>
<div><a href="https://www.eff.org/deeplinks/2018/02/technical-deep-dive-securing-automation-acme-dns-challenge-validation">https://www.eff.org/deeplinks/2018/02/technical-deep-dive-securing-automation-acme-dns-challenge-validation</a><br></div>
<div><br></div>
<div><a href="http://strugglers.net/~andy/blog/2018/03/19/lets-encrypt-wildcard-certificates-acme-sh-and-automated-dns-verification/">http://strugglers.net/~andy/blog/2018/03/19/lets-encrypt-wildcard-certificates-acme-sh-and-automated-dns-verification/</a><br></div>
<div><br></div>
<div><br></div>
<div>Mark</div>
<div><div><div class="signature">--<br></div>
<div class="signature">Mark Tearle - mtearle@ucc.asn.au<br></div>
</div>
</div>
<div><br></div>
</body>
</html>