**beep ** bop.

  • 0 Posts
  • 18 Comments
Joined 1 year ago
cake
Cake day: July 1st, 2023

help-circle





  • Updates to DNS, yes. Not necessarily to your primary zone. In other words, you don’t need access to the name servers for your highly privileged example.com zone, only the nameservers for inconsequential.example.com. With the challenge delegation you can easily narrow the scope by CNAMEing the relevant _acme-challenge enries in your primary domain once. This not only removes the need for the validator to modify your primary zone, but also scopes what subdomains it can validate, too. So the blast radius decreases.

    I, too, maintain several devices that insist on having the certificates (and keys, yuck) being fed to them by hand. I automated it all, because I don’t see why a human should be in a loop of copying the secret material. Automaton is good.









  • It was my first introduction to the type-length-value concept over the network, seemed radically different from the text only IRC protocol that I knew back then. I remember how fun it was to write an elegant parser for the ICQ messaging, and how I ended up on somewhat a DOM model where I converted the on-wire format into series of nested objects. Not the most efficient idea, but it was neat.