@richardsago said in acme certificate in DNS Resolver also?:
After setting up acme do I need to also change "Services" > "DNS Resolver" > "General Settings" > "SSL/TLS Certificate" from the default of webConfigurator to the new certificate?
Noop.
Some more or less related details first :
Your local (every) 'LAN' based traffic uses the default port 53, not 853.
You could use 853 port and thus "TLS DNS" if you don't trust the transmission over your LANs. after all, DNS traffic to port 53 is readable - not encrypted. If your neighbor is hacking into your LAN wires, or has your Wifi WPA3 password, he could 'see (sniff) your DNS requests ....
(if so, who is your neighbor ? I would be worried if your live in Langley, Virginia)
Also, a DNS client addresses itself to a DNS server using an IP addess, and deosn't have an host name. Think about it : if a DNS server is only known to the client with it's host address, you would need DNS to resolve that first, before doing the DNS request. => You dive straight into a chicken and egg problem.
The (my) main explanation :
The DNS resolver (a server) needs a certificate - any certificate - to initiate TLS transaction. If there was a SAN (host name) in it, it wouldn't be used.
After all, the client uses an IP, not a host name, to talk to the DNS server.
That's very different as a web browser that connects to a web server, where you, the human, uses a host name to start with. These have to be resolved first etc.
Remember : example : you visit : "forum.netgate.com". The web browser will first resolve "forum.netgate.com" - and it gets " 2610:160:11:11::6" back. Only now the browser can connects to this " 2610:160:11:11::6", and it will use 'https' = http over TLS. Port 443.
The 2610:160:11:11::6 web server ("forum.netgate.com") will get a certificate back to the browser.
This certificate contains :
[image: 1781593859821-1243e068-358d-4f0e-9bfc-8a2607b77e8b-image.png]
so the browser accepts the connection.
In this case = web browsing, a certificate with a matching host name is important.
Long story short : the DNS resolver / client traffic isn't using "host name" checking, so 'any' valid certificate will do. A certificate is just used to seed the TLS traffic.
You can pick any certificate under the "SSL/TLS Certificate" list.
Small negative side effect of using a acme.sh 'real' certificate : when renewed, the resolver has to be restarted. Or, you don't want any process to restart if not strictly needed.
