acme when dns provider does not allow dns challenge

johnpoz

I wouldn't suggest you host your public dns locally anyway... I have been using bind for something like 30 years... And I wouldn't host my own public dns on my own connection - even if you paid me to do it ;)

Pick a DNS service that is what they DO... They have global dns anycast networks.. It would be impossible for you to provide such connectivity on your connection, provide for the ddos protection, etc. etc..

Host your own local dns locally - anything else.. Get one of the major players to do it... Anything else is just asking for issues and problems and just old PITA..

tn1rpi3

@johnpoz said in acme when dns provider does not allow dns challenge:

Do you actually own the domain, or did let them register it for you

I'm not entirely sure. I registered it with world4you. I pay an annual fee for it.
I always thought I'd own it, since 'whois' used to show my name with it (before it got security conscious).

Gertjan

@tn1rpi3 said in acme when dns provider does not allow dns challenge:

since 'whois' used to show my name with it (before it got security conscious).

That's one proof that you can't really hide yourself on the net.
When you rent - you can't own or buy for life - a domain name, people have the right to know what person or identity is behind it.

@tn1rpi3 said in acme when dns provider does not allow dns challenge:

I'm not entirely sure. I registered it with world4you. I pay an annual fee for it.

Thus they are more like a classic hosting company that throws in domain names into the package.
Nifty stuff like you being able to change DNS related settings by API isn't included. For them : this means one hell of a support issue less to amuse.

johnpoz

Do you have access to where it registered? They can still own it and put in your name for whois.

Do you not have the option with them to move your domain? Ie transfer it to a different registrar..

I have domains on quite a few different registrars - if your domain, they have to let you transfer it to a different one..

Does this company have any info about doing transfer - ask them how you move your domain to a different registrar? Quite often its cheaper to just go with actual registrar then paying your webhost to handle it for you... Many of them don't actually let you own it, but its theirs and they just let you use it.. I would never register a domain with a webhost.

Just ask them, hey I want to move my domainXYZ.com to a different registrar because your dns blows! And you want let me point to my own NS, etc.

tn1rpi3

@Gertjan DNS related settings are restricted to filling in the server names for DNS.

tn1rpi3

@johnpoz I got word from them that I'm actually the owner.
Still waiting for response on the transfer question..
I'm sitting in Austria. Can you possibly recommend a decent provider?

johnpoz

Doesn't matter really where the registrar is.. What is the tld is all that matters since some registrars do no support specific tld's

Can you delegate on their site - who the ns are for your domain? If so don't really need to move to different registrar - you could just point to a dns service..

So you just looking for registrar that has decent dns services - works with acme? I have domains with both namecheap and dynadot.. What is the tld of your domain? .com, .net, .at ?

tn1rpi3

@johnpoz The mgmt interface does allow to point to other dns servers. TLD's a .com

johnpoz

Well if you can just point to different ns, host your domain at any of the fine fully featured dns.. Do you want free? Or do you not mind paying a few bucks... We host some work domains here for dns..

https://dnsmadeeasy.com/

Clouldflare is full featured dns, FREE level.. I have one of my domains there.. also hurricane electric offers full featured FREE dns services. I have domain there as well... And then I do have a play domain that I host off my own vps boxes..

I would prob say you check out cloudflare first..

tn1rpi3

@johnpoz I just got a basic Cloudflare account. DNS settings at my provider now point to cloudflare servers, update is pending. - Acme settings for DNS-Cloudflare require 1. Cloudflare API Key, 2. API Email Address, 3. API Token and 4. API Account ID. --> I don't see any of these in my Cloudflare account though. Could you provide some Cloudflare wisdom, plz?

tn1rpi3

@johnpoz Transfer to Cloudflare nameservers is now completed. It took some five days (‘status pending)’, then I was able to retrieve the necessary API keys for DNS challenge. (btw: It would appear logical that you can't get them right away, my bad..) - I’ll be creating the certificate this weekend and report back if all went well.

tn1rpi3

@johnpoz Meanwhile my registrar has trouble getting the settings for DNSSEC right. I don't know why but I've been waiting for a working config since Nov. 18th. - Needless to say that I can neither update the certificate right now, nor is the site accessible at all.

johnpoz

Yeah its sad state affairs to be honest, since to be accredited its a requirement to support dnssec..

This was made a requirement back in 2013
https://www.icann.org/en/system/files/files/approved-with-specs-27jun13-en.pdf

Page 67

Registrar must allow its customers to use DNSSEC upon request by relaying orders to add, remove or change public key material (e.g., DNSKEY or DS resource records) on behalf of customers to the Registries that support DNSSEC. Such requests shall be accepted and processedin a secure manner and according to industry best practices. Registrars shall accept any public key algorithm and digest type that is supported by the TLD of interest and appears in the registries posted at: http://www.iana.org/assignments/dns-sec-alg-numbers/dns-sec-alg-numbers.xml and http://www.iana.org/assignments/ds-rr-types/ds-rr-types.xml. All such requests shall be transmitted to registries using the EPP extensions specified in RFC 5910 or its successors.

When I first fired up a dnssec back a few years with dyndot since they listed they supported it on xyz tld... It took a few emails to get them to correct their problems and get it working..

tn1rpi3

@johnpoz I'm glad it's become a matter of compliance by now. - I understand that unspoofable caller IDs add a great deal to the security on the net. According to this source one could even file a complaint with ICANN if a provider is unwilling/unable to provide DNSSEC. - Anyway, still waiting for something to happen..

johnpoz

Yeah the only thing is your tld has to support it.. Not the registrar's problem if the tld does not have it - and there are many out there that do not still.

It has gotten way better
http://stats.research.icann.org/dns/tld_report/
1517 TLDs in the root zone in total
1388 TLDs are signed;
1378 TLDs have trust anchors published as DS records in the root zone;

JeGr

@tn1rpi3 said in acme when dns provider does not allow dns challenge:

I don't see any of these in my Cloudflare account though. Could you provide some Cloudflare wisdom, plz?

Cloudflare doesn't create an API key with your account, you have to do that for yourself. Click on your profile symbol/pic in the upper right corner of your CF Dashboard. Got to "my profile". Then access the API Tokens Tab. There check for or create the Global API Key. That's the one you need for the acme package with dns_cf mode. Works like a charme.

tn1rpi3

@johnpoz valid point. We're talking about a .com address here.

tn1rpi3

@JeGr thanks for the pointer!

johnpoz

Well .com has been dnssec for a long time ;) And every accredited registrar is required to provide the support to do dnssec.. So yeah you should be able to use any registrar - yet that is not the case for sure.. And while some say they support it - you can not get it to work ;)

You shouldn't have any issues with cloudflare..

tn1rpi3

@johnpoz I've requested a DS record at my current registrar and sent them the data Cloudflare has provided me with: It goes like
"example.com. IN DS 62910 7 1 1D6AC75083F3CEC31861993E325E0EEC7E97D1DD"
While my provider says they've done what's necessary, a website check produces the following error: Fatal error: DNSKEY 2371 signs DNSKEY RRset, but no confirming DS RR in the parent zone found. No chain of trust created.
Did I overlook something here or is the ball back in the registar's court?

If the latter is the case, I'll initiate a domain transfer and do everything within Cloudflare. - The whole affair is taking way too long..