acme when dns provider does not allow dns challenge



  • Hi *

    I'm intending to host a bunch of virtual servers in a DMZ using ha-proxy on pfsense.
    For the site certificate I use the acme package.

    The problem is that my dns provider (world4you.com) does not allow me to

    • manually enter TXT records or even
    • change the dns server to point to pfsense as a resolver

    What are my options apart from changing the provider?

    Appreciate your response.

    Reinhard



  • @tn1rpi3 said in acme when dns provider does not allow dns challenge:

    manually enter TXT records or even

    Domain names are you choice. All registrars do the same basic job - the difference is
    what 'other' services they offer. An 'accesible" DNS system is one of them.
    Let's say you found a valid reason to move elsewhere ;)

    @tn1rpi3 said in acme when dns provider does not allow dns challenge:

    change the dns server to point to pfsense as a resolver

    No way.
    The DNS resolver is NOT a full fledged domain name server - neither slave neither master.
    True, you could de-activate the resolver (unbound) not using the Forwarder (dnsmasq) neither, and install a package called bind that can full-fill the local (pfSense and LANs) DNS needs and also being a DNS domain name master or salve.
    Normally, these needed DNS domain name servers are being offered by your registrar.
    acme will update the master DNS domain name server (and the master will inform / update the slave). If you don't know very well how bind works, I strongly advise you to stay away from it. It's like ... apache2 or postfix : huge programs with huge set up parameters that can't be made easier by using a GUI like pfSense. Just install the bind package and see for yourself.

    Btw : you saw https://www.world4you.com/en/webhosting/gratis-ssl-zertifikat.html ?


  • LAYER 8 Global Moderator

    @tn1rpi3 said in acme when dns provider does not allow dns challenge:

    What are my options apart from changing the provider?

    manually enter TXT records or even

    Pretty much zero - why would you use them as a dns provider? They sound freaking horrible!!!

    Its not like your dns can not be hosted for any domain you actually have registered with a registrar... Did you register the domain with them - and they are holding it hostage?

    There is a big difference between a registrar and a hosting service... Do you actually own the domain, or did let them register it for you, and they actually own it?

    If you own it you can move it to any registrar you want that supports that .tld - and then use their dns, or point to whatever dns provider you want to, or yeah host your own if you want, etc.. Just not via dnsmasq or unbound. Those are not meant to be authoritative NS.. Nor would I suggest you host your dns actually on pfsense, or your own network... But there are plenty of places to host dns for FREE or very low cost that provides you with full access to whatever records you want to create via simple web gui.



  • @Gertjan been there with bind, huge.. Not a choice, but thx.


  • LAYER 8 Global Moderator

    I wouldn't suggest you host your public dns locally anyway... I have been using bind for something like 30 years... And I wouldn't host my own public dns on my own connection - even if you paid me to do it ;)

    Pick a DNS service that is what they DO... They have global dns anycast networks.. It would be impossible for you to provide such connectivity on your connection, provide for the ddos protection, etc. etc..

    Host your own local dns locally - anything else.. Get one of the major players to do it... Anything else is just asking for issues and problems and just old PITA..



  • @johnpoz said in acme when dns provider does not allow dns challenge:

    Do you actually own the domain, or did let them register it for you

    I'm not entirely sure. I registered it with world4you. I pay an annual fee for it.
    I always thought I'd own it, since 'whois' used to show my name with it (before it got security conscious).



  • @tn1rpi3 said in acme when dns provider does not allow dns challenge:

    since 'whois' used to show my name with it (before it got security conscious).

    That's one proof that you can't really hide yourself on the net.
    When you rent - you can't own or buy for life - a domain name, people have the right to know what person or identity is behind it.

    @tn1rpi3 said in acme when dns provider does not allow dns challenge:

    I'm not entirely sure. I registered it with world4you. I pay an annual fee for it.

    Thus they are more like a classic hosting company that throws in domain names into the package.
    Nifty stuff like you being able to change DNS related settings by API isn't included. For them : this means one hell of a support issue less to amuse.


  • LAYER 8 Global Moderator

    Do you have access to where it registered? They can still own it and put in your name for whois.

    Do you not have the option with them to move your domain? Ie transfer it to a different registrar..

    I have domains on quite a few different registrars - if your domain, they have to let you transfer it to a different one..

    transfer.jpg

    Does this company have any info about doing transfer - ask them how you move your domain to a different registrar? Quite often its cheaper to just go with actual registrar then paying your webhost to handle it for you... Many of them don't actually let you own it, but its theirs and they just let you use it.. I would never register a domain with a webhost.

    Just ask them, hey I want to move my domainXYZ.com to a different registrar because your dns blows! And you want let me point to my own NS, etc.



  • @Gertjan DNS related settings are restricted to filling in the server names for DNS.



  • @johnpoz I got word from them that I'm actually the owner.
    Still waiting for response on the transfer question..
    I'm sitting in Austria. Can you possibly recommend a decent provider?


  • LAYER 8 Global Moderator

    Doesn't matter really where the registrar is.. What is the tld is all that matters since some registrars do no support specific tld's

    Can you delegate on their site - who the ns are for your domain? If so don't really need to move to different registrar - you could just point to a dns service..

    So you just looking for registrar that has decent dns services - works with acme? I have domains with both namecheap and dynadot.. What is the tld of your domain? .com, .net, .at ?



  • @johnpoz The mgmt interface does allow to point to other dns servers. TLD's a .com


  • LAYER 8 Global Moderator

    Well if you can just point to different ns, host your domain at any of the fine fully featured dns.. Do you want free? Or do you not mind paying a few bucks... We host some work domains here for dns..

    https://dnsmadeeasy.com/

    Clouldflare is full featured dns, FREE level.. I have one of my domains there.. also hurricane electric offers full featured FREE dns services. I have domain there as well... And then I do have a play domain that I host off my own vps boxes..

    I would prob say you check out cloudflare first..



  • @johnpoz I just got a basic Cloudflare account. DNS settings at my provider now point to cloudflare servers, update is pending. - Acme settings for DNS-Cloudflare require 1. Cloudflare API Key, 2. API Email Address, 3. API Token and 4. API Account ID. --> I don't see any of these in my Cloudflare account though. Could you provide some Cloudflare wisdom, plz?


Log in to reply