| ▲ | dspillett 5 hours ago | |
You don't need to do it manually - the DNS challenge works automatically as long as the machine doing the renewing can call out to something to update the DNS entry, and you can use the dns-alias option¹ if your main DNS provider isn't easy to automate this way (this also limits the opportunities for something going wrong with the automatic DNS updates for certs breaking your main DNS at the same time). I'm interested in the new DNS-persist method² which will make this even easier, though with some obvious trade-offs, but despite the announcements in Feb/May suggesting it would be rolled out in Q2, I've heard nothing recently and we are now in Q4. There are various ways to separate managing certs via regular ACME renews and the hosts that actually use the certificates, meaning that hosts which can never see or be touched by the outside network (except via whatever VPN you may use when away yourself) can have ACME certs instead of you setting up your own CA arrangement to serve them. One option if you don't mind all your services having one private key, is to get a wildcard cert on one host (a small server just answering the top level domain.tld for HTTPS based validation, or again one of the DNS options) and have your other services regularly refresh the certificate they use by reading it from there. ---- [1] Docs for acme.sh: https://github.com/acmesh-official/acme.sh/wiki/DNS-alias-mo... (other tools work just as well with it) | ||