TL;DR

The DNS you’re using for a given domain may not have a suitable API for automating DNS-01 challenges, but that can be worked around by delegating to a sub domain (say acme.example.com) hosted somewhere that has a decent API.

Background

I was recently setting up some new services that would need TLS certificates. One of those services would not be publicly accessible, so HTTP-01 challenges weren’t going to work. No problem, I was planning to use Caddy on the front end, and I’d already used it elsewhere with DNS-01 challenges being answered by DigitalOcean DNS[1].

The problem was that the domain I was working with had DNS on NameCheap, and whilst they do have an API it’s terrible. I seemed to be faced with choosing the lesser evil of:

• Move the entire domain to another DNS provider, which is lots of busywork, and some risk of causing failures for existing stuff.
• Put the new services onto a subdomain, which would mean different URLs from what had been agreed (service1.something.example.com rather than service1.example.com).
• Create a DNS delegation for the subdomain representing each of the new services (service1.example.com etc.) – more busywork.

I didn’t like any of those, but I was leaning towards the latter (even though I feared it might cause issues around moving the apex).

DNS delegation to the rescue

I then discovered that I could work around things with a few DNS (and Caddy) tricks. Better still, there was already a subdomain delegated to DigitalOcean, so I could simply reuse that.

All I had to do was CNAME _acme-challenge.service1 to _acme-challenge.service1.acme.example.com

That would mean that the ACME challenge TXT records for service1 would be found in the delegated acme subdomain.

But… I also needed to ensure that the TXT records would be created in the right place. Thankfully Caddy has a setting for that, and I simply had to add this to the tls section of Caddyfile:

dns_challenge_override_domain _acme-challenge.service1.acme.example.com

Hopefully this all goes away soon

Once the DNS-PERSIST-01 challenge validation gets widely implemented there will no longer be any need for the workaround described above. I should be able to simply bind a domain to an ACME account key, and then get certificates for any name within that domain.

Note

[1] I even have a little CD pipeline to automate building Docker images with the DigitalOcean module for Caddy baked in.