DNS server alias (not different domain alias)

[michal-686]

We have one domain example.com and public DNS record _acme-challenge.example.com CNAME proxy.example.com, where is our small letsencrypt dedicated DNS server for the domain, updatable via nsupdate. What is correct syntax for acme.sh to use this dedicated DNS server, please?

Thanks, Michal

[michal-686]

Another informations: The DNS records on proxy.example.com are updated correctly (acme.sh --dns dns_nsupdate ....). The problem seems to be that the external DNS check (from letsencrypt servers, I suppose) does not asks _acme-challenge.example.com. There is no attempt to connect to this DNS server from internet in firewall/server logs.

[neilpang]

acme.sh is doing its part -- the missing piece is public DNS resolution, not the update.

When Let's Encrypt validates, it resolves _acme-challenge.example.com, follows your CNAME to proxy.example.com, then asks whoever is authoritative for proxy.example.com for the TXT. Your dedicated nsupdate server only gets that query if the public example.com zone delegates proxy.example.com to it with an NS record:

proxy.example.com.   IN NS   ns.your-dedicated-server.example.com.

Without that delegation, the query is answered by your main DNS provider (which has no TXT) and your server is never contacted -- exactly the "no connection in the logs" you see.

Two fixes together:

1. In the public example.com zone, delegate the target: proxy.example.com IN NS <your server> (so it's a real sub-zone your server is authoritative for).
2. In acme.sh, since the CNAME target has no _acme-challenge prefix, use domain-alias so the TXT is written to proxy.example.com:

export NSUPDATE_SERVER="proxy.example.com"
export NSUPDATE_KEY="/path/to/tsig.key"
export NSUPDATE_ZONE="proxy.example.com"
acme.sh --issue -d example.com --dns dns_nsupdate --domain-alias proxy.example.com

Cleaner alternative: delegate a dedicated sub-zone acme.example.com (NS -> your server), set _acme-challenge.example.com CNAME _acme-challenge.acme.example.com, and use --challenge-alias acme.example.com.