undefined | Better HN

0 points0x00000007mo ago0 comments

Because nginx, as an HTTP server, could answer the query?

0 comments

You want to build a DNS server into nginx so you can respond to DoH query's for the domain you are hosting on that nginx server?

Let's ignore that DoH is a client oriented protocol and there's no same way to only run a DoH server without an underlying DNS server. How do you plan to get the first certificate so the query to the DoH server doesn't get rejected for invalid certificate?

xg157mo ago

At that point you might as well use the HTTP-01 challenge. I think the whole utility of DNS-01 is that you can use it if you don't want to expose the HTTP server to the internet.

jcgl7mo ago

No, that’s just one of the use-cases. Also:

- wildcard certs. DNS-01 is a strict requirement here. - certs for a service whose TLS is terminated by multiple servers (e.g. load balancers). DNS-01 is a practical requirement here because only one of the terminating servers would be able to respond during an HTTP or ALPN challenge.

account427mo ago

> DNS-01 is a practical requirement here because only one of the terminating servers would be able to respond during an HTTP or ALPN challenge.

Reverse-proxying or otherwise forwarding requests for .well-known/acme-challenge/ to a single server should be just as easy to set up as DNS-01.

1 more reply

xg157mo ago

Ah, that makes sense. Thanks!

j / k navigate · click thread line to collapse

0 comments

Arrowmaster7mo ago

You want to build a DNS server into nginx so you can respond to DoH query's for the domain you are hosting on that nginx server?

xg157mo ago

At that point you might as well use the HTTP-01 challenge. I think the whole utility of DNS-01 is that you can use it if you don't want to expose the HTTP server to the internet.

jcgl7mo ago

No, that’s just one of the use-cases. Also:

account427mo ago

> DNS-01 is a practical requirement here because only one of the terminating servers would be able to respond during an HTTP or ALPN challenge.

Reverse-proxying or otherwise forwarding requests for .well-known/acme-challenge/ to a single server should be just as easy to set up as DNS-01.

1 more reply

xg157mo ago

Ah, that makes sense. Thanks!

j / k navigate · click thread line to collapse