Re: [Astlinux-users] Securing DNS API Keys when using ACME

[Lonnie A. <li...@lo...>]

Hey Michael,

Looking forward to hearing how acme-dns works for you.  AstLinux's acme-client (acme.sh) has a plugin for acme-dns, usage: --dns dns_acmedns

The acme-dns author "Joona Hoikkala" wrote an EFF article [1] "Securing the Automation of ACME DNS Challenge Validation"

BTW, I would use the acme-dns Github page [2] for info rather then the nethserver wiki article you referenced.

Lonnie

[1] https://www.eff.org/deeplinks/2018/02/technical-deep-dive-securing-automation-acme-dns-challenge-validation

[2] https://github.com/joohoi/acme-dns/



> On Aug 13, 2021, at 10:33 PM, Michael Knill <mic...@ip...> wrote:
> 
> Actually decided that I will give acme-dns a try: https://wiki.nethserver.org/doku.php?id=userguide:let_s_encrypt_acme-dns
> Will report how I go.
>  
> Regards
> Michael Knill
>  
> From: Michael Knill <mic...@ip...>
> Reply to: AstLinux List <ast...@li...>
> Date: Saturday, 14 August 2021 at 12:29 pm
> To: AstLinux List <ast...@li...>
> Subject: [Astlinux-users] Securing DNS API Keys when using ACME
>  
> Hi Group
>  
> I'm looking to move away from Wildcard SSL and move back to ACME Lets Encrypt to ensure a unique cert for all our systems. The reason is that we have built our new Mobile Softphone solution which is heavily reliant heavily on TLS  for provisioning and SIP.
>  
> As such, I want to set this up but I am concerned that if one of our systems was compromised (we have quite a few now), this will allow an attacker to do bad stuff to our DNS (currently GoDaddy). I understand that some DNS providers may be able to restrict what you can do with the API but just wondering if anyone has any better ideas?
>  
> Regards
>  
> Michael Knill
> Managing Director
>  
> D: +61 2 6189 1360
> P: +61 2 6140 4656
> E: mic...@ip...
> W: ipcsolutions.com.au
>  
>  <image001.png>
> Smarter Business Communications
>  
> _______________________________________________
> Astlinux-users mailing list
> Ast...@li...
> https://lists.sourceforge.net/lists/listinfo/astlinux-users
> 
> Donations to support AstLinux are graciously accepted via PayPal to pa...@kr....