LetsEncrypt DNS verification using a local BIND instance
I’ve been looking into Let’s Encrypt DNS verification for a while.
Not only because you’re able to obtain wildcard certificates through
this method, freeing you from the necessity to obtain an individual
certificate for every single one of your subdomains: It also allows you
to get a certificate for stuff running on your LAN, provided you’re
running it on a subdomain that belongs to you. The problem is though,
how do you enable Certbot to automate the DNS server update, without
putting a credential in place that would allow full access to all your
domains? And what to do if you’re running a server for a domain that
doesn’t even belong to you: How can the owner delegate permissions for
the verification TXT records to you, without having to give you full
access to all their domains? Today I stumbled across a solution:
Delegate the _acme-challenge subdomain to a local BIND
instance and have Certbot update that. Here’s how.