2026-10-15 08:08 UTC
I’m a bit confused by what you’re saying, because to my knowledge the DNS entry you’re mentioning won’t help with getting a certificate at all. Challenges will typically require either having the DNS entry point to a publicly reachable website (doesn’t get you wildcard) or proving the ability to modify records for the domain by adding something like a TXT record on the fly, which shouldn’t require A/AAAA records.
So you should be able to do the second type of challenge without a global A record to get a wildcard certificate, and use local DNS for the A record?
Replies (1)
-
@MadPsyentist@lemmy.nz 2026-10-15 12:42
The challenge dosent require your site to be public only the DNS to be public. So your second description works. Your serve talks to LetsEncrypt. LE gives your server a challenge. Your server adds the challenge record to your public dns. LE confirms the challenge and issues a dns-01 wildcard certificate to your server. LE never had to vist your site to confirm the challenge. See for yourself and, from a terminal of your choosing, run nslookup madpsy.nz You should get back my local ip which doesnt work for anyone outside of my local network.