Post by @MadPsyentist@lemmy.nz

2026-10-15 12:42 UTC

The challenge dosent require your site to be public only the DNS to be public. So your second description works. Your serve talks to LetsEncrypt. LE gives your server a challenge. Your server adds the challenge record to your public dns. LE confirms the challenge and issues a dns-01 wildcard certificate to your server. LE never had to vist your site to confirm the challenge. See for yourself and, from a terminal of your choosing, run nslookup madpsy.nz You should get back my local ip which doesnt work for anyone outside of my local network.

Replies (1)

@kuberoot@discuss.tchncs.de 2026-10-15 13:05

The point is, the challenge doesn’t require a public DNS A record pointing to your IP, it’s not involved in issuing a wildcard certificate. It requires you to control DNS records for the domain to issue a temporary TXT or something record to prove it, one which you can remove afterwards. This was my point in the original comment. It’s A and AAAA records that are used when you open a website in a browser to map the domain to an IP address, the ones I’m saying don’t need to be public. The challenge dosent require your site to be public only the DNS to be public. And just to be clear, that was describing a different kind of challenge, the simpler one which most people probably use, and which does actually involve A records.

Open ##5220540