Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

dns_challenge_override_domain: clarify expected domain and DNS plugin support #367

Merged
merged 2 commits into from Jan 17, 2024
Merged

dns_challenge_override_domain: clarify expected domain and DNS plugin support #367

merged 2 commits into from Jan 17, 2024

Conversation

rom4nik
Copy link
Contributor

@rom4nik rom4nik commented Jan 12, 2024

For context: I have a CNAME record that makes _acme-challenge.domain1.com point to _acme-challenge.domain2.com.

  1. When I was searching online for how to use DNS-01 challenge delegation with Caddy, I was constantly running into pages about DuckDNS plugin's support for this feature (e.g. https://caddy.community/t/can-i-use-dns-alias-mode-to-issue-a-cert-with-caddy/11877). For some reason the dns_challenge_override_domain config option (added in Support for DNS challenge delegation caddy#4071) didn't really pop up in my searches until today, and even then I thought I would have to patch the OVH plugin, since it wasn't logging any errors with the override domain set to domain2.com. It would just timeout and throw an error: no memory of presenting a DNS record for "domain2.com" (usually OK if presenting also failed).

  2. This post: https://caddy.community/t/global-dns-challenge-and-dns-challenge-override-domain/16773/3 was written for DuckDNS plugin's own override_domain option, and as such it said that _acme-challenge mustn't be prepended to that option's value in Caddyfile. I initially assumed this would be true for OVH plugin as well, despite not having custom override code in it.
    On the other hand, this post: https://caddy.community/t/issuing-a-cert-with-the-dns-challenge-override-domain-directive-is-not-working-while-possible-to-issue-a-cert-for-the-alias-domain-itself/18477/2 made it clear to me that the domain set for Caddy's own dns_challenge_override_domain will be used as-is with (any?) DNS plugin.

That was pretty confusing, so I think it would be good to have it clarified in official docs.

Copy link
Member

@mholt mholt left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I suppose it's not a bad idea to clarify these things. Thanks!

@francislavoie
Copy link
Member

Sorry, I saw this a few days ago but forgot to follow up.

👍 from me!

@francislavoie francislavoie merged commit c341db1 into caddyserver:master Jan 17, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants