Domain delegation for ACME TLS certificate DNS-01 challenges

TL;DR The DNS you’re using for a given domain may not have a suitable API for automating DNS-01 challenges, but that can be worked around by delegating to a sub domain (say acme.example.com) hosted somewhere that has a decent API. Background I was recently setting up some new services that would need TLS certificates. One of those services would not be publicly accessible, so HTTP-01 challenges weren’t going to work. No problem, I was planning to use Caddy on the front end, and I’d already used it elsewhere with DNS-01 challenges being answered by DigitalOcean DNS[1]. The problem was that the domain I was working with had DNS on NameCheap, and whilst they do have an API it’s terrible. I seemed to be faced with choosing the lesser evil of: Move the entire domain to another DNS provider, which is lots of busywork, and some risk of causing failures for existing stuff. Put the new services onto a subdomain, which would mean different URLs from what had been agreed…

Commenting on Bubbles has been removed. Why? If you want to talk about this post, write to the author, use the comments on their blog if it has them, or reply with a "RE:" post on your own blog. Suggestions? feedback@bubbles.town