I manage shared-hosting servers and do not want to give them write access to our authoritative DNS infrastructure. DNS-01 validation seems necessary for wildcard certificates and for services where the usual HTTP .well-known challenge is not practical. What are good ways to automate certificate issuance while limiting DNS permissions and keeping the setup secure?
3 Answers
Another option is to use an ACME client with a narrowly scoped DNS provider credential. For example, the client can authenticate to Azure DNS, Cloudflare, or Route 53 through an application identity that can modify only the required zone. This keeps the shared-hosting machines from having broad DNS privileges.
For a central application serving many customer subdomains, a reverse proxy or dedicated certificate service can obtain and renew the certificate, then make it available to the application through a controlled deployment process. If you use wildcard certificates, avoid distributing the private key across multiple systems; a leak means replacing the wildcard certificate everywhere. Per-service certificates are preferable when the architecture allows it.
Delegate only the _acme-challenge name to a separate DNS zone. The ACME clients can then use an API key or update key that is limited to creating TXT records in that zone, without getting access to the rest of your DNS. With BIND, this can be enforced using a dedicated key and update policy.
That sounds like the safest approach. The client would still have DNS API access, but only for the specific challenge domain rather than the main zones.