Support DNS-01 challenges

[normanr]

Support DNS-01 challenges

[dongphuchaitrieu]

Yes, please support it!

[NoobTW]

Please support it.
Maybe it helps?
pyrou@8ae6efc

[vanillajonathan]

@pyrou Would you be interested in open a PR?

[NoobTW]

For now, I use acme alias mode.
I edit backend.py to reply CNAME when the domain starts with "_acme-challenge"

[pyrou]

Existing implementation on https://github.com/pyrou/traefik.me that NoobTW pointed out is to obtain a certificate for *.traefik.me that I give away for testing purpose, mitm experiment etc (see https://traefik.me for more info).

I'm not sure how this would help this issue.

[normanr]

Making the private key available will result in the certificate being rapidly revoked (as required by the CA/Browser forum baseline requirements), as sslip.io found out the hard way (ref: cunnie/sslip.io#6 (comment)). Also anyone with access to the private key can revoke the certificate.

The right way is to either allow clients to set response for _acme-challenge TXT record (requires database backend), or just delegate (with NS record) like sslip.io does it.