Michał "rysiek" Woźniak · 🇺🇦 @rysiek@mstdn.social
Public

Oh this is wonderful news:

DNS-PERSIST-01: A New Model for DNS-based Challenge Validation
letsencrypt.org/2026/02/18/dns

> Instead of publishing a new challenge record for each issuance, you publish a standing authorization in the form of a TXT record that identifies both the CA and the specific ACME account you authorize to issue for this domain.

DNS-PERSIST-01: A New Model for DNS-based Challenge Validation

When you request a certificate from Let’s Encrypt, our servers validate that you control the hostnames in that certificate using ACME challenges. For subscribers who need wildcard certificates or who prefer not to expose infrastructure to the public Internet, the DNS-01 challenge type has long been the only choice. DNS-01 works well. It is widely supported and battle-tested, but it comes with operational costs: DNS propagation delays, recurring DNS updates at renewal time, and automation that often requires distributing DNS credentials throughout your infrastructure.

letsencrypt.org

0
2
0

If you have a fediverse account, you can quote this note from your own instance. Search https://mstdn.social/users/rysiek/statuses/116098951686509362 on your instance and quote it. (Note that quoting is not supported in Mastodon.)