Skip to content

Commit

Permalink
Reword the introduction
Browse files Browse the repository at this point in the history
  • Loading branch information
aaomidi committed Feb 7, 2024
1 parent b3e3d23 commit cf8cc33
Showing 1 changed file with 3 additions and 5 deletions.
8 changes: 3 additions & 5 deletions draft-ietf-acme-dns-account-01.mkd
Original file line number Diff line number Diff line change
Expand Up @@ -75,6 +75,9 @@ name and all of its subdomains.

Furthermore, since each domain only has a single authorization label, it creates an impediment
limiting the number of other entities domain validation can be delegated to.
Delegating authorization to an entity requires the use of CNAME records, which can only used once
per DNS name (or in this case, once per authorization label). This limitation requires that
operators to pick a single ACME challenge solver for their domain name.

In multi-region deployments, where separate availability zones
serve the same content, and dependencies across them are avoided, operators need
Expand All @@ -83,11 +86,6 @@ Similarly, in cases of zero-downtime migration, two different setups of the
infrastructure may coexist for a long period of time, and both need access to valid
certificates.

Due to the uniqueness of the `_acme-challenge` label, operators today have to
pick a single ACME challenge solver for their domain name, and then add a
`CNAME` record to this infrastructure. A domain name can only have one `CNAME`
in DNS.

This document specifies two new challenge types. `dns-02` and `dns-account-01`.

This work follows all recommendations set forth in "Domain Control
Expand Down

0 comments on commit cf8cc33

Please sign in to comment.