Digitalboard/docs
5
1
Fork 0
Code Pull requests 1 Activity Actions

chore: update acme reference design with design by tom

Browse source
This commit is contained in:
Bert-Jan Fikse 2025-10-02 11:53:07 +02:00
parent 7ffee27b47
commit c82716a991
Signed by: bert-jan
GPG key ID: C1E0AB516AC16D1A
1 changed files with 15 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

26
infrastructure/acme.md
View file

@ -11,22 +11,26 @@ We agreed to use **ACME DNS-01 challenges** for issuing certificates for **both
- Restrict write access to the challenge zone to the ACME automation only. - Restrict write access to the challenge zone to the ACME automation only.
## Reference Design ## Reference Design
**Dedicated zone:** **Dedicated zone:**
`_acme.example.com` `_acme.digitalboard.ch`
**For a service FQDN:** **Dedicated zone for each managed school:**
Target certificate: `app1.example.com` `gymkirchenfeld._acme.digitalboard.ch`
**Publish in the primary zone:** **For a service FQDN:**
Target certificate: `app1.gymkirchenfeld.ch`, `app2.kinet.ch`
**Publish in the primary zone:**
```dns ```dns
; Delegate the challenge to the dedicated zone ; Delegate the challenge to the dedicated zone
_acme-challenge.app1.example.com. CNAME app1._acme-challenge._acme.example.com. _acme-challenge.app1.gymkirchenfeld.ch. IN CNAME
``` app1.gymkirchenfeld.ch.gymkirchenfeld._acme.digitalboard.ch.
**Publish in the dedicated zone (managed by the ACME client/automation):** _acme-challenge.app2.kinet.ch. IN CNAME
```dns app2.kinet.ch.gymkirchenfeld._acme.digitalboard.ch.
; ACME client writes the TXT token here
app1._acme-challenge._acme.example.com. TXT "ACME_VALIDATION_TOKEN" _acme-challenge.app.example.com. IN CNAME
app.example.com.school-a._acme.digitalboard.ch.
``` ```
> During validation, the CA will follow the CNAME from the primary zone to the dedicated zone and read the TXT record there. > During validation, the CA will follow the CNAME from the primary zone to the dedicated zone and read the TXT record there.