Post by @kuberoot@discuss.tchncs.de

@kuberoot@discuss.tchncs.de

2026-10-15 13:05 UTC

The point is, the challenge doesn’t require a public DNS A record pointing to your IP, it’s not involved in issuing a wildcard certificate. It requires you to control DNS records for the domain to issue a temporary TXT or something record to prove it, one which you can remove afterwards. This was my point in the original comment. It’s A and AAAA records that are used when you open a website in a browser to map the domain to an IP address, the ones I’m saying don’t need to be public. The challenge dosent require your site to be public only the DNS to be public. And just to be clear, that was describing a different kind of challenge, the simpler one which most people probably use, and which does actually involve A records.

Replies (1)

@MadPsyentist@lemmy.nz 2026-10-16 02:07

Right, i think we are talking about 2 different but very close things. Jet’s post is talking about a setup similar to mine, which is a wildcard certificate which LetsEncrypt only issue with a DNS-01 challenge, which, as you stated, requires the TXT record and not a text file on the server that the HTTP-01 challenge requires. Yes the HTTP-01 challenge would fail for an internal ip because letsencrypt wouldn’t be able to reach your site to check the acme challenge text file. But for sanity’s sake you can setup a wildcard cert for your homelab. Traefik makes it pretty painless and now you are not having to configure DNS records for your subdomains. For added security your A record on your dns can point to your internal IP address of your reverse proxy which gives everything routed through your proxy TLS but no-one outside your network can access it.

Open ##5220539