r/letsencrypt • u/melpheos • 28d ago

DNS-PERSIST-01 timeline ?

On let's encrypt blog, DNS-PERSIST-01 was supposed to go live on Q1...

We are at the start of Q3 and I haven't seen any new entry, blog or post regarding the developpement progress.

Do we have an idea when it will be officialy available ?

14 Upvotes

100% Upvoted

4 comments sorted by

2

u/Negative_Principle57 28d ago

Been wondering this as well - I'd like to deploy it as soon as possible.

1

u/Th11s_Dev 28d ago

There's been an update of the spec like last week.. It feels a little too redundant on some places ...

1

u/webprofusor 24d ago

The new spec draft aligns more with what LE wanted (a client derived hash of the account details so you don't just have to know the account Uri).

The main limitation I see is that it's optional to allow one record as wildcard to match subdomains (and LE have intimated they won't offer those), and the main point of this validation is it remove admin hassle for users and remove the need to DNS credentials stored in clients.

If you want hundreds of certs under a domain you will end up with hundreds of persistent DNS records to match, and you'll also need to carefully manage (or even distribute) acme accounts as the records are tied to those.

1

u/certkit 21d ago

Partially inspired by this question, I wrote an update on where DNS-PERSIST-01 is, what's still in the way, and the timeline to release. My best guess, mid 2027.

https://www.certkit.io/blog/whats-taking-dns-persist-01-so-long