Certyfikat Letsencrypt wewnątrz sieci firmowej

[yLuno]

Dzięki za info. Teraz akurat tego nie potrzebuje ale jako, że mam w obecnej firmie kilka domen w CF, w różnych planach ale bez tego najwyższego, to w wolnej chwili spróbuję sprawdzić.

[fibahiy560]

W dniu 4/25/2022 o 3:58 PM, psz napisał:

You can create an API Token that will have access, for example, only to DNS records for one DNS zone.

 

Creating a Token API that would only access a single DNS record is theoretically possible if you create a Token via API, but as far as I know it is untested and may not work. For this reason, we are not officially announcing this functionality.

 

Unfortunately, adding subdomains to a Cloudflare account is a feature available to Enterprise customers.

 

I suggest you try one of the following:

•  Add a CNAME record pointing from your domain to a special domain "only for verification" and give API access only to it, e.g.

  Some Let's Encrypt clients allow this redirection. Alternatively, write a simple script to add / remove DNS records and hook it to the Let's Encrypt client.

• Same as above, but a CNAME that points to a different provider where such API restricted access is possible. List of DNS plugins for Certbot.

• Create a simple Worker to which you point your Let's Encrypt client, in this script you would hide the API Token, and deny requests that would try to modify DNS records other than _acme-challenge.

 

 I do not insist, and perhaps something has changed in CF in this regard.