jcoffey-dev
cc282697e8
A CAA record with accounturi covers every name under the domain, so another ACME client there, like certbot on a web server, is refused at its next renewal. Nothing warned about it and it could be weeks before it showed. New domains now have to ask for CAA. The field description says why, and domains that already publish it keep it. The DNS-PERSIST-01 validation record was only built as part of CAA, so without this a persist provider on a domain not publishing CAA could never validate. It's now published either way for those providers. Fixes #292
152 KiB
152 KiB