Summary

  • The IETF has opened Last Call through 10 November on an ACME draft that gives each account a distinct DNS validation name under the same domain.
  • The proposed dns-account-01 challenge lets independent regions, cloud providers or migration systems ask for certificates concurrently without fighting over one delegated CNAME.

Imagine a company changing clouds while keeping its website alive. The old system still needs certificates. The new one needs them too. Both knock at the same DNS name, _acme-challenge, and discover that this particular doorbell has room for one CNAME. The ACME base standard, RFC 8555, gives certificate authorities a way to ask for a fresh proof of control; it did not give two separately delegated teams two different places to answer.

The ACME working-group draft proposes a second bell. More precisely, it derives a short label from each account URL and places it before _acme-challenge. A team using one ACME account would publish its TXT answer at one name. Another account would use another name under the same domain. Each certificate authority would calculate the appropriate name from the account identifier in the signed request and check the fresh TXT digest there.

The arithmetic is specific: take SHA-256 of the full account URL, use its first ten bytes, encode them in Base32, then prepend that label. The account URL determines the address, so a routine key rollover can keep the DNS arrangement. The TXT value still changes with the challenge token and account key. Each account gets a lasting place to answer a fresh question.

That distinction is where the governance story lives. A domain owner could authorize a primary cloud, a second region and a migration partner to maintain separate validation paths. Every extra path is also an extra route by which a suitably equipped account may request a certificate. Someone must keep the list of authorized accounts, DNS delegations, owners and retirement dates. Otherwise the migration ends, the old workstation goes dark, and its little brass bell stays screwed to the wall.

The draft points to another fragile piece of furniture: the account URL. If a certificate authority changes its hostname, path, scheme or port, previously provisioned account labels can change. The draft urges servers to keep account identifiers stable and, where a move is necessary, to accept previously issued URLs so existing DNS names still work. It also says clients should remove challenge TXT records after a completed check. Those instructions are useful operating questions for any team planning parallel issuance.

The Datatracker lists revision -04, dated 27 October, in IETF Last Call through 10 November. The proposal asks IANA to register dns-account-01 if it advances. For now, the review is where the extra doorbell is being fitted on paper.