<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto">Dear all,<div><br></div><div>I have an application that would benefit from a setup like Plex' Secure Server connections. In short words, they use wildcard DNS records where the name of the resource record conforms to a syntax conveying the IP address, the record shall resolve to, for instance 10-0-1-13.someuuidforthedevice-abcdef.example.com.</div><div><br></div><div>The device gets a certificate for *.<span style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);"> someuuidforthedevice-abcdef.example.com</span></div><div><font color="#000000"><span style="caret-color: rgb(0, 0, 0);">When someone asks the DNS for </span></font><span style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">10-0-1-13.someuuidforthedevice-abcdef.example.com. they get an A record for 10.0.1.13 back.</span></div><div><span style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);"><br></span></div><div><span style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">In order to make this setup work with letsencrypt, two challenges arise:</span></div><div><span style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);"><br></span></div><div><span style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">1. the easy one: put the challenge of ACME into the DNS at runtime. Now, I did this previously with isc-bind and used the dynamic dns update feature for the relevant zone. Since I have not yet hands-on-experience with pdsn, I am asking for the correct way to implement this. I read that I can use three different ways to accomplish that:</span></div><div><span style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">a) dynamic DNS updates </span></div><div><span style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">b) the HTTP API</span></div><div><span style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">c) inserting the record directly into the backend database, but I would have to make sure that no previous query to that record had been sent to pdns, otherwise it could respond from the cache.</span></div><div><span style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">What is the best way to do it?</span></div><div><span style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);"><br></span></div><div><span style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">2. the hard one: how can an answer to a A RR query be synthesized from the queried name? My current way of thinking is to use the remote backend and write a node.js application (with ZeroMQ, as that's what I am familiar with) that answers these questions.</span></div><div><span style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);">My question to you all would here be: is this a stable setup with pdns? Is the remote backend interface widely used and battle tested? Or is this an uncommon thing and I am probably running into trouble? The scale of my application is, that there would be something like 500.000 devices out there, not more.</span></div><div><font color="#000000"><span style="caret-color: rgb(0, 0, 0);"><br></span></font></div><div><font color="#000000"><span style="caret-color: rgb(0, 0, 0);">Thank you in advance for your insights!</span></font></div><div><font color="#000000"><span style="caret-color: rgb(0, 0, 0);"><br></span></font></div><div><font color="#000000"><span style="caret-color: rgb(0, 0, 0);"> Michael.<br></span></font><br><div dir="ltr">-- <div>Michael Rommel, Erlangen, Germany</div></div></div></body></html>