feat(certbot): issue certificates via `dns-persist-01` - #1132

Open

kvinwang wants to merge 26 commits into

nextfrom

feat/certbot-dns-persist-01

Commits on Aug 25, 2026

feat(certbot): add the dns-persist-01 validation method
kvinwang
committed
32c3e52
feat(certbot): print the one-time dns-persist-01 records from the CLI
kvinwang
committed
d5fca0d
feat(gateway): let a ZT domain validate with dns-persist-01
kvinwang
committed
98ec272
docs: document dns-persist-01 certificate issuance
kvinwang
committed
f2b1e3c
docs: quote the real dns-persist-01 rejection from staging
kvinwang
committed
8d778af
fix(certbot): read a dns-persist-01 record the way the CA reads it
kvinwang
committed
56544f4
fix(certbot): name the configured CA in dns-01 CAA records too
kvinwang
committed
5942675
fix(gateway): fit the dns-persist-01 dns wait inside the order timeout
kvinwang
committed
387feb4
feat(gateway): make the issuer domain name settable
kvinwang
committed
ba05002
fix(gateway): keep a ZT domain's challenge across a dashboard edit
kvinwang
committed
0771a38
docs: spell out the gateway dns-persist-01 setup order
kvinwang
committed
4b47a44
feat(gateway): register an ACME account before any ZT domain exists
kvinwang
committed
a13d102
fix(certbot): check the configured issuer domain name before it reaches a zone
kvinwang
committed
65d0843
fix(certbot): keep the advisory DNS wait inside the order timeout
kvinwang
committed
f5032ec
fix(gateway): stop the dashboard hiding dns-persist-01 setup
kvinwang
committed
f162c07
docs: restore the issuer-name guidance and record the new rules
kvinwang
committed
49a724b
fix(certbot): keep the account a failed client build would have dropped
kvinwang
committed
076189c
fix(certbot): stop the DNS wait overshooting the budget it was clamped to
kvinwang
committed
c6bed3e
fix(certbot): hold the issuer domain name to the RFC 8659 label grammar
kvinwang
committed
f8fccff
fix(gateway): show the records dialog only where it applies
kvinwang
committed
7540f31
fix(gateway): report a partial ACME rotation instead of raising it
kvinwang
committed
52ad7c4
fix(certbot): say which character an issuer name was rejected for
kvinwang
committed
5ef4936
refactor(certbot): log the DNS budget at debug, not on every issuance
kvinwang
committed
b63fc44

Navigation Menu

Uh oh!

feat(certbot): issue certificates via `dns-persist-01` - #1132

feat(certbot): issue certificates via `dns-persist-01`#1132
kvinwang wants to merge 26 commits into
nextfrom
feat/certbot-dns-persist-01

Commits on Aug 25, 2026

feat(certbot): add the dns-persist-01 validation method

feat(certbot): print the one-time dns-persist-01 records from the CLI

feat(gateway): let a ZT domain validate with dns-persist-01

docs: document dns-persist-01 certificate issuance

docs: quote the real dns-persist-01 rejection from staging

fix(certbot): read a dns-persist-01 record the way the CA reads it

fix(certbot): name the configured CA in dns-01 CAA records too

fix(gateway): fit the dns-persist-01 dns wait inside the order timeout

feat(gateway): make the issuer domain name settable

fix(gateway): keep a ZT domain's challenge across a dashboard edit

docs: spell out the gateway dns-persist-01 setup order

feat(gateway): register an ACME account before any ZT domain exists

fix(certbot): check the configured issuer domain name before it reaches a zone

fix(certbot): keep the advisory DNS wait inside the order timeout

fix(gateway): stop the dashboard hiding dns-persist-01 setup

docs: restore the issuer-name guidance and record the new rules

fix(certbot): keep the account a failed client build would have dropped

fix(certbot): stop the DNS wait overshooting the budget it was clamped to

fix(certbot): hold the issuer domain name to the RFC 8659 label grammar

fix(gateway): show the records dialog only where it applies

fix(gateway): report a partial ACME rotation instead of raising it

fix(certbot): say which character an issuer name was rejected for

refactor(certbot): log the DNS budget at debug, not on every issuance

Commits on Aug 26, 2026

fix(certbot): name the character an issuer name was rejected for, not its first byte

fix(gateway): count a rotation's re-pin failures out of the domains it tried

fix(gateway): keep a partial rotation on the page instead of in a toast