• 0 Posts
  • 404 Comments
Joined 3 years ago
cake
Cake day: June 25th, 2023

help-circle



  • It’s really frustrating. Many years ago, my older brother helped me get a new GPU, buying it from a nice online store. Some years later I used it when buying hardware and it was so good compared to all the established stores, instead of pushing promos everywhere it made it easy to browse, find and buy products, because oh god are those big stores shitty. Just having a responsive website with filters, reasonable element sizing and a straightforward checkout process stands out.

    A few years after that, when I used it again, noticed something peculiar, as they added lootboxes. And I don’t mean physical surprise boxes or something, they added digital lootboxes to get random discounts on products, with a premium subscription that gets you a better pool of discounts. That is a level of “what the fuck” that’s just stunning. And they might still have the best service, which combined with inertia of it being my goto store makes things rather difficult.











  • Jet says the following

    If you want https it’s gotta be a external DNS record anyway, might as well point to internal ips

    My point is, the A record, the one pointing to an IP address, doesn’t need to be public/external, it’s not needed for the wildcard cert, so it can be kept internal.

    I’m mentioning the other challenge trying to make it clear why the record matters for that, and not for a wildcard cert, sorry if that just made things more confusing.


  • Perhaps a better analogy is a painter who has no idea what their canvas is made out of; they know it’s a canvas, they know it’s for painting, they’re faintly aware they’re using some material stretched over a frame, but they just assumed a canvas is a canvas and they just never considered there might be other options than the one they’ve been getting.


  • The point is, the challenge doesn’t require a public DNS A record pointing to your IP, it’s not involved in issuing a wildcard certificate. It requires you to control DNS records for the domain to issue a temporary TXT or something record to prove it, one which you can remove afterwards. This was my point in the original comment.

    It’s A and AAAA records that are used when you open a website in a browser to map the domain to an IP address, the ones I’m saying don’t need to be public.

    The challenge dosent require your site to be public only the DNS to be public.

    And just to be clear, that was describing a different kind of challenge, the simpler one which most people probably use, and which does actually involve A records.


  • I’m a bit confused by what you’re saying, because to my knowledge the DNS entry you’re mentioning won’t help with getting a certificate at all. Challenges will typically require either having the DNS entry point to a publicly reachable website (doesn’t get you wildcard) or proving the ability to modify records for the domain by adding something like a TXT record on the fly, which shouldn’t require A/AAAA records.

    So you should be able to do the second type of challenge without a global A record to get a wildcard certificate, and use local DNS for the A record?