You can even put it in a seperate zone (which I do) by using a CNAME for _acme-c... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

		sigio 12 days ago \| parent \| context \| favorite \| on: TLS certificates for internal services done right You can even put it in a seperate zone (which I do) by using a CNAME for _acme-challenge.domain.tld. I have it to a seperate subdomain, which is served by a seperate desec.io account, which is only used for this specific subdomain.
		help

mrl5 12 days ago | [–]

TIL, thanks! This makes dns challange automation more approachable for me. I always had an issue with API keys which scope can't be limited to TXT records. This seems to be a nice workaround

... and it is even already documented at https://github.com/acmesh-official/acme.sh/wiki/DNS-alias-mo...

Consider applying for YC's Fall 2026 batch! Applications are open till July 27.
Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact