Change default solver method for wildcard domains

[kirtangajjar]

Running bin/acme authorize '*.domain.ext' gives following error -

In AuthorizeCommand.php line 95:

  This ACME server does not expose supported challenge.

In such case, acmephp should set dns as default resolver(If the domain starts with *)

if user specifies any non-dns solver, then error should be thrown that non-dns solvers are not allowed by acme in wildcard domains.

[tgalopin]

Thanks for the feedback!

If you are interested by doing a PR on this, don't hesitate to ping me here or on the Symfony Slack: I'd be glad to help :) .

[aik099]

How do you validate wildcard domains using run command command?

In my case all the sub-domains lead to same document root so http-file would also work, but instead I also get same This ACME server does not expose supported challenge. error.

[jderusse]

You have to use a DNS solver.
For now only AWS Route53 is implented

[aik099]

Theoretically \AcmePhp\Core\Challenge\Dns\SimpleDnsSolver (activated via solver: dns config file line) should also work, but I'm not sure if it will actually wait during run command execution for me to change DNS?

Will it?

[aik099]

I'm using Gandi.Net. It has API (see http://doc.livedns.gandi.net/) were you can:

1. create new zone file version based on existing zone file
2. add needed entries for validation to it
3. switch to new zone file version
4. after validation is done switch back to old zone file version
5. drop new zone file version created for validation only

[jderusse]

Sounds 5. Could you please submit a Pull Request?

[aik099]

I probably could, but I wonder how do I test that. In the test suite I haven't found examples of DNS solver test classes.

Also maybe you can point me to the correct test case where I can see how challenge fixtures are used. Generating certificates right on Let's Encrypt just to test how it works sounds like a terrible idea.

[aik099]

@jderusse , PR created: #162

[xiaohuilam]

I don't think resolver should be DNS by default when wildcard identifier occur.
It is a mechanism of letsencrypt, doesn't mean it's an ACME mechanism.