DNS-PERSIST-01 challenge support (planned for late Q1 2026)
**Is your feature request related to a problem? Please describe.** Let's Encrypt is developing a new challenge that could make ACMEv2 clients not having to activelly participate in passing a challenge. They would still need to participate, but passivelly. It would be a persistent DNS TXT record set upfront with `account_uri` in its `RDATA`. When managed correctly (re-using acme account keys), account_uri never changes. Let's Encrypt plans to announce it in 2026, per their official blog post: https://letsencrypt.org/2025/12/02/from-90-to-45 Draft that appears to be very close to finalizing it: https://www.ietf.org/archive/id/draft-sheurich-acme-dns-persist-01.txt **Describe the solution you'd like** Support for DNS-PERSIST-01 as early as possible. **Describe alternatives you've considered** None. **Additional context** A lot security concerned k8s rollouts and companies **do not want** ACMEv2 clients to participate in risky infrastructure changes (like, DNS records) on every challenge, at runtime. For various reasons, explained in https://www.ietf.org/archive/id/draft-sheurich-acme-dns-persist-01.txt. Over they years, multiple workarounds to this problems had been at play: namelly `CNAME` or `NS` delegations for `_acme-challenge.example.com` (to separate impact of dns challenger credentials leakage for the main zones) or using stateless or active `http-01` challenges whenever possible. **Environment details (remove if not applicable)**: - Kubernetes version: any - C
Posted by pawlakus on Dec 29, 2025, 2:27 PM
Tags
Related issues
- That Reddit post is feeding more conspiracy thinking than helping.
- Support BYOK/Custom Models for Inline Code Completions
- Yeah I can't really blame people for not realising they have shitty mics and shitty internet because it's really hard for them to tell!
- Onboarding guide for FluentAssertions
- Add WebTransport support
- > solar electricity is already cheaper than natural gas Does that include transmission?
Raise real-world problems, find people facing the same issue, and discuss solutions.2,000 issues0 comments
support (Network)
That Reddit post is feeding more conspiracy thinking than helping.
Support BYOK/Custom Models for Inline Code Completions
DNS-PERSIST-01 challenge support (planned for late Q1 2026)
Yeah I can't really blame people for not realising they have shitty mics and shitty internet because it's really hard for them to tell!
Onboarding guide for FluentAssertions
Add WebTransport support
> solar electricity is already cheaper than natural gas Does that include transmission?
Support for WireGuard only peers
DNS-PERSIST-01 challenge support (planned for late Q1 2026)
**Is your feature request related to a problem? Please describe.** Let's Encrypt is developing a new challenge that could make ACMEv2 clients not having to activelly participate in passing a challenge. They would still need to participate, but passivelly. It would be a persistent DNS TXT record set upfront with `account_uri` in its `RDATA`. When managed correctly (re-using acme account keys), account_uri never changes. Let's Encrypt plans to announce it in 2026, per their official blog post: https://letsencrypt.org/2025/12/02/from-90-to-45 Draft that appears to be very close to finalizing it: https://www.ietf.org/archive/id/draft-sheurich-acme-dns-persist-01.txt **Describe the solution you'd like** Support for DNS-PERSIST-01 as early as possible. **Describe alternatives you've considered** None. **Additional context** A lot security concerned k8s rollouts and companies **do not want** ACMEv2 clients to participate in risky infrastructure changes (like, DNS records) on every challenge, at runtime. For various reasons, explained in https://www.ietf.org/archive/id/draft-sheurich-acme-dns-persist-01.txt. Over they years, multiple workarounds to this problems had been at play: namelly `CNAME` or `NS` delegations for `_acme-challenge.example.com` (to separate impact of dns challenger credentials leakage for the main zones) or using stateless or active `http-01` challenges whenever possible. **Environment details (remove if not applicable)**: - Kubernetes version: any - C
Comments (0)
No comments yet. Start the discussion.