<div dir="ltr"><div class="gmail_default" style="font-size:small">I have been working on a mechanism to fully automate provisioning of devices that use ACME issued TLS certs. </div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small">By fully automate, I mean the user does nothing more than unpack the device, scan a QR code and plug it in. I do not mean spend hours pouring through the certbot documentation, configuring DNS, etc. etc. I mean fully automate.</div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small">The way to do this is to automate both the DNS provisioning and the cert provisioning through some form of service that lives either locally or in the cloud or both which receives requests from the device and performs all the interactions with the DNS via dynamic DNS and the CA using ACME.</div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small">My model here is that there will be service providers offering service on a freemium model. So Alice starts off with the free service from provider.test, she is given the subdomain alice.provider.test as her personal 'place'. </div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small">Alice uses the service to bind her coffee pot which she can now reach as <a href="https://coffee.alice.provider.test/">https://coffee.alice.provider.test/</a></div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small">After a while, Alice decides to get her own domain, so she upgrades to the paid service and now she reaches her coffee pot at <a href="https://coffee.the-real-alice.test/">https://coffee.the-real-alice.test/</a></div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small">And Alice also has an OAUTH online handle bound to <a class="gmail_plusreply" id="plusReplyChip-0">@</a>the-real-alice.test using the extensions to OAUTH proposed by BlueSky and people can mail or message her using the Mesh protocols on the same ID.</div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small">The whole thing seems fairly clean and straightforward. But as I am implementing, being OCD, I can't help but notice how ugly glue records are. I would like to hide that away rather than make the user make a choice or risk a collision when they buy a NayStation1 and try to give it the name ns1.</div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small">So solutions coming to mind for the glue record name for <a href="http://example.com">example.com</a></div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small">Prefix the address like we do suffixes:</div><div class="gmail_default" style="font-size:small">@ IN SOA _<a href="http://primary.example.com">primary.example.com</a>. <a href="http://hostmaster.example.com">hostmaster.example.com</a>.<br></div><div class="gmail_default" style="font-size:small"> IN NS
_<a href="http://primary.example.com">primary.example.com</a>.<br>_<a href="http://primary.example.com">primary.example.com</a>. IN A 192.168.1.22</div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small"><div class="gmail_default">Use a non routed DNS address, does this work though?</div><div class="gmail_default"><div class="gmail_default">@ IN SOA example.com.invalid <a href="http://hostmaster.example.com">hostmaster.example.com</a>.<br></div><div class="gmail_default"> IN NS example.com.invalid.<br>example.com.invalid. IN A 192.168.1.22</div></div></div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small">Use a random address</div><div class="gmail_default" style="font-size:small"><div class="gmail_default">@ IN SOA <a href="http://d0cfc2e5319b82cdc71a33873e826c93d7.example.com">d0cfc2e5319b82cdc71a33873e826c93d7.example.com</a>. <a href="http://hostmaster.example.com">hostmaster.example.com</a>.<br></div><div class="gmail_default"> IN NS <a href="http://d0cfc2e5319b82cdc71a33873e826c93d7.example.com">d0cfc2e5319b82cdc71a33873e826c93d7.example.com</a>.<br><a href="http://d0cfc2e5319b82cdc71a33873e826c93d7.example.com">d0cfc2e5319b82cdc71a33873e826c93d7.example.com</a>. IN A 192.168.1.22</div><div class="gmail_default"><br></div><div class="gmail_default">Yes, I get that all mean change. But the two are at least mnemonic and could be reserved for the purpose.</div><div class="gmail_default"><br></div><div class="gmail_default">The peculiar status of glue records has never set easily with me TBH.</div></div><div class="gmail_default" style="font-size:small"><br></div></div>