DNS verification for ACME plugin

[tiny-pangolin]

I would like to be able to issue certificates using the ACME plugin with DNS verification so I can issue wildcard certs and/or issue well known certs to internal services

[xianghai2]

Hi @tiny-pangolin , could you clarify your use case in details? thanks.

[tiny-pangolin]

my current use case is I run multiple internal sites using docker and would like to issue ACME certificates to those internal services. Since they are not exposed publically I can't use the acme plugin since it only supports http verification, and AFAIK there is not something like cert-manager that is used in docker so it usually falls on the apigateway or reverse proxy to issue certs in docker. The reason for not issuing internal certs is that it is a giant pain to add CA certs on mobile devices and multiple desktop operating systems

[xianghai2]

The ACME plugin should work with both 'https' and 'http' protocol.
https://docs.konghq.com/hub/kong-inc/acme/configuration/

Looks like that I may not catch the point of this configuation issue?

[tiny-pangolin]

The issue with this plugin for my use case is that HTTP verification requires port 80 and/or 443 is publically accessible. I was hoping Kong could add DNS-01 verification so I could get a widely accepted certificates without publically exposing my api gateway

[tiny-pangolin]

Currently I'm using traefik for this but, I would like to evaluate kong for improved performance and the ability to manage API keys

[xianghai2]

Got it.
At this moment, acme plugin does not support dns-01 challenge. It’s on our roadmap but not prioritized right now. thanks.