For ACME http-01, using HTTPS records isn't allowed. TLS BR domain validation method 19 (ACME http-01) requires that validations are done using http-01 as defined in section 8.3 of RFC 8555 [1]. Section 8.3 says:
> As a domain may resolve to multiple IPv4 and IPv6 addresses, the server will connect to at least one of the hosts found in the DNS A and AAAA records, at its discretion. This makes it clear the IP address must be sourced from an A or AAAA record. In addition to the above passage, section 8.3 says in the next sentence: > Because many web servers allocate a default HTTPS virtual host to a particular low-privilege tenant user in a subtle and non-intuitive manner, the challenge must be completed over HTTP, not HTTPS. Section 9.5 of RFC 9460 [2] states that HTTPS records are a signal to the client to only use secure transport. Using HTTPS records to complete ACME http-01 challenges would violate this, as the initial request must be performed over plaintext HTTP. Thanks, Corey [1] https://datatracker.ietf.org/doc/html/rfc8555#section-8.3 [2] https://datatracker.ietf.org/doc/html/rfc9460#hsts On Tuesday, August 18, 2026 at 8:01:26 AM UTC-4 Suchan Seo wrote: > Someone asked this at Let's encrypt forum. > > https://community.letsencrypt.org/t/support-for-https-records-in-alias-mode/250456 > > Baseline requirement 3.2.2.4 is silent about how CA parse DNS record to > get IP address of a domain, as they are written before this become a thing. > I'd say thats a hint, not an authoritative source, but It'd better write > explicit rule about this > -- You received this message because you are subscribed to the Google Groups "[email protected]" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion visit https://groups.google.com/a/mozilla.org/d/msgid/dev-security-policy/25905ede-8d44-4809-bb9f-a05d93b4d66en%40mozilla.org.
