draft-ietf-acme-dns-account-label

Automated Certificate Management Environment (ACME) DNS Labeled With ACME Account ID Challenge

streamIETF groupacme stateactive pages9 rev03 expires2026-11-16 canonicalhttps://datatracker.ietf.org/doc/draft-ietf-acme-dns-account-label/
This document outlines a new DNS-based challenge type for the ACME protocol that enables multiple independent systems to authorize a single domain name concurrently. By adding a unique label to the DNS validation record name, the dns-account-01 challenge avoids CNAME delegation conflicts inherent to the dns-01 challenge type. This is particularly valuable for multi-region or multi-cloud deployments that wish to rely upon DNS-based domain control validation and need to independently obtain certificates for the same domain.