Specify Zone ID about cloudflare HOT 6 OPEN

I found an interesting quirk, not mentioned in the documentation.

There currently seems to be no way to obtain a certificate for an internal subdomain. As the plugin tries to lookup the dns name to determine the zone, it looks to DNS to get the primary zone. If that subdomain does not exist, it gives up and uses the subdomain as the primary zone for DNS validation. In hopes of being able to obtain certificates for internal only domains, it would be great to have a way to manually specify the primary zone for which the DNS validation should use in the config.

In the meantime, I hope this helps alleviate confusion for people that specified a manual resolver but are still facing DNS related issues. I personally thought at first that the resolvers simply did not work.

from cloudflare.

Okay. I'd happily accept a pull request. It doesn't sound hard. Want to contribute?

from cloudflare.

I believe that the permission used to get zone ID is Zone-Zone-Read, which is not a write permission.

The "Edit" permission is Zone-DNS-Edit, which is needed to set and then delete the TXT record for the ACME challenge(s) in that zone. I don't think that one can really be worked around.

I'm not against making it possible to explicitly provide the zone ID (or maybe a mapping of domain name to zone ID for multiple names), buuuut, I'm not sure how that would remove the need for an edit permission.

from cloudflare.

Cloudflare doesn't let you scope the separate permissions to specific zones inside Cloudflare, only (as far as I can tell) the whole key.

If I could provide the Zone ID then Zone-Zone-Read isn't required which lets me scope the key to a single zone/s. If I do that currently the getting zones part to find the zone ID fails as it doesn't have the required permissions.

Manually providing a mapping would be fantastic as well!

from cloudflare.

There currently seems to be no way to obtain a certificate for an internal subdomain. As the plugin tries to lookup the dns name to determine the zone, it looks to DNS to get the primary zone. If that subdomain does not exist, it gives up and uses the subdomain as the primary zone for DNS validation. In hopes of being able to obtain certificates for internal only domains, it would be great to have a way to manually specify the primary zone for which the DNS validation should use in the config.

Hey, is there any chance to get this fixed?

from cloudflare.

As the plugin tries to lookup the dns name to determine the zone, it looks to DNS to get the primary zone. If that subdomain does not exist, it gives up and uses the subdomain as the primary zone for DNS validation.

This is not a problem if your internal DNS resolver properly specifies the authoritative zone of your internal domains.

Hey, is there any chance to get this fixed?

I'm not sure what needs to be fixed at this point; the issue seems to have diverted from the original topic.

Pull requests welcomed!

from cloudflare.