From: "Theo de Raadt" <deraadt@openbsd.org>
Subject: Re: allow wildcard altnames in acme-client.conf
To: tech@openbsd.org
Date: Fri, 18 Sep 2026 08:29:52 -0600

Stuart Henderson <stu@spacehopper.org> wrote:

> It would seem reasonable for acme-client to run a user script to update
> zones - on a pure-base install that script could write to a file which
> is $INCLUDE'd in a zone and reload/notify - otherwise poke at a DNS
> provider's API or nsupdate.

The privsep will get in the way.  Probably requires a good amount of
surgery.  But it will be worth it to have a way to perform actions,
maybe also for other things?