From: "Theo de Raadt" <deraadt@openbsd.org>
Subject: Re: allow wildcard altnames in acme-client.conf
To: Gregory Edigarov <edigarov@qarea.com>
Cc: tech@openbsd.org
Date: Fri, 18 Sep 2026 10:14:22 -0600

Gregory Edigarov <edigarov@qarea.com> wrote:

> On 9/18/26 17:29, Theo de Raadt wrote:
> > Stuart Henderson <stu@spacehopper.org> wrote:
> >
> >> It would seem reasonable for acme-client to run a user script to update
> >> zones - on a pure-base install that script could write to a file which
> >> is $INCLUDE'd in a zone and reload/notify - otherwise poke at a DNS
> >> provider's API or nsupdate.
> > The privsep will get in the way.  Probably requires a good amount of
> > surgery.  But it will be worth it to have a way to perform actions,
> > maybe also for other things?
> with that new 47 days certificate lifespan the way to automate it
> become a must. sorry, just my 0.005 cents

Oh, apparently acme-client cannot currently be used in automation.
Simply doesn't work, at all.

That is news to all of us.

Cut the drama, ok?