Improve wording in manual DNS instructions
Author: peterg-ghCreated Dec 8, 2023Updated Sep 6, 2026
Labelsarea: ui / uxarea: manual authenticatorpriority: unplanned
Certbot's behavior differed from what I expected because:
I have 6 domains for which I want a certificate:
certbot certonly \ --authenticator manual \ --preferred-challenges dns-01 \ -d 'yugen.me.uk' -d '*.yugen.me.uk' \ -d 'sabi.co.uk' -d '*.sabi.co.uk' \ -d 'sabi.uk' -d '*.sabi.uk'I get six different prompts for
_acme-challenge, and they all tell me to check immediately that the challenge RR is deployed.Verification happens, unannounced, after the last prompt.
This is suboptimal because:
- There is no need to have a separate challenge for
example.comand*.example.combecause the wildcard can only happen in the same zone as the domain, because the wildcard is an attribute ofexample.comand not a subdomain ofexample.com. - There is no need for checking that each invidivual RR is deployed, the check needs to be done just before verification.
- That verification is about to happen after the last challenge is prompted for is not announced.
Simple improvements that I would like to see:
- Don't require challenges for wildcards if the main subdomain is also listed.
- Simple list all domains and the challenges for them without prompting.
- Only prompt at the end by saying something like "Please ensure that all records above are deployed, the next step will verify them.
Source: certbot/certbot