#9859·certbot

Improve wording in manual DNS instructions

Author: peterg-ghCreated Dec 8, 2023Updated Sep 6, 2026
Labelsarea: ui / uxarea: manual authenticatorpriority: unplanned

Certbot's behavior differed from what I expected because:

  • I have 6 domains for which I want a certificate:

    bash
    certbot certonly \
      --authenticator manual \
     --preferred-challenges dns-01 \
    -d 'yugen.me.uk' -d '*.yugen.me.uk' \
    -d 'sabi.co.uk' -d '*.sabi.co.uk' \
    -d 'sabi.uk' -d '*.sabi.uk'
  • I get six different prompts for _acme-challenge, and they all tell me to check immediately that the challenge RR is deployed.

  • Verification happens, unannounced, after the last prompt.

This is suboptimal because:

  • There is no need to have a separate challenge for example.com and *.example.com because the wildcard can only happen in the same zone as the domain, because the wildcard is an attribute of example.com and not a subdomain of example.com.
  • There is no need for checking that each invidivual RR is deployed, the check needs to be done just before verification.
  • That verification is about to happen after the last challenge is prompted for is not announced.

Simple improvements that I would like to see:

  • Don't require challenges for wildcards if the main subdomain is also listed.
  • Simple list all domains and the challenges for them without prompting.
  • Only prompt at the end by saying something like "Please ensure that all records above are deployed, the next step will verify them.