[GH-ISSUE #263] Whitelisted domains only #133

New issue

Open

opened 2026-03-13 15:52:51 +03:00 by kerem · 4 comments

kerem commented

2026-03-13 15:52:51 +03:00

Owner

Originally created by @saudiqbal on GitHub (May 20, 2021).
Original GitHub issue: https://github.com/acme-dns/acme-dns/issues/263

Is it possible to only register domains in a white list only? Like
whitelist_domain = ["domain.com, domain.org"]

Originally created by @saudiqbal on GitHub (May 20, 2021). Original GitHub issue: https://github.com/acme-dns/acme-dns/issues/263 Is it possible to only register domains in a white list only? Like `whitelist_domain = ["domain.com, domain.org"]`

kerem commented

2026-03-13 15:52:57 +03:00

Author

Owner

@webprofusion-chrisc commented on GitHub (May 20, 2021):

The standard /register/ endpoint doesn't actually know your domain, so currently you couldn't whitelist domains in standard acme-dns.

If the objective is to limit registrations to certain authorised users:

You can however run a proxy (any web server or proxying service) in front of the API and require basic authentication, like https://user:password@your-acme-dns.server/register - that does depend on the acme-dns client being compatible though as it then has to convert those into an Authorization: Basic <base64credentials> http header. Some do this automatically.
Another alternative is to put a key in the URL https://your-acme-dns.server/ABC123KEY/register

@webprofusion-chrisc commented on GitHub (May 20, 2021): The standard /register/ endpoint doesn't actually know your domain, so currently you couldn't whitelist domains in standard acme-dns. If the objective is to limit registrations to certain authorised users: - You can however run a proxy (any web server or proxying service) in front of the API and require basic authentication, like https://user:password@your-acme-dns.server/register - that does depend on the acme-dns client being compatible though as it then has to convert those into an `Authorization: Basic <base64credentials>` http header. Some do this automatically. - Another alternative is to put a key in the URL https://your-acme-dns.server/ABC123KEY/register

kerem commented

2026-03-13 15:53:02 +03:00

Author

Owner

@saudiqbal commented on GitHub (May 20, 2021):

Thanks, I like the idea of using a key in the url, can you explain where do I set the value ABC123KEY, I cannot find any documentation for where to set it.

@saudiqbal commented on GitHub (May 20, 2021): Thanks, I like the idea of using a key in the url, can you explain where do I set the value ABC123KEY, I cannot find any documentation for where to set it.

kerem commented

2026-03-13 15:53:07 +03:00

Author

Owner

@saudiqbal commented on GitHub (Sep 18, 2023):

It would be nice to set a variable in config to define a key in the URL $key as https://your-acme-dns.server/$key/register

@saudiqbal commented on GitHub (Sep 18, 2023): It would be nice to set a variable in config to define a key in the URL $key as https://your-acme-dns.server/$key/register

kerem commented

2026-03-13 15:53:12 +03:00

Author

Owner

@TomyLobo commented on GitHub (Sep 3, 2024):

Either use a firewall rule to whitelist access to acme-dns or use a reverse proxy to enforce basic auth on the /register endpoint, like @webprofusion-chrisc suggested.
We've been successfully using the firewall approach for years.

Your suggestion to make the registration endpoint configurable complicates the manual, adds maintenance burden and is less secure than the two already supported measures I listed.
The PR you are asking the maintainers to merge is lacking test cases for the proposed changes and doesn't update the manual either.

If you're concerned about scans, I'd suggest you to set up a firewall or an nginx reverse proxy to protect your acme-dns instance.
I'm confident that anyone could have learned how to do that in the almost 3 years you've been commenting about this on various issue threads.

@TomyLobo commented on GitHub (Sep 3, 2024): Either use a firewall rule to whitelist access to acme-dns or use a reverse proxy to enforce basic auth on the /register endpoint, like @webprofusion-chrisc suggested. We've been successfully using the firewall approach for years. Your suggestion to make the registration endpoint configurable complicates the manual, adds maintenance burden and is less secure than the two already supported measures I listed. The PR you are asking the maintainers to merge is lacking test cases for the proposed changes and doesn't update the manual either. If you're concerned about scans, I'd suggest you to set up a firewall or an nginx reverse proxy to protect your acme-dns instance. I'm confident that anyone could have learned how to do that in the almost 3 years you've been commenting about this on various issue threads.