TIL, thanks! This makes dns challange automation more approachable for me. I always had an issue with API keys which scope can't be limited to TXT records. This seems to be a nice workaround
I've documented how to securely set up TLS certificates for internal services without creating TLS issues for http clients downstream. All thanks to split-horizon DNS, WAF and ACME protocol. All for free!
"It is still being assembled deep inside a mountain in west Texas. The Clock provides a rare invitation to think and engineer at the timescale of civilization. It offers an enduring symbol of our personal connection to the distant future."
... and it is even already documented at https://github.com/acmesh-official/acme.sh/wiki/DNS-alias-mo...