ACME DNS-01 broker

Wire-compatible with acme-dns, so cert-manager, acme.sh, lego, and Traefik work unchanged — point them at https://acme.comglue.tech.

1Register — once per certificate name

No account needed. The password is shown once and stored only as a digest.

curl -X POST https://acme.comglue.tech/register

{"username":"9…", "password":"…", "subdomain":"58…",
 "fulldomain":"58….acme.comglue.tech", "allowfrom":[]}

Optionally pin updates to your network: {"allowfrom":["203.0.113.0/24"]}.

2CNAME your challenge record at the broker

One record in your real zone, created once, with your normal DNS workflow:

_acme-challenge.example.com.  CNAME  58….acme.comglue.tech.

3Let your ACME client update the challenge

This is what acme-dns-aware clients do automatically on every issuance:

curl -X POST https://acme.comglue.tech/update \
  -H "X-Api-User: <username>" -H "X-Api-Key: <password>" \
  -d '{"subdomain":"<subdomain>","txt":"<key authorization digest>"}'

Let's Encrypt follows the CNAME, reads the TXT from the broker's own authoritative servers, and issues. Your zone's API keys never leave home.

Properties worth knowing

Blast radius of a stolen credential: One TXT record at one random label. No zone access, no other records, no reuse elsewhere. Add allowfrom and it does not even work off your network.
Storage: Credentials are held as SHA-256 digests and verified in constant time; the plaintext is unrecoverable after registration.
Two values per label: The broker retains the two most recent TXT values, because issuing example.com + *.example.com validates two challenges at the same name.
Authoritative-only DNS: The broker's DNS answers only for its zone. Zone transfers, ANY, and everything out-of-zone are refused.