Do wildcard certificates with subdomain delegation via _acme-challenge work?

[faultymajority]

Question, not a bug report.

Cloudflare outside Enterprise doesn't allow delegating a subdomain, and API DNS edit keys are always for a full zone.

It is my understanding that a CNAME _acme-challenge.sub.domain.example.com -> throwaway-domain.com should allow issuing wildcard certificates *.sub.domain.example.com (and specific certificates as well).

Is this supported currently, and if not would this be a big lift to implement?

[mholt]

I think that would work. What do you mean by "is this supported" though? Let's Encrypt supports it, or do you mean something else?

[faultymajority]

Whether this plugin supports it? I'm not sure whether Caddy itself or this plugin would implement this. If so - might be nice to add an example, if only to point out this approach to work around Cloudflare's lack of API key granularity.

[mholt]

Typically delegation is a more permanent thing, i.e. you create the record and leave it. In that way, I guess an automated record wouldn't even need to be created. 🤔

I haven't tried it tbh. But I'd be open to non-invasive patches if needed.