{"id":2674,"date":"2026-02-03T10:35:28","date_gmt":"2026-02-03T09:35:28","guid":{"rendered":"https:\/\/yellotab.se\/x056\/?p=2674"},"modified":"2026-02-03T14:49:50","modified_gmt":"2026-02-03T13:49:50","slug":"dns-01-challenge","status":"publish","type":"post","link":"https:\/\/yellotab.se\/x056\/2026\/02\/03\/dns-01-challenge\/","title":{"rendered":"DNS-01\u00a0challenge"},"content":{"rendered":"\n

DNS-01 challenge<\/strong> \u00e4r ett s\u00e4tt att bevisa f\u00f6r en certifikatutf\u00e4rdare (t.ex. Let\u2019s Encrypt) att du \u00e4ger en dom\u00e4n<\/strong> \u2013 utan att n\u00e5gon webbtj\u00e4nst beh\u00f6ver vara \u00e5tkomlig fr\u00e5n internet. \ud83d\udd10<\/p>\n\n\n\n

Det \u00e4r nyckeln<\/strong> till att kunna k\u00f6ra riktiga TLS-cert \u00e4ven p\u00e5 helt lokala tj\u00e4nster<\/strong>.<\/p>\n\n\n\n

\n\n\n\n

Grundid\u00e9n (kort och tydligt)<\/strong><\/h2>\n\n\n\n

N\u00e4r du beg\u00e4r ett cert f\u00f6r t.ex.:<\/p>\n\n\n\n

home.jidoka.se<\/code><\/pre>\n\n\n\n
s\u00e4ger Let\u2019s Encrypt:<\/p>\n\n\n\n
\n
\u201cVisa att du kontrollerar jidoka.se\u201d<\/p>\n<\/blockquote>\n\n\n\n
Du g\u00f6r det genom att l\u00e4gga in en s\u00e4rskild TXT-post i DNS<\/strong>.<\/p>\n\n\n\n
\n\n\n\n
Hur DNS-01 funkar \u2013 steg f\u00f6r steg<\/strong><\/h2>\n\n\n\n
    \n
  1. Du beg\u00e4r ett cert (manuellt eller automatiskt)<\/li>\n\n\n\n
  2. Certutf\u00e4rdaren ger dig en\u00a0token<\/strong>, typ:<\/li>\n<\/ol>\n\n\n\n
    abc123xyz<\/code><\/pre>\n\n\n\n

       3. Du skapar denna DNS-post:<\/p>\n\n\n\n
    _acme-challenge.home.jidoka.se  TXT  "abc123xyz"<\/code><\/pre>\n\n\n\n
      \n
    1. Let\u2019s Encrypt kollar DNS:\n
        \n
      • Finns TXT-posten?<\/li>\n\n\n\n
      • Matchar token?<\/li>\n<\/ul>\n<\/li>\n\n\n\n
      • \u2705 Cert utf\u00e4rdas<\/li>\n\n\n\n
      • TXT-posten kan tas bort igen<\/li>\n<\/ol>\n\n\n\n
        \ud83c\udf89 Klart. Ingen port 80\/443 beh\u00f6ver vara \u00f6ppen.<\/p>\n\n\n\n

        Varf\u00f6r DNS-01 \u00e4r s\u00e5 bra (j\u00e4mf\u00f6rt med HTTP-01)<\/strong><\/p>\n\n\n\n
        Metod<\/strong><\/th>Kr\u00e4ver publik IP<\/strong><\/th>Funkar bakom NAT<\/strong><\/th>Wildcard<\/strong><\/th><\/tr><\/thead>
        HTTP-01<\/td>\u274c Ja<\/td>\u274c Nej<\/td>\u274c<\/td><\/tr>
        DNS-01<\/strong><\/td>\u2705 Nej<\/td>\u2705 Ja<\/td>\u2705 Ja<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
        \ud83d\udc49 Wildcard-cert (*.home.jidoka.se) kr\u00e4ver DNS-01<\/strong><\/p>\n\n\n\n
        \n\n\n\n
        Typiska anv\u00e4ndningsfall<\/strong><\/h2>\n\n\n\n
        DNS-01 anv\u00e4nds n\u00e4r:<\/p>\n\n\n\n
          \n
        • Tj\u00e4nsten \u00e4r\u00a0endast lokal<\/strong><\/li>\n\n\n\n
        • Du k\u00f6r\u00a0split DNS<\/strong><\/li>\n\n\n\n
        • Du vill ha\u00a0wildcard-cert<\/strong><\/li>\n\n\n\n
        • Du k\u00f6r:\n
            \n
          • Home Assistant<\/li>\n\n\n\n
          • UniFi<\/li>\n\n\n\n
          • Nginx Proxy Manager<\/li>\n\n\n\n
          • Proxmox<\/li>\n\n\n\n
          • OIDC \/ mTLS \/ Zero-Trust<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n
            (dvs exakt ditt case \ud83d\ude04)<\/p>\n\n\n\n
            \n\n\n\n
            Hur g\u00f6r man detta i praktiken?<\/strong><\/h2>\n\n\n\n
            Automatiskt (rekommenderat)<\/strong><\/h3>\n\n\n\n
            Cert-klienten pratar direkt med din DNS-leverant\u00f6rs API.<\/p>\n\n\n\n
            Exempel:<\/p>\n\n\n\n
              \n
            • certbot<\/li>\n\n\n\n
            • acme.sh<\/li>\n\n\n\n
            • Nginx Proxy Manager<\/li>\n\n\n\n
            • Traefik<\/li>\n<\/ul>\n\n\n\n
              De:<\/p>\n\n\n\n
                \n
              • skapar TXT-posten<\/li>\n\n\n\n
              • v\u00e4ntar<\/li>\n\n\n\n
              • tar bort den<\/li>\n\n\n\n
              • f\u00f6rnyar cert var 60\u201390 dag<\/li>\n<\/ul>\n\n\n\n
                Du beh\u00f6ver bara:<\/p>\n\n\n\n
                  \n
                • API-nyckel till DNS-leverant\u00f6ren<\/li>\n<\/ul>\n\n\n\n
                  \n\n\n\n
                  Manuellt (f\u00f6r test)<\/strong><\/h3>\n\n\n\n
                    \n
                  1. K\u00f6r cert-klienten<\/li>\n\n\n\n
                  2. Den s\u00e4ger: \u201cl\u00e4gg till denna TXT-post\u201d<\/li>\n\n\n\n
                  3. Du loggar in hos DNS-leverant\u00f6ren<\/li>\n\n\n\n
                  4. L\u00e4gg till posten<\/li>\n\n\n\n
                  5. V\u00e4nta ~1\u20132 min<\/li>\n\n\n\n
                  6. Tryck Enter<\/li>\n<\/ol>\n\n\n\n
                    \n\n\n\n
                    Vanliga f\u00e4llor \u26a0\ufe0f<\/strong><\/h2>\n\n\n\n
                      \n
                    • \u274c Gl\u00f6mmer att DNS-posten ska ligga p\u00e5\u00a0r\u00e4tt niv\u00e5<\/strong><\/li>\n\n\n\n
                    • \u274c TTL f\u00f6r h\u00f6gt (anv\u00e4nd 60 sek)<\/li>\n\n\n\n
                    • \u274c DNS-provider utan API \u2192 kr\u00e5ngligt att automatisera<\/li>\n\n\n\n
                    • \u274c Blandar intern och publik DNS-zon (split DNS ska vara tydlig)<\/li>\n<\/ul>\n\n\n\n
                      \n\n\n\n
                      I din milj\u00f6 (konkret)<\/strong><\/h2>\n\n\n\n
                      Med jidoka.se skulle jag g\u00f6ra:<\/p>\n\n\n\n
                        \n
                      • Wildcard:<\/li>\n<\/ul>\n\n\n\n
                        *.home.jidoka.se<\/code><\/pre>\n\n\n\n
                          \n
                        • DNS-01 via:\n
                            \n
                          • Nginx Proxy Manager\u00a0eller<\/strong><\/li>\n\n\n\n
                          • certbot + DNS-plugin f\u00f6r din DNS-host<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n
                            Sedan:<\/p>\n\n\n\n
                              \n
                            • interna DNS pekar\u00a0*.home.jidoka.se\u00a0\u2192 192.168.x.x<\/li>\n\n\n\n
                            • publika DNS beh\u00f6ver\u00a0inte<\/strong>\u00a0peka n\u00e5gonstans alls<\/li>\n<\/ul>\n\n\n\n
                              <\/p>\n","protected":false},"excerpt":{"rendered":"
                              DNS-01 challenge \u00e4r ett s\u00e4tt att bevisa f\u00f6r en certifikatutf\u00e4rdare (t.ex. Let\u2019s Encrypt) att du \u00e4ger en dom\u00e4n \u2013 utan att n\u00e5gon webbtj\u00e4nst beh\u00f6ver vara \u00e5tkomlig fr\u00e5n internet. \ud83d\udd10 Det \u00e4r nyckeln till att kunna k\u00f6ra riktiga TLS-cert \u00e4ven p\u00e5 helt lokala tj\u00e4nster. Grundid\u00e9n (kort och tydligt) N\u00e4r du beg\u00e4r ett cert f\u00f6r t.ex.: s\u00e4ger Let\u2019s Encrypt: \u201cVisa att du kontrollerar jidoka.se\u201d Du […]<\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[1],"tags":[],"class_list":["post-2674","post","type-post","status-publish","format-standard","hentry","category-news"],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/yellotab.se\/x056\/wp-json\/wp\/v2\/posts\/2674","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/yellotab.se\/x056\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/yellotab.se\/x056\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/yellotab.se\/x056\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/yellotab.se\/x056\/wp-json\/wp\/v2\/comments?post=2674"}],"version-history":[{"count":4,"href":"https:\/\/yellotab.se\/x056\/wp-json\/wp\/v2\/posts\/2674\/revisions"}],"predecessor-version":[{"id":2680,"href":"https:\/\/yellotab.se\/x056\/wp-json\/wp\/v2\/posts\/2674\/revisions\/2680"}],"wp:attachment":[{"href":"https:\/\/yellotab.se\/x056\/wp-json\/wp\/v2\/media?parent=2674"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/yellotab.se\/x056\/wp-json\/wp\/v2\/categories?post=2674"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/yellotab.se\/x056\/wp-json\/wp\/v2\/tags?post=2674"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}