How to Create DNS-01 Validation Records with Certificate Manager Across GCP Projects

Hello, I'm incompetent.

This doesn't happen often, but when issuing wildcard certificates for projects A and B, in the usual FIXED_RECORD case—or the general case—you need to register the following as the target of a CNAME record:

_acme-challenge.example.com. But in this scenario, both projects point to the same record target, causing a conflict.

So, this option seems to be available only via the gcloud command at the moment. I couldn't find it in the Web Console, so presumably it can only be created via the gcloud command—or, more specifically, through the API. You can avoid this conflict by using the PER_PROJECT_RECORD option. It's a pretty clever mechanism, though it's essentially a Google-specific implementation. I don't think you should generally build your operations around relying on it, but there will probably be situations where it's necessary.

It seems AWS ACM has a similar mechanism, so I don't think this should be an issue when migrating between GCP and AWS.

gcloud certificate-manager dns-authorizations create my-dns-01-auth \
  --domain="*.example.com" \
  --type=PER_PROJECT_RECORD \
  --location=global \
  --project=PROJECT_ID

In that case, you'll need to register records like these:

_acme-challenge_abc123.example.com. CNAME ...
_acme-challenge_xyz123.example.com. CNAME ...

Though I seem to remember that abc123 or xyz123 might be the project ID...