是否可以用cloudflare的Origin CA Key代替Global CA Key?

[tankren]

Steps to reproduce

Debug log

acme.sh  --issue .....   --debug 2

this is not a bug report but new function requirement.
currently, acme is useing api key+user email to generate the cert with DNS-cloudflare method. however it's risky to explose the global api key. and officially from cloudflare, they provide Origin CA Key which is use to "generate TLS certificates for any of your websites on Cloudflare which are only trusted by Cloudflare, but not to read or change any other settings. This is to help keep your websites safe. Origin CA Keys often get deployed on public servers, and in case of compromise, none of your other Cloudflare settings would be accessible." so, could you add this feature in the code? you can refer to "https://api.cloudflare.com/" for details.
thanks.

[FernandoMiguel]

Are you sure origin ca key gives you enough privileges to add a DNS entry?

[Neilpang]

理论上可以, 但是我目前没有时间看

看了一下， Origin CA Key 不行。 它只能生成证书。

[tankren]

Will try to see if it works or not when got time, thx for the reply, both

[Neilpang]

看了一下， Origin CA Key 不行。 它只能生成证书。

[tankren]

看了一下， Origin CA Key 不行。 它只能生成证书。

忘了回复了，昨晚试过，确实不行。
谢谢