A certificate is not issued for a subdomain

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: dev.tv.mk.ru

I ran this command: certbot certonly --authenticator dns-nicru --dns-nicru-credentials /etc/letsencrypt/credentials.ini --dns-nicru-propagation-seconds 300 --server https://acme-v02.api.letsencrypt.org/directory --agree-tos --rsa-key-size 4096 -d 'dev.tv.mk.ru'

It produced this output: Certbot failed to authenticate some domains (authenticator: dns-nicru). The Certificate Authority reported these problems:
Domain: dev.tv.mk.ru
Type: unauthorized
Detail: No TXT record found at _acme-challenge.dev.tv.mk.ru

Hint: The Certificate Authority failed to verify the DNS TXT records created by --dns-nicru. Ensure the above domains are hosted by this DNS provider, or try increasing --dns-nicru-propagation-seconds (currently 300 seconds).

My web server is (include version): nginx

The operating system my web server runs on is (include version): ubuntu

My hosting provider, if applicable, is: nic.ru

I can login to a root shell on my machine (yes or no, or I don't know): yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel):
The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): 2.9.0

Welcome @Andrey

The first thing you should do is review and fix the errors and warnings shown by the DNSViz site below.

Also, are all of your name servers updated by that dns-nicru authenticator you are using? I did not lookup each of your DNS Servers but some of their names are very different making me think they are different providers and maybe not updated by dns-nicru script. All of your DNS Servers need to have the TXT records for the challenge to succeed.



You helped me a lot and I issued the certificate on the test server. But in production, I get this error
!!!!certbot: error: unrecognized arguments: --dns-nicru-credentials /etc/letsencrypt/credentials_avtovzglyad.ini --dns-nicru-propagation-seconds 700!!!!

I run the following command
certbot certonly --authenticator dns-nicru --dns-nicru-credentials /etc/letsencrypt/credentials_avtovzglyad.ini --dns-nicru-propagation-seconds 700 --server https://acme-v02.api.letsencrypt.org/directory --agree-tos --rsa-key-size 4096 --cert-path /etc/letsencrypt/live/avtovzglyad.ru-test/cert.pem --key-path /etc/letsencrypt/live/avtovzglyad.ru-test/privkey.pem --chain-path /etc/letsencrypt/live/avtovzglyad.ru-test/chain.pem --fullchain-path /etc/letsencrypt/live/avtovzglyad.ru-test/fullchain.pem -d avtovzglyad.ru -d admin.avtovzglyad.ru -d avtovz.ru -d www.avtovz.ru -d www.avtovzglyad.ru

1 Like

certbot plugins
Saving debug log to /var/log/letsencrypt/letsencrypt.log

  • apache
    Description: Apache Web Server plugin
    Interfaces: IAuthenticator, IInstaller, IPlugin
    Entry point: apache = certbot_apache.entrypoint:ENTRYPOINT

  • certbot-dns-nicru:dns-nicru
    Description: Obtain certificates using a DNS TXT record (if you are using nic.ru
    for DNS).
    Interfaces: IAuthenticator, IPlugin
    Entry point: dns-nicru = certbot_dns_nicru.dns_nicru:Authenticator

pip show certbot-dns-nicru
Name: certbot_dns_nicru
Version: 1.0.2
Summary: This plugin for certbot, configures a DNS TXT record to respond to a dns-01 challenge using the nic.ru Remote REST API.
Home-page: GitHub - shizacat/certbot-dns-nicru: A certbot plugin for enabling DNS authentication with nic.ru
Author: Alexey Matveev
Location: /usr/local/lib/python3.8/dist-packages
Requires: acme, certbot, requests, setuptools, sh-nic-api, zope.interface

1 Like

Are you running the same version of Certbot on your test server as this one?

There were some changes in Certbot V2 on how plugins operated. I don't remember the details other than there were some.

I have never seen that DNS plugin used on this forum. You may need to ask this on the github for it. Or, wait for someone here with more info about Certbot versions and DNS plugins.


I've dealt with the last mistake.

But now a new one)
Add record error: Code: 4096. Access forbidden

That sounds like your Certbot nicru plugin could not update the DNS server(s) because of incorrect security credentials.

You still have errors and warnings on your DNS tree per DNSViz that I linked earlier. You may need to fix those.

Or, post on the github for this plugin about this.

If you don't get any response on that plugin github you might look at using the ACME Client acme.sh instead of Certbot. It also supports the nic.ru DNS api.
acme.sh/dnsapi/dns_nic.sh at master · acmesh-official/acme.sh · GitHub


This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.