_acme-challenges mismatch from dns-rfc2136

Help
1

While trying to issue a wildcard certificate to a domain, using DNS-RFC2136 (BIND) plugin in a “certonly” request, certbot registers two TXT _acme-challenge entries on my DNS server, and none matches the ACME challenge expected by the server. Therefore it fails verification.

This is happening with both the dns-rfc2136 plugin and a manual hook I’ve been happily using for the past 2+ years. My original certbot was an ancient 0.38 version, which was updated to 1.3.0 as part of a troubleshooting session.

The “certupdate” command is just a wrapper script that does a few things prior and after the certificate is issued.

It is my understanding wildcard certificates are only issued if requested with DNS challenge, so the HTTP based options are a no go for me. Any advices around this DNS challenge are welcome.

Certbot command - certbot.log.txt (218 Bytes)

CLI output - certbot_cli.log.txt (1.1 KB)

BIND logging DDNS output - named_ddns.log.txt (1.4 KB)

BIND logging zone Xfer output - named_zone_xfer.log.txt (837 Bytes)

letsencrypt.log logfile - letsencrypt.log.txt (30.0 KB)

1 Like
2

Looking at the authorization (https://acme-staging-v02.api.letsencrypt.org/get/authz-v3/43595567), we can see the error:

DNS problem: SERVFAIL looking up TXT for _acme-challenge.hquest.pro.br - the domain's nameservers may be malfunctioning

Running a test through any one of DNS testing sites (Let's Debug), we can see there's a problem with the DNSSEC configuration of the domain:

DNS response for hquest.pro.br had fatal DNSSEC issues: validation failure <hquest.pro.br. CAA IN>: no keys have a DS with algorithm RSASHA1-NSEC3-SHA1 from 2001:470:100::2 for key hquest.pro.br. while building chain of trust

1 Like
3

According to their website, Hurricane Electric’s DNS service doesn’t support DNSSEC. They’ve been “looking into” it for a long time.

[That is not a criticism.]

1 Like
4

“not supporting” and “having a misconfigured DNS server” are two different things @mnordhoff. A DNS server shouldn’t response with SERVFAIL.

1 Like
5

HE does not support hosting master DNSSEC entries, however they work just fine as slave. And yep, seems there are more pressing concerns on my zone. Appreciated for the hints - assumed this piece was OK when it is not.

2 Likes
6

A post was split to a new topic: DNS-01 problem with dehydrated

7

After fixing the DS record on my upstream provider for this domain, and let a few minutes for the propagation to do its magic, I have it all set now, with brand new/renewed certificates!

Thank you @_az for the hint of the letsdebug website - added it to my links arsenal.

2 Likes
8

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.