While trying to issue a wildcard certificate to a domain, using DNS-RFC2136 (BIND) plugin in a “certonly” request, certbot registers two TXT _acme-challenge entries on my DNS server, and none matches the ACME challenge expected by the server. Therefore it fails verification. This is happening with…

Looking at the authorization ( https://acme-staging-v02.api.letsencrypt.org/get/authz-v3/43595567 ), we can see the error: DNS problem: SERVFAIL looking up TXT for _acme-challenge.hquest.pro.br - the domain's nameservers may be malfunctioning Running a test through any one of DNS testing sites ( L…

According to their website , Hurricane Electric’s DNS service doesn’t support DNSSEC. They’ve been “looking into” it for a long time. [That is not a criticism.]

“not supporting” and “having a misconfigured DNS server” are two different things @mnordhoff . A DNS server shouldn’t response with SERVFAIL.

HE does not support hosting master DNSSEC entries, however they work just fine as slave. And yep, seems there are more pressing concerns on my zone. Appreciated for the hints - assumed this piece was OK when it is not.

After fixing the DS record on my upstream provider for this domain, and let a few minutes for the propagation to do its magic, I have it all set now, with brand new/renewed certificates! Thank you @_az for the hint of the letsdebug website - added it to my links arsenal.

_acme-challenges mismatch from dns-rfc2136

Help

Topic		Replies	Views
Can't generate my Wildcard Certificate by DNS-01 challenge Help	4	2174	December 19, 2019
DNS Challenge does not work Help	3	1606	May 18, 2020
RFC2136 - _acme-challenge record not found Help	8	1889	February 8, 2021
Dns challenge not recognized Server	6	1907	October 13, 2018
DNS Challenge only works for root name Help	17	4043	November 9, 2017

_acme-challenges mismatch from dns-rfc2136

Related topics