Acme-dns.service - Limited DNS server with RESTful HTTP API to handle ACME DNS challenges easily and securely

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: *.free-island.ru

I ran this command: sudo certbot certonly --manual --preferred-challenges dns --manual-auth-hook 'acme-dns-client' -d *.free-island.ru

It produced this output: Saving debug log to /var/log/letsencrypt/letsencrypt.log
Requesting a certificate for *.free-island.ru

Certbot failed to authenticate some domains (authenticator: manual). The Certificate Authority reported these problems:
Domain: free-island.ru
Type: dns
Detail: DNS problem: SERVFAIL looking up TXT for _acme-challenge.free-island.ru - the domain's nameservers may be malfunctioning

Hint: The Certificate Authority failed to verify the DNS TXT records created by the --manual-auth-hook. Ensure that this hook is functioning correctly and that it waits a sufficient duration of time for DNS propagation. Refer to "certbot --help manual" and the Certbot User Guide.

Some challenges have failed.
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.

My web server is (include version): nginx/1.18.0 (Ubuntu)

The operating system my web server runs on is (include version): Ubuntu 20.04.3 LTS

My hosting provider, if applicable, is: hoster.ru

I can login to a root shell on my machine (yes or no, or I don't know): I don't know

I'm using a control panel to manage my site (no, or provide the name and version of the control panel):

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): certbot 1.21.0

Hi @AkakievMD and welcome to the LE community forum :slight_smile:

If you have not already done so, please check that acme-dns-client is able to update your DNS zone.
Also, pay attention to how long it takes for both authoritative DNS servers to become synchronized.
That may be solution to this problem - to wait long enough for the TXT entry to be found in both servers.

nslookup -q=soa _acme-challenge.free-island.ru. ns10.hoster.ru.
nslookup -q=soa _acme-challenge.free-island.ru. ns11.hoster.ru.
nslookup -q=txt _acme-challenge.free-island.ru. ns10.hoster.ru.
nslookup -q=txt _acme-challenge.free-island.ru. ns11.hoster.ru.
1 Like

Проблема в том, что сообщение об ошибке появляется сразу после ввода команды, я пытаюсь сделать ACME-DNS по этому видео: How to Get Letsencrypt WILDCARD Certificate? Renew Certificate | Certbot | DNS Challenge | acme-dns - YouTube
На моменте 26:37 после выполнения команды у него выдается сертификат, у меня ошибка которую я ранее опубликовал


The problem is that the error message appears right after entering the command, I am trying to do ACME-DNS from this video: How to Get Letsencrypt WILDCARD Certificate? Renew Certificate | Certbot | DNS Challenge | acme-dns - YouTube
At the moment 26:37, after executing the command, a certificate is issued to him, I have an error that I previously posted

When using acme-dns, there should only be one authoritative DNS server (typically there will be two NS entries, but both point to the same IP address), and the _acme-challenge subdomain should be a CNAME to a randomly-generated subdomain like 836d7b66-63ae-4a2d-a96e-3e637826feac.acme.free-island.ru. The fact that this CNAME record doesn't exist means that OP is going about this very wrongly.

@AkakievMD, the docs for acme-dns-client are here:

You appear to have missed the part about "create a new acme-dns account for your domain." Suggest you try that again, and make sure to create the correct DNS records.

1 Like

Спасибо, возможно я понял в чем моя ошибка, я попробую ваш вариант, если не получиться я напишу здесь


Thanks, maybe I understood what my mistake was, I will try your option, if it doesn’t work out, I’ll write here

1 Like

If it works, also write about that here.

1 Like

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.