Acme.sh - DNS manual mode - Unable to verify TXT

Help
1

Unable to verify TXT to generate certificate

My domain is:
api.opsplatform.ad.net
I ran this command:

With the TXT acme challenge set in DNS.

aidan.wong@H69T4FQ1JY ssl-cert-tools % docker exec acme.sh-letsencrypt /root/.acme.sh/acme.sh --renew -d api.opsplatform.ad.net --yes-I-know-dns-manual-mode-enough-go-ahead-please --server letsencrypt 2>&1'"
[Tue Aug  4 19:29:22 UTC 2026] The domain 'api.opsplatform.ad.net' seems to already have an ECC cert, let's use it.
[Tue Aug  4 19:29:22 UTC 2026] Renew: api.opsplatform.ad.net
[Tue Aug  4 19:29:22 UTC 2026] Renewing: 'api.opsplatform.ad.net'
[Tue Aug  4 19:29:22 UTC 2026] Renewing using Le_API=https://acme-v02.api.letsencrypt.org/directory
[Tue Aug  4 19:29:23 UTC 2026] Using CA: https://acme-v02.api.letsencrypt.org/directory
[Tue Aug  4 19:29:23 UTC 2026] Single domain='api.opsplatform.ad.net'
[Tue Aug  4 19:29:23 UTC 2026] Verifying: api.opsplatform.ad.net
[Tue Aug  4 19:29:23 UTC 2026] Pending. The CA is processing your order, please wait. (1/30)
[Tue Aug  4 19:29:26 UTC 2026] api.opsplatform.ad.net: Invalid status. Verification error details: During secondary validation: Incorrect TXT record \
[Tue Aug  4 19:29:26 UTC 2026] Please add '--debug' or '--log' to see more information.
[Tue Aug  4 19:29:26 UTC 2026] See: https://github.com/acmesh-official/acme.sh/wiki/How-to-debug-acme.sh
aidan.wong@H69T4FQ1JY ssl-cert-tools % docker exec acme.sh-letsencrypt /root/.acme.sh/acme.sh --renew -d api.opsplatform.ad.net --yes-I-know-dns-manual-mode-enough-go-ahead-please --server letsencrypt 2>&1
[Tue Aug  4 19:29:32 UTC 2026] The domain 'api.opsplatform.ad.net' seems to already have an ECC cert, let's use it.
[Tue Aug  4 19:29:32 UTC 2026] Renew: api.opsplatform.ad.net
[Tue Aug  4 19:29:32 UTC 2026] Renewing: 'api.opsplatform.ad.net'
[Tue Aug  4 19:29:32 UTC 2026] Renewing using Le_API=https://acme-v02.api.letsencrypt.org/directory
[Tue Aug  4 19:29:32 UTC 2026] Using CA: https://acme-v02.api.letsencrypt.org/directory
[Tue Aug  4 19:29:32 UTC 2026] Single domain='api.opsplatform.ad.net'
[Tue Aug  4 19:29:34 UTC 2026] Getting webroot for domain='api.opsplatform.ad.net'
[Tue Aug  4 19:29:34 UTC 2026] Cannot find DNS API hook for: dns_manual
[Tue Aug  4 19:29:34 UTC 2026] You need to add the TXT record manually.
[Tue Aug  4 19:29:34 UTC 2026] Add the following TXT record:
[Tue Aug  4 19:29:34 UTC 2026] Domain: '_acme-challenge.api.opsplatform.ad.net'
[Tue Aug  4 19:29:34 UTC 2026] TXT value: '53ssHwpvBvhwHnnRk1t4qxjo8_nvcEB5ZjUSQGg_mY8'
[Tue Aug  4 19:29:34 UTC 2026] Please make sure to prepend '_acme-challenge.' to your domain
[Tue Aug  4 19:29:34 UTC 2026] so that the resulting subdomain is: _acme-challenge.api.opsplatform.ad.net
[Tue Aug  4 19:29:34 UTC 2026] Please add the TXT records to the domains, and re-run with --renew.
[Tue Aug  4 19:29:34 UTC 2026] Please add '--debug' or '--log' to see more information.
[Tue Aug  4 19:29:34 UTC 2026] See: https://github.com/acmesh-official/acme.sh/wiki/How-to-debug-acme.sh

acme.sh 3.1.2

2

There appears to be an issue with propagation in your DNS setup, ns1.ad.net is serving

_acme-challenge.api.opsplatform.ad.net.	300 IN TXT "afpXnJIAOfOJJOuRTOpyyKNIvqFOB7fmjcsl9nUCLKk"

as the sole TXT record, whereas ns2.ad.net is serving

_acme-challenge.api.opsplatform.ad.net.	300 IN TXT "tvWHwcs6m4j2szeZrUBPfQ-WuWTNZOfBCaduOGKw0_A"
_acme-challenge.api.opsplatform.ad.net.	300 IN TXT "S4BA-bnEAr0g8iY-xd9giUQZ2dlMmxQHIcjrgdhM2k8"

I don't know what DNS software/provider you're using so I can't give specific advice, however I'd recommend checking if the primary DNS server is sending update notifications to the secondary DNS server[1].

  1. These might also be referred to as master and slave servers ↩︎