Amazon Linux 2 wildcard certificate error

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. |, so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: / *

I ran this command: (several commands, actually)

certbot certonly --manual --preferred-challenges dns --debug-challenges -d \* -d

certbot certonly --manual --manual-auth-hook /etc/letsencrypt/ --preferred-challenges dns --debug-challenges -d \*

certbot certonly --manual --manual-auth-hook /etc/letsencrypt/ --preferred-challenges dns --debug-challenges -d \* -v

certbot certonly --manual -d * --agree-tos --preferred-challenges dns-01 --server

certbot certonly --manual -d * --agree-tos --preferred-challenges dns01 --server

It produced this output:
DNS problem: NXDOMAIN looking up TXT for - check that a DNS record exists for this domain

but if I do a dig, I see it so I know I have the DNS setup correctly

(This server is on an internal network - not accessible from outside of Vanderbilt)

My web server is (include version):
Apache 2.4.6 / EZProxy

The operating system my web server runs on is (include version):
Amazon Linux 2

My hosting provider, if applicable, is:
Amazon Web Services

I can login to a root shell on my machine (yes or no, or I don't know):

I'm using a control panel to manage my site (no, or provide the name and version of the control panel):
no, only through SSH

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot):
certbot 1.11.0

You must DIG against public DNS systems [not internal DNS systems].

That could use an upgrade :wink:


Your TXT lookup returns a CNAME. And, it apparently has a typo.

It has iblt and not bilt	0	IN	CNAME


@rg305 is better able to help with this DNS :slight_smile:


Good catch on the TYPO!

But the CNAME is a catch-all and would be secondary to any actual matching entry [which I can't find any at this time - in the public DNS systems].

nslookup -q=cname  canonical name =

Thanks all, but I am really confused now. We moved our DNS entry from libvm22 to a different server some time ago and if you do the on just, you will see that. However, if you add the “_acme-challenge.” In front of that, you get that CNAME typo. But that’s not even listed in our DNS (we use InfoBlox) so I don’t know where that is coming from (the AUTHORITY SECTION seems to be a red flag to me, but I’d appreciate your input).

Query results for TXT


;; opcode: QUERY, status: NOERROR, id: 43068

;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0



;; AUTHORITY SECTION: 0 IN SOA 2013093427 10800 3600 2419200 900



You need to speak with the external DNS university folks:  nameserver =  nameserver =  nameserver =  nameserver =      internet address =      internet address =      internet address =      internet address =

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.