Amazon Linux 2 wildcard certificate error

Help
1

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: proxytest.library.vanderbilt.edu / *.proxytest.library.vanderbilt.edu

I ran this command: (several commands, actually)

certbot certonly --manual --preferred-challenges dns --debug-challenges -d \*.proxytest.library.vanderbilt.edu -d proxytest.library.vanderbilt.edu

certbot certonly --manual --manual-auth-hook /etc/letsencrypt/acme-dns-auth.py --preferred-challenges dns --debug-challenges -d \*.proxytest.library.vanderbilt.edu

certbot certonly --manual --manual-auth-hook /etc/letsencrypt/acme-dns-auth.py --preferred-challenges dns --debug-challenges -d \*.proxytest.library.vanderbilt.edu -v

certbot certonly --manual -d *.proxytest.library.vandertbilt.edu --agree-tos --preferred-challenges dns-01 --server https://acme-v02.api.letsencrypt.org/directory

certbot certonly --manual -d *.proxytest.library.vandertbilt.edu --agree-tos --preferred-challenges dns01 --server https://acme-v02.api.letsencrypt.org/directory

It produced this output:
DNS problem: NXDOMAIN looking up TXT for _acme-challenge.proxytest.library.vanderbilt.edu - check that a DNS record exists for this domain

but if I do a dig, I see it so I know I have the DNS setup correctly
dig _acme-challenge.proxytest.library.vanderbilt.edu

(This server is on an internal network - not accessible from outside of Vanderbilt)

My web server is (include version):
Apache 2.4.6 / EZProxy

The operating system my web server runs on is (include version):
Amazon Linux 2

My hosting provider, if applicable, is:
Amazon Web Services

I can login to a root shell on my machine (yes or no, or I don't know):
yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel):
no, only through SSH

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot):
certbot 1.11.0

2

You must DIG against public DNS systems [not internal DNS systems].

That could use an upgrade :wink:

2 Likes
3

Your TXT lookup returns a CNAME. And, it apparently has a typo.

It has iblt and not bilt

_acme-challenge.proxytest.library.vanderbilt.edu.	0	IN	CNAME	libvm22.library.vanderiblt.edu.

from:
https://unboundtest.com/m/TXT/_acme-challenge.proxytest.library.vanderbilt.edu/4C4ZLD7H

@rg305 is better able to help with this DNS :slight_smile:

3 Likes
4

Good catch on the TYPO!

But the CNAME is a catch-all and would be secondary to any actual matching entry [which I can't find any at this time - in the public DNS systems].

nslookup -q=cname not-a-real-name-12345.proxytest.library.vanderbilt.edu
not-a-real-name-12345.proxytest.library.vanderbilt.edu  canonical name = libvm22.library.vanderiblt.edu
3 Likes
5

Thanks all, but I am really confused now. We moved our DNS entry from libvm22 to a different server some time ago and if you do the unboundtest.com on just proxytest.library.vanderbilt.edu, you will see that. However, if you add the “_acme-challenge.” In front of that, you get that CNAME typo. But that’s not even listed in our DNS (we use InfoBlox) so I don’t know where that is coming from (the AUTHORITY SECTION seems to be a red flag to me, but I’d appreciate your input).

Query results for TXT proxytest.library.vanderbilt.edu

Response:

;; opcode: QUERY, status: NOERROR, id: 43068

;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:

;proxytest.library.vanderbilt.edu. IN TXT

;; AUTHORITY SECTION:

library.vanderbilt.edu. 0 IN SOA ns1.vanderbilt.edu. noc.vanderbilt.edu. 2013093427 10800 3600 2419200 900

image001.png

image002.png

6

You need to speak with the external DNS university folks:

vanderbilt.edu  nameserver = ns1.vanderbilt.edu
vanderbilt.edu  nameserver = ns2.vanderbilt.edu
vanderbilt.edu  nameserver = ns3.vanderbilt.edu
vanderbilt.edu  nameserver = ns4.vanderbilt.edu
ns1.vanderbilt.edu      internet address = 129.59.9.138
ns2.vanderbilt.edu      internet address = 129.59.9.139
ns3.vanderbilt.edu      internet address = 13.248.152.172
ns4.vanderbilt.edu      internet address = 76.223.17.161
3 Likes
7

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.