I am the developer for a large content management system that produces free websites from content entered in simple forms for Toastmasters public speaking clubs. Users also have the option to enter a custom domain name that they registered on their own (+ point to our server) into one of the form …

[image] SteveTheTechie: My presumed workflow (via Perl script) for a new cert is as follows... (Does this sound reasonable?) a. Detect new, changed, or deleted domain name entered in settings form for website. b. If changed, then check for existing cert, and if found ditch it. c. If domai…

[image] schoen: In the course of what I assume was your testing, you've issued certificates for the same names many times this week: crt.sh | %mindfulcommunicators.org It's the existence of those other certificates which is producing this rate limit error. The response to that is to wait befor…

[image] leader: As I mentioned, the utility code that does the expiration checks will be moved from the client into the library with the next release, so hopefully that will ease the renewal task a bit :slight_smile: Thanks. I understood that the renewals were essentially a variation on the …

[image] schoen: [image] SteveTheTechie: Ok, but I am not sure why I should be getting the above error... My impression was that the renewal mechanisms just do a check on time remaining to cert expiration and if in the supplied "window" of time, then they just re-request the cert... is that…

[image] SteveTheTechie: I am wondering if the rate limits also apply to the staging server... (My server admin was carping about me not producing certs from the live server previously... so here we are with the rate limits.) This is, indeed, the main purpose of the staging server (it has muc…

@leader / @schoen : I am now producing certs in bulk for all the various domain names my users have mapped to our server, as I intended. Thank you both for all your wonderful assistance!!! :smiley: However, now I am scrutinizing the domain verification failures listed in my log file to see if I…

hi @SteveTheTechie This is probably because boulder doesn't use public resolvers :smiley: [image] Challenge creation issue and pending authorization rate limit Client dev … So when you run your queries don't run them against a public dns (google etc) run them agains…

@ahaw021 : Thanks for your reply! I am a bit puzzled why you do not use public resolvers–I am guessing that I am missing something significant to domain verification. I am not sure of the best course for dealing with this since I am using the perl Crypt::LE module and not accessing the Boulder ser…

@ahaw021 ’s point is that Boulder doesn’t use someone else’s nameserver to do the lookup (whether an ISP nameserver, a public server like 8.8.8.8, or a local copy of BIND or something). When you use dig, it’s looking at your local /etc/resolv.conf to decide which nameserver to ask to do the lookup fo…

@schoen : Ok thanks for the clarification! So, I am still left with what is my best course of action. Since I am using dig as a “pre-check” test, I could tell it what name server to use, if I knew which to specify for the dig command. See http://droptips.com/using-dig-to-query-a-specific-dns-ser…

Right, but there is no single nameserver that matches the behavior of an iterative query. I believe the iterative process for community.letsencrypt.org would require asking (say) dig ns org @a.root-servers.net then (say) dig soa org @a0.org.afilias-nst.info dig ns letsencrypt.org @a0.org.afilias…

Best Practices Using a Perl Client Module?

Client dev

ahaw021 June 5, 2017, 12:36pm 37

hi @SteveTheTechie

This is probably because boulder doesn't use public resolvers

So when you run your queries don't run them against a public dns (google etc) run them against the specific name servers.

Andrei

Topic		Replies	Views
Multi-domain Cert using Crypt:LE and DNS.pm Module Help	20	3125	March 26, 2019
Can't renew with certbot or Crypt::LE, Timeout during secondary validation (403 resolved) Help	80	2772	May 1, 2024
Some Domains Suddenly Failing Renewal or New Cert Issue Help	19	806	April 8, 2026
Help for noob on the cert tools Help	14	3341	August 10, 2016
How to provide CSR and verify identity without HTTPS? Help	44	2417	September 5, 2020

Best Practices Using a Perl Client Module?

Related topics