My operating system is (include version): Ubuntu 24.04
I installed Certbot with (snap, OS package manager, pip, certbot-auto, etc):
I'm actually run SWAG docker implementation which I'm aware runs certbot within a container. (bear with me). I'm not looking for docker help as the issue has to do with certbot and specifically with the inability to specify a DNS resolver.
I ran this command and it produced this output:
Certbot failed to authenticate some domains (authenticator: dns-cloudflare). The Certificate Authority reported these problems:
Domain: disco.<domain>.com
Type: unauthorized
Detail: No TXT record found at _acme-challenge.disco.<domain>.com
Hint: The Certificate Authority failed to verify the DNS TXT records created by --dns-cloudflare. Ensure the above domains are hosted by this DNS provider, or try increasing --dns-cloudflare-propagation-seconds (currently 10 seconds).
Certbot's behavior differed from what I expected because:
So I'm aware what causing my problem. My linux server is setup via systemd-resolved with the DNS names resolved locally using pfSense unbound. If I do a simple dns lookup with drill you'll see:
drill disco.<domain>.com
;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 57770
;; flags: qr rd ra ; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;; disco.<domain>.com. IN A
;; ANSWER SECTION:
disco.<domain>.com. 3600 IN A 10.0.1.161
;; AUTHORITY SECTION:
;; ADDITIONAL SECTION:
;; Query time: 1 msec
;; SERVER: 127.0.0.53
;; WHEN: Wed Dec 18 01:22:35 2024
;; MSG SIZE rcvd: 52
My current DNS server's are:
$ sudo resolvectl status
Global
Protocols: -LLMNR -mDNS DNSOverTLS=opportunistic
DNSSEC=no/unsupported
resolv.conf mode: stub
Current DNS Server: 10.0.1.1#pfsense.<domain>.com
DNS Servers: 10.0.1.1#pfsense.<domain>.com
Fallback DNS Servers: 127.0.0.1 10.0.1.1 9.9.9.9 1.1.1.2 1.1.1.3
DNS Domain: <domain>.com ~.
Link 2 (eth0)
Current Scopes: DNS
Protocols: +DefaultRoute -LLMNR -mDNS DNSOverTLS=opportunistic
DNSSEC=no/unsupported
Current DNS Server: 10.0.1.1
DNS Servers: 10.0.1.1
DNS Domain: <domain>.com
DNS lookups however are not being blocked at the firewall level as I allow port 53 requests to pass if a DNS is specified such as with the following:
$ drill disco.<domain>.com @1.1.1.1
;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 54141
;; flags: qr rd ra ; QUERY: 1, ANSWER: 7, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;; disco.<domain>.com. IN A
;; ANSWER SECTION:
disco.<domain>.com. 300 IN A 104.21.16.1
disco.<domain>.com. 300 IN A 104.21.32.1
disco.<domain>.com. 300 IN A 104.21.48.1
disco.<domain>.com. 300 IN A 104.21.64.1
disco.<domain>.com. 300 IN A 104.21.80.1
disco.<domain>.com. 300 IN A 104.21.96.1
disco.<domain>.com. 300 IN A 104.21.112.1
;; AUTHORITY SECTION:
;; ADDITIONAL SECTION:
;; Query time: 15 msec
;; SERVER: 1.1.1.1
;; WHEN: Wed Dec 18 01:35:42 2024
;; MSG SIZE rcvd: 148
I'm not exactly sure how certbot is written but I've consulted the documentation and I don't see what I'm looking for in terms of trying to specify a DNS resolver. In comparison traefik using's LEGO's implementation for acme letsencrypt which allows the user to specify the dns resolver to use. For example:
certificatesResolvers:
le:
acme:
email: <user>@<domain>.com
#Staging Server
# caServer: https://acme-staging-v02.api.letsencrypt.org/directory
#Production Server
caServer: https://acme-v02.api.letsencrypt.org/directory
storage: /etc/letsencrypt/acme.json
keyType: 'EC384'
preferredChain: 'ISRG Root X1'
dnsChallenge:
provider: cloudflare
delayBeforeCheck: 0
resolvers:
- "1.1.1.1:53"
- "9.9.9.9:53"
Does certbot have an equivalent? I'm aware I could change the DNS resolver server at the host level, however it's kind of screwy to do this since I really only need the external DNS servers such as 1.1.1.1 or 9.9.9.9 with DNS challenge and the process of obtaining certificates.
I hope this post made some sense.
Did that resolve the problem?