The ACME protocol uses TXT records, not CNAME. It is possible to CNAME the entry to some other domain, and the validation would then follow the CNAME like any other DNS record. But certbot doesn't support having the automatic TXT record created in a different domain than the one you're trying to validate by using a CNAME, so if that's what you're trying to do then you'll need to use a different client.
The other reason I'm confused is the snippet of the log you've posted looks like it's loading the Route 53 plugin and loading your credentials file fine. What problem are you having? I think you just didn't copy the entire log here. The easiest way to format it is to put three backticks on their own line before and after it:
Today they have expired and I had a serious problem, so I need to automate the renewal, but I have found a process that I have not been able to solve.
I use renewal by DNS but when certbot certonly --manual --email email@email --server https://acme-v02.api.letsencrypt.org/directy --agree-tos --manual-public-ip-logging-ok -d *.domain.com
I come across a request for confirmation.
Plugins selected: Authenticator manual, Installer None
Cert is due for renewal, auto-renewing...
Renewing an existing certificate
Performing the following challenges:
dns-01 challenge for domain.com
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Please deploy a DNS TXT record under the name
_acme-challenge.domain.com with the following value:
Un9yLvUqZwmHExxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Before continuing, verify the record is deployed.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Press Enter to Continue
Waiting for verification...
Cleaning up challenges
my idea was to use the --dns-route53 option to update the _acme-challenge record but I think I’m confused.
My English is not so good, sorry.
If your DNS is hosted in Route 53, then yes you should be able to automate the whole process by using Certbot and the Route 53 plugin as you're trying to do.
When I run the command I see the following, it shows me what is the new code I should add in the dns zone and I do it manually.
Plugins selected: Authenticator manual, Installer None
Cert is due for renewal, auto-renewing...
Renewing an existing certificate
Performing the following challenges:
dns-01 challenge for domain.com
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Please deploy a DNS TXT record under the name
_acme-challenge.domain.com with the following value:
Un9yLvUqZwmHExxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Before continuing, verify the record is deployed.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Press Enter to Continue
Waiting for verification...
Cleaning up challenges
Is there a way to automatically create the _acme-challenge.domain.com record?
My problem occurs when using the parameter "-dns-route53" the record _acme-challenge.domain.com is not created in the dns zone in route53.I understand it should be created, maybe I’m wrong.
In case I’m wrong, is there any way to avoid getting the TXT record without pressing the enter key to proceed? (Press Enter to Continue)
Yes, you have the right idea with the Route53 plug-in as shown in your first post. It is hard for us to know what might be wrong for a couple reasons. One, you are not showing your domain name. And, two, you did not show the entire log file in your first post.
And, you did not describe what version of certbot you use. But, you could try adding --debug-challenges to the command in your first post. That should pause to allow you to check whether the TXT record (not CNAME record) was created as expected.
If that doesn't help you debug the problem then upload the entire log file using the upload button on the format menu. You can redact your domain name in the log if you must but we can be more helpful if you show the domain name.
Check you don't have conflicting _acme-challenge records (e.g. make sure you don't have both a CNAME and a TXT record, if you do, delete the CNAME and continue with the TXT record).
It helps a lot of you provide your domain, then nobody has to guess, your certificate is public anyway.
Hi good morning, thans for helps to everyone.
In the main domain we create a certificate for *.kiusys.com to perform tests I’m using the
subdomain called certbot-testing.kiusys.com.
Um, that certbot command worked. The log is clean and I see the cert issued. Note the timestamp in the cert is 1H before your runtime on purpose (LE pre-dates an hour to tolerate time diffs better).
No, Let's Encrypt uses a TXT record to validate the DNS challenge. Your log showed a TXT record being created, the challenge was successful, and the TXT record was removed. Every DNS challenge has a new TXT record and value so it is deleted once it was successful.
And, I showed the link where you can see the cert that was created.
Note that your Route53 DNS still has a TXT record in it for that name. But, it must have been an old request and you can delete this one:
_acme-challenge.certbot-testing.kiusys.com. 300 IN TXT "r2v71ly2st46p6vmpdwn2yl4w0010j01"
