greetings, i used to get my certificate by certbot-auto and everything was just fine until a month ago, when the renew turned into a problem. I tried to remove all certificates and start over, without success. can anybody give an advice or any help? Thank you.
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator apache, Installer apache
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for beth.stt.eesc.usp.br
Enabled Apache rewrite module
Waiting for verification…
Cleaning up challenges
Failed authorization procedure. beth.stt.eesc.usp.br (http-01): urn:acme:error:connection :: The server could not connect to the client to verify the domain :: DNS problem: server failure at resolver looking up CAA for usp.br
IMPORTANT NOTES:
The following errors were reported by the server:
Domain: beth.stt.eesc.usp.br
Type: connection
Detail: DNS problem: server failure at resolver looking up CAA for usp.br
To fix these errors, please make sure that your domain name was
entered correctly and the DNS A/AAAA record(s) for that domain
contain(s) the right IP address. Additionally, please check that
your computer has a publicly routable IP address and that no
firewalls are preventing the server from communicating with the
client. If you’re using the webroot plugin, you should also verify
that you are serving files from the webroot path you provided.
My web server is (include version): apache
The operating system my web server runs on is (include version): linux mint
I can login to a root shell on my machine (yes or no, or I don’t know): yes
I’m using a control panel to manage my site (no, or provide the name and version of the control panel): no
Which results in a 626 byte DNS response, give or take.
But it’s not necessary to include more than one of Amazon’s domains. This would be equivalent, as long as Amazon doesn’t change up which domains they use in the future:
Thanks for the reminder. I actually forgot to file that issue the first time around; serves me right for responding that I “will” do something without having done it first. Here it is now: https://github.com/letsencrypt/boulder/issues/3451.
Thanks for the excellent and actionable response, @mnordhoff!
I’m a little fuzzy on the details of the problem here, so I’d like to voice some assumptions based on the thread of conversation here and here as a sanity check. It sounds like:
boulder uses an internal instance of the unbound DNS server in production
boulder's DNS client is configured with a default message buffer capacity of 512 bytes
CAA record resolution for xyleme.com exceeds the DNS client’s message capacity (~626 bytes)
boulder reports a CAA record lookup server failure
To add a little context to our use-case, we’re an organization requesting certs on behalf of our customers. While we do have authority to serve SSL certs on specific subdomains for each customer, in most cases, we don’t have authority to modify their DNS records which are usually located on a parent domain.
Just looking for a little clarity so we can help educate our customers about potential DNS configuration improvements until the issue @jsha kindly linked is addressed. Thanks!
You’re 99% correct, @pd-aray. However, to be really precise: the default limit of 512 bytes is actually a DNS feature rather than an internal buffer. In DNS, if you want to receive responses larger than 512 bytes from a server, you have to set a field in your request indicating that.
Here it is now: