DNS-01 challenge acme-dns internal Bind

Help
12

Dreamhost has an option to flush their internal DNS cache once every 12 or 24 hours. It's on the DNS section of their control panel, but can be somewhat hidden. I doubt that is the issue, but you can try.

Like @Osiris said, you don't seem to understand exactly what is going on.

Looking at your DNS, it is wrong.

Whois reports this for your domain:

Name Server: AUTH.ECFINTERNAL.NET
Name Server: NS1.DREAMHOST.COM
Name Server: NS2.DREAMHOST.COM
Name Server: NS3.DREAMHOST.COM

These all should be the dreamhost severs. This is configured on your registrar (dreamhost). You should remove the AUTH entry for that.

Follow the directions on acme-dns. Your acme-dns server must be publicly accessible, and the DNS server that delegates authority to it must be publicly accessible.

In the dreamhost dns, you should:

  • NS record for auth.ecfinternal.net pointing to auth.ecfinternal.net
  • A record for auth.ecfinternal.net pointing to your IP address

Any subdmains you want to authorize via DNS-01 will then have a CNAME _acme-challenge record pointing to the "account" placed on the acme-dns instance.

I would prefer not to go down the route of a private CA and faff about with installing CA certificates on 80+ hosts.

acme-dns will require 80+ accounts to be setup for this, which can be overwhelming.

the acme-dns maintainers were nice enough to merge a PR for me a while ago -- Relax subdomain validation from UUID to actual subdomain by jvanasco · Pull Request #243 · joohoi/acme-dns · GitHub - which relaxes their validation to allow for rfc compliant subdomains to be used instead of uuids.

My suggestion is to write a script that will pre-generate an acme-dns credential for each of the 80+ domains, then use/adapt this script I open sourced to change the UUIDs into subdomains that reflect the subdomain you want a certificate for (see peter_sslers/tools/replace_domain.py at main · aptise/peter_sslers · GitHub)

This way your DNS records for example.com would CNAME onto com.example.auth.ecfinternal.net instead of uuid-uuid-uuid-uuid.auth.ectinternal.net. That can make management, setup, and troubleshooting much easher.

If using acme-dns, there is ZERO reason to involve bind or the various rfc2136 commands to certbot. The only command that certbot needs to know is the manual-auth-hook.