My domain is: starline.ru
I ran this command: dehydrated -c
It produced this output:
# dehydrated -c
# INFO: Using main config file /etc/dehydrated/config
Processing *.starline.ru
Unknown hook
+ Signing domains...
+ Generating private key...
+ Generating signing request...
+ Requesting new certificate order from CA...
+ Received 1 authorizations URLs from the CA
+ Handling authorization for starline.ru
+ 1 pending challenge(s)
+ Deploying challenge tokens...
deploy_challenge: deploy_challenge
deploy_challenge: starline.ru
deploy_challenge: qaaRC3ntFSPRZTIATXV34ws03WkbR2anG6KakDc3h58
deploy_challenge: iAyiNX-npIVn9wdFy8I1L09fqNHJUWrDhHdsrFHvd6k
/etc/bind/zones/starline.ru:8: using RFC1035 TTL semantics
zone starline.ru/IN: loaded serial 2020053021
OK
+ Responding to challenge for starline.ru authorization...
Unknown hook "invalid_challenge"
+ Cleaning challenge tokens...
clean_challenge: clean_challenge
clean_challenge: starline.ru
clean_challenge: qaaRC3ntFSPRZTIATXV34ws03WkbR2anG6KakDc3h58
clean_challenge: iAyiNX-npIVn9wdFy8I1L09fqNHJUWrDhHdsrFHvd6k
/etc/bind/zones/starline.ru:8: using RFC1035 TTL semantics
zone starline.ru/IN: loaded serial 2020053021
OK
+ Challenge validation has failed :(
ERROR: Challenge is invalid! (returned: invalid) (result: {
"type": "dns-01",
"status": "invalid",
"error": {
"type": "urn:ietf:params:acme:error:unauthorized",
"detail": "Incorrect TXT record \"8fEexLsOf5dT6GJ3_RDsgeg5auOfIe9quW4QWqgP9Hw\" found at _acme-challenge.starline.ru",
"status": 403
},
"url": "https://acme-v02.api.letsencrypt.org/acme/chall-v3/4913816243/5oW-5w",
"token": "qaaRC3ntFSPRZTIATXV34ws03WkbR2anG6KakDc3h58"
})
exit_hook: exit_hook
exit_hook: Challenge
exit_hook: is
exit_hook: invalid!
exit_hook: (returned:
exit_hook: invalid)
exit_hook: (result:
exit_hook: {
exit_hook: "type":
exit_hook: "dns-01",
exit_hook: "status":
exit_hook: "invalid",
exit_hook: "error":
exit_hook: {
exit_hook: "type":
exit_hook: "urn:ietf:params:acme:error:unauthorized",
exit_hook: "detail":
exit_hook: "Incorrect
exit_hook: TXT
exit_hook: record
exit_hook: \"8fEexLsOf5dT6GJ3_RDsgeg5auOfIe9quW4QWqgP9Hw\"
exit_hook: found
exit_hook: at
exit_hook: _acme-challenge.starline.ru",
exit_hook: "status":
exit_hook: 403
exit_hook: },
exit_hook: "url":
exit_hook: "https://acme-v02.api.letsencrypt.org/acme/chall-v3/4913816243/5oW-5w",
exit_hook: "token":
exit_hook: "qaaRC3ntFSPRZTIATXV34ws03WkbR2anG6KakDc3h58"
exit_hook: })
Record 8fEexLsOf5dT6GJ3_RDsgeg5auOfIe9quW4QWqgP9Hw is old, TTL is only 1 minute, but letsencrypt use it after hour later. This is repeatable case and this does not allow get a certificate - letsencrypt every challenge use previous record instead current.