I ran this command: certbot-auto certbot -d git.shifudao.com
It produced this output:
Failed authorization procedure. git.shifudao.com (http-01): urn:ietf:params:acme:error:dns :: DNS problem: SERVFAIL looking up CAA for git.shifudao.com
IMPORTANT NOTES:
- The following errors were reported by the server:
Domain: git.shifudao.com
Type: None
Detail: DNS problem: SERVFAIL looking up CAA for git.shifudao.com
My web server is (include version): Nginx 1.14.0
The operating system my web server runs on is (include version): Ubuntu Server 16.04.5
I am not sure this is a good idea to wildcard. If you just have a CAA record at the zone apex (shifudao.com), it will already cover any possible subdomain, unless that subdomain has a more specific CAA record.
I don't think this is causing your problem, though.
Is this happening every time you try it? Does it happen with a --dry-run ?
Hmm, your nameservers' DNS responses appear to come with some 'little extra' data on the end:
(The elb.amazonaws.com. bit). dig complains about this too, maybe it is freaking the Let's Encrypt resolver out:
;; WARNING: Message has 23 extra bytes at end
Always different content, but always 23 extra bytes that are not valid DNS data. Looks like a nameserver malfunction to me.
It actually looks like memory corruption on the resolver to me, because I'm seeing totally unrelated data (like ezdnscenter.com) - but maybe it is a screwed up NSEC response?
Sign in · JiHu GitLab The server responded with no OPT record, rather than with RCODE FORMERR. (121.12.104.109, 121.12.104.110, 183.2.194.173, 183.2.194.174, 218.66.171.173, 218.66.171.174, 218.98.111.173, 218.98.111.174, UDP_0_EDNS0_32768_4096)
No. I try to change *.shifudao.com. CAA to shifudao.com. CAA, but still showing:
IMPORTANT NOTES:
- The following errors were reported by the server:
Domain: git.shifudao.com
Type: None
Detail: DNS problem: SERVFAIL looking up CAA for git.shifudao.com
We're limited in what we can say about the root cause. Only the SERVFAIL is captured. I agree with the debugging you folks have done in thread (many thanks!).
@abcfy2 Have you been able to issue with success since addressing the issues with your authoritative DNS server?
You could try removing the CAA record entirely. CAA records are not required to be there, they’re only required to be respected by the CA if they are.
Removing the CAA record is the closest thing you can do to disabling the check. It only requires that your DNS provider be able to properly respond with a NOERROR.
No matter whether the CAA record exists, certbot will always show:
IMPORTANT NOTES:
- The following errors were reported by the server:
Domain: git.shifudao.com
Type: None
Detail: DNS problem: SERVFAIL looking up CAA for git.shifudao.com
So I’m confused. How could I solve this issue?
I try to add @.shifudao.com, git.shifudao.com, *.shifudao.com with CAA record, but none of them could help.