Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. https://crt.sh/?q=example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.
My domain is:
nepheli.ydns.eu
I ran this command:
sudo certbot --apache
It produced this output:
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator apache, Installer apache
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for nepheli.ydns.eu
Waiting for verification…
Cleaning up challenges
Failed authorization procedure. nepheli.ydns.eu (http-01): urn:ietf:params:acme:error:dns :: DNS problem: SERVFAIL looking up CAA for nepheli.ydns.eu - the domain’s nameservers may be malfunctioning
IMPORTANT NOTES:
The following errors were reported by the server:
Domain: nepheli.ydns.eu
Type: None
Detail: DNS problem: SERVFAIL looking up CAA for nepheli.ydns.eu -
the domain’s nameservers may be malfunctioning
My web server is (include version): Apache/2.4.38
The operating system my web server runs on is (include version): Raspbian 10 (Buster)
My hosting provider, if applicable, is:
I can login to a root shell on my machine (yes or no, or I don’t know): yes
I’m using a control panel to manage my site (no, or provide the name and version of the control panel):no
The version of my client is (e.g. output of certbot --version or certbot-auto --version if you’re using Certbot): certbot 0.31.0
Status: Valid Chain of trust. Parent-DS with Algorithm 13, KeyTag 42554, DigestType 2 and Digest "lc9T1RFKJ7XnmfX2lWE76vZQ33Bq+VcdwK3MX5luq0w=" validates local Key with the same values, Key ist Secure Entry Point (SEP) of the zone
[1592253126] libunbound[24588:0] info: validate(nodata): sec_status_bogus
nepheli.ydns.eu. has no CAA record (BOGUS (security failure))
validation failure <nepheli.ydns.eu. CAA IN>: nodata proof failed from 2a00:1328:e000:504::1:104 and 217.115.6.76
The first validated RRSIG says: The domain name nepheli.ydns.eu exists and has that A-record.
But if that domain name exists and if no CAA RR exists, there is a NoData proof required (not a NXDomain proof).
But the NSEC
RRSIG Type 47, expiration 2020-06-25 00:00:00 validates the NSEC RR that proves the not-existence of the CAA RR. Owner neoxnet.ydns.eu, NextOwner: nerd.ydns.eu.
isn't a NoData proof, it's a NXDomain proof.
NoData -> the owner of the NSEC must be nepheli.ydns.eu.
Thank you very much for your time and the long reply.
I have to say, I understood only a part of what you were saying.
So if I get you right, it tries to confirm that nepheli.ydns.eu is the owner of the domain nepheli.ydns.eu. However, in the list it looks up (is this the zone NSEC3 list?) there’s neoxnet.ydns.eu and nerd.ydns.eu with nepheli.ydns.eu missing (which I guess should be in-between them).
Is this a problem of the configuration of my server? Or of the DNS-provider?
What can I do to solve that problem?
But it looks like a subdomain service, so the owners of ydns.eu have to update their software.
If not, you can't create a certificate. If there is a CAA record, only the listed CAs are allowed to create certificates. If there is no CAA record, every CA can create a certificate.
But in combination with DNSSEC that requires a correct authenticated denial of the existence of the CAA record. The RRs sent from the dns software aren't correct.
