Dns renewal fails after validating _acme_challenge

Help
1

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: reportlab.com *.reportlab.com

I ran acme.sh --renewAll (with exported LE_WORKING_DIR, LE_CONFIG_HOME, ME_Key & ME_Secret)

It produced this output:
[Fri 8 Nov 10:49:38 UTC 2024] Renewing: 'reportlab.com'
[Fri 8 Nov 10:49:38 UTC 2024] Renewing using Le_API=https://acme-v02.api.letsencrypt.org/directory
[Fri 8 Nov 10:49:39 UTC 2024] Using CA: https://acme-v02.api.letsencrypt.org/directory
[Fri 8 Nov 10:49:39 UTC 2024] Multi domain='DNS:reportlab.com,DNS:.reportlab.com'
[Fri 8 Nov 10:49:41 UTC 2024] Getting webroot for domain='reportlab.com'
[Fri 8 Nov 10:49:41 UTC 2024] Getting webroot for domain='.reportlab.com'
[Fri 8 Nov 10:49:41 UTC 2024] Adding TXT value: 0Y2-zRiRCFJJ3I0K_-3lfVB2Ozr52W3r-f3TIq2JOvo for domain: _acme-challenge.reportlab.com
[Fri 8 Nov 10:49:43 UTC 2024] Adding record
[Fri 8 Nov 10:49:44 UTC 2024] Added
[Fri 8 Nov 10:49:44 UTC 2024] The TXT record has been successfully added.
[Fri 8 Nov 10:49:44 UTC 2024] Let's check each DNS record now. Sleeping for 20 seconds first.
[Fri 8 Nov 10:50:05 UTC 2024] You can use '--dnssleep' to disable public dns checks.
[Fri 8 Nov 10:50:05 UTC 2024] See: dnscheck · acmesh-official/acme.sh Wiki · GitHub
[Fri 8 Nov 10:50:05 UTC 2024] Checking reportlab.com for _acme-challenge.reportlab.com
[Fri 8 Nov 10:50:06 UTC 2024] Success for domain reportlab.com '_acme-challenge.reportlab.com'.
[Fri 8 Nov 10:50:06 UTC 2024] All checks succeeded
[Fri 8 Nov 10:50:06 UTC 2024] Verifying: reportlab.com
[Fri 8 Nov 10:50:06 UTC 2024] Pending. The CA is processing your order, please wait. (1/30)
[Fri 8 Nov 10:50:10 UTC 2024] reportlab.com: Invalid status. Verification error details: DNS problem: NXDOMAIN looking up TXT for acme-challenge.reportlab.com - check that a DNS record exists for this domain
[Fri 8 Nov 10:50:10 UTC 2024] Removing DNS records.
[Fri 8 Nov 10:50:10 UTC 2024] Removing txt: 0Y2-zRiRCFJJ3I0K-3lfVB2Ozr52W3r-f3TIq2JOvo for domain: _acme-challenge.reportlab.com
[Fri 8 Nov 10:50:12 UTC 2024] Successfully removed
[Fri 8 Nov 10:50:12 UTC 2024] Please check log file for more details: /home/rptlab/etc/certs/acme.sh/data/acme.sh.log
[Fri 8 Nov 10:50:13 UTC 2024] Error renewing reportlab.com.

acme-cron: 20241108105013 no ssl changes were made
acme-check: 20241108105013 ssl for 'uka-proxy.opentrack.run' expires in 89 days

!!!!! acme-check: 20241108105013 SSL ERRORS
!!!!! acme-check: 20241108105013 ssl for 'reportlab.com' expires in 9<10 days
My web server is (include version):

The operating system my web server runs on is (include version):

My hosting provider, if applicable, is:

I can login to a root shell on my machine (yes or no, or I don't know):

I'm using a control panel to manage my site (no, or provide the name and version of the control panel):

The version of my client is $ acme.sh --version

v3.1.0

I have checked in dnsmade easy and the reportlab.com domain is there as are all the *.reportlab.com comains.

2

You probably need to get it to wait longer before validating the domain, 20 seconds is pretty short and you need time for all of your nameservers to replicate the change, 60 seconds or even longer is a good idea.

2 Likes
3

If you examine the output it first says it succeeds and then says it fails. It seems to be the CA verification that fails.

4

Exactly. One query from your local system saw that record but your DNS system must synchronize all its authoritative servers for the CA verification to succeed. Let's Encrypt checks from multiple locations around the world and they must all present the correct result

2 Likes
5

OK so you ar saying I must wait a long time before checking on my initial (local) check. That way the rst of the world has a chance to catch up. OK i'll give that a go.

6

Thanks, adding in --dnssleep 300 seems to have worked OK.

3 Likes
7

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.