Hello,
I had preciously used the Letencrypt client which has worked good with http validation ,
while HTTP validation is not preferred(not all servers run http) in the cluster env and it is time to move to the DNS validation.
My domain is:
thither.direct
I ran this command:
python:
# account key is a new or reused.
client = acme_client.Client(directory='https://acme-v01.api.letsencrypt.org/directory', key=key)
new_authz = messages.NewAuthorization(identifier=messages.Identifier( typ=messages.IDENTIFIER_FQDN, value=str(fqdn)))
response = client.net.post(client.directory.new_authz, new_authz)
rsp_challs = response.json()
authz = messages.Authorization.from_json(rsp_challs)
# DNS record created with the values of (zero key is DNS chall):
# - domain: authz.challenges[0].validation_domain_name(fqdn)
# - TXT value: authz.challenges[0].validation(key)
after the DNS record set,
the process waits for the status of valid to proceed to cert-request with the URI of the challenge (uri from rsp_challs['challenges'] type 'dns-01')
response = client.net.get(token_uri) # _https://acme-v01.api.letsencrypt.org/acme/challenge/kmRLowREeyMHas8yXzak85RuGlXclOZLyc1QGW8Scb0/1596100859_
rsp = response.json()
if rsp[u'status'] == u'valid':
the wait process goes 30 sec wait between checkups, which had no results.
------- client.net.get(token_uri)
{'Server': 'nginx', 'Content-Type': 'application/json', 'Content-Length': '222', 'Boulder-Request-Id': 'P_mMapTMs-
GpC7JNvZqSpn_MFeWlczOpRvI09enx9XM', 'Link': 'https://acme-v01.api.letsencrypt.org/acme/authz/kmRLowREeyMHas8yXzak85RuGlXclOZLyc1QGW8Scb0;rel="up"', 'Location': 'https://acme-v01.api.letsencrypt.org/acme/challenge/kmRLowREeyMHas8yXzak85RuGlXclOZLyc1QGW8Scb0/1596100859', 'Replay-Nonce': '0Ql1iELEPpSp821s0tjeNoS4txGhUFwpRDPfIbhVNF8', 'Expires': 'Sat, 22 Jul 2017 19:53:02 GMT', 'Cache-Control': 'max-age=0, no-cache, no-store', 'Pragma': 'no-cache', 'Date': 'Sat, 22 Jul 2017 19:53:02 GMT', 'Connection': 'keep-alive'}{u'type': u'dns-01', u'status': u'pending', u'uri': u'https://acme-v01.api.letsencrypt.org/acme/challenge/kmRLowREeyMHas8yXzak85RuGlXclOZLyc1QGW8Scb0/1596100859', u'token': u'ASkkIgmAgJOq4kbEnnD8uJPG-OkSueMXxBLKm1OSBOI'}
status:pending
The DNS record is set instantly and It is responded at:
https://dns.google.com/query?name=_acme-challenge.thither.direct&type=TXT&dnssec=true
and so as at,
https://unboundtest.com/m/TXT/_acme-challenge.thither.direct/HKXKKLJN
I hope it is enough information to determine the cause of status not changed, It would be clear if status has been invalid/expired, while I'm unable to determine why status remains Pending.
Thank You,
Kashirin Alex
Basically what happens is that as long as there is some “other” challenge in the ‘valid’ state, the one you requested will remain ‘pending’. Say you have validated the domain successfully via HTTP and then trying to validate it again via DNS (with HTTP validation result still being there). You will see that pending state not changing. The client needs to account for this case (and for example just re-use ‘valid’ result), otherwise you may get an infinite loop.