I am trying to get a TLS certificate for kdgregoryart.bedeckers.com. I have had the owner of the domain follow a lot of the steps from DNSSEC Errors and random Cloudflare IPs? - #2 by petercooperjr. Despite adding a CAA record and toggling the DNSSEC on the account with Bluehost, I am unable to pass the http-01 challenge. The domain had a certificate continuously from June 2022 until June 30th when it expired because we could not renew. Any help here would be greatly appreciated.
Our custom client returned the following error as of a few moments ago: { "type": "urn:ietf:params:acme:error:dns", "detail": "DNS problem: looking up CAA for kdgregoryart.bedeckers.com: DNSSEC: Bogus: validation failure <kdgregoryart.bedeckers.com. CAA IN>: nodata proof failed from 162.159.25.175", "subproblems": [] }
So I ran: dig @162.159.25.175 kdgregoryart.bedeckers.com caa
The output is:
`
; <<>> DiG 9.10.6 <<>> @162.159.25.175kdgregoryart.bedeckers.com caa
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 33893
;; flags: qr aa rd; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1
;; WARNING: recursion requested but not available
It's getting beyond my expertise, but I think it's trying to say that the name doesn't exist at all when asked about records (like AAAA and CAA) which should be empty, even though the name exists. What DNS server software is the domain using?
In fact the opposite (if I understand you correctly). See the following explanation from DNSViz:
NSEC proving non-existence of kdgregoryart.bedeckers.com/CAA: The following queries resulted in an answer response, even though the NSEC records indicate that the queried names don't exist: kdgregoryart.bedeckers.com/A See RFC 4035, Sec. 3.1.3.2.
(Impossible to copy/paste this popup part of DNSViz unfortunately )
Notice the value of the "NSEC" part: it's only a NSEC RR for the apex domain bedeckers.com. Apparently (NSEC isn't my speciality too) this is only valid if the requested hostname kdgregoryart.bedeckers.com does not exist. But it does exist, because there's an A RR. Thus the NSEC RR is invalid which makes the DNSSEC validity bogus.
If the zone contains RRsets matching <SNAME, SCLASS> but contains no RRset matching <SNAME, SCLASS, STYPE>, then the name server MUST include the NSEC RR for <SNAME, SCLASS> along with its associated RRSIG RR(s) in the Authority section of the response (see Section3.1.1).
OP should request their DNS service provider to fix the NSEC RR(s).
)