Why am I getting this on a FQDN?
[Mon Jun 19 00:52:41 CDT 2023] invalid domain
[Mon Jun 19 00:52:41 CDT 2023] Error add txt for domain:_acme-challenge.
pfSense 23.05 and using Cloudflare DNS to validate.
Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.
No...was trying not to expose to the public the subdomain...that's the part about Let's Encrypt I don't like...to troubleshoot, one has to expose to the public. Here is the full subdomain that had been previously worked the same exact setup before I had to abort project due to war with ISP...
[Mon Jun 19 01:24:21 CDT 2023] Adding txt value: uQMhURuTG_A9DQYGqzAKHSr0CaxbeIyo1eJmYP28MSs for domain: _acme-challenge.nollivoipserver.nollicomm.net
[Mon Jun 19 01:24:22 CDT 2023] invalid domain
[Mon Jun 19 01:24:22 CDT 2023] Error add txt for domain:_acme-challenge.nollivoipserver.nollicomm.net
[Mon Jun 19 01:24:22 CDT 2023] Please check log file for more details: /tmp/acme/certvoip/acme_issuecert.log
The two more common reasons for that to fail is your system is 1) that your credentials are no longer correct to update your Cloudflare DNS and 2) that your system is not waiting long enough after creating the TXT record to ensure Cloudflare sync its authoritative servers.
You could also use https://letsdebug.net/, read documentation, search for old forum threads with similar problems, or pay someone to help you privately. And if you're confident that a problem is a bug in your Let's Encrypt client application, you can also post an issue on its GitHub page.
The reason for this policy here on the forum is that people providing support here are doing so as volunteers, and an incredibly high fraction of issuance failure problems here involve either (1) DNS configuration errors [including mispointed IPv6 AAAA records] or (2) firewall configuration problems that block a challenge from succeeding. Both of those categories of problems could be detected quickly by an experienced volunteer, but many forum users adamantly deny that either of these problems could apply to their situations, while continuing to ask how to make the issuance succeed just by changing options in the client application (which will never work if the problem is in the DNS or firewall).
