Error in renew with specific domain

Help
1

Sorry for the translation software.
Until last month, I was able to get it without any problems.
I checked manually for debugging,
The following error will always occur.
Although I tried http authentication and DNS authentication, I get an error.
Other domain names have no problems at all, so I think they are unique problems.

./certbot-auto certonly --manual --dry-run -w /www/yoc.jpn.com -d www.yoc.jpn.com --expand -d yoc.jpn.com --preferred-challenges dns

The error is

Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator manual, Installer None
Obtaining a new certificate
Performing the following challenges:
dns-01 challenge for www.yoc.jpn.com
dns-01 challenge for yoc.jpn.com

NOTE: The IP of this machine will be publicly logged as having requested this
certificate. If you’re running certbot in manual mode on a machine that is not
your server, please ensure you’re okay with that.

Are you OK with your IP being logged?

(Y)es/(N)o: y

Please deploy a DNS TXT record under the name
_acme-challenge.www.yoc.jpn.com with the following value:

7atz3UNXFIrozBci6dN-9O1mDbV0_rc-rAcXxv1X0eM

Before continuing, verify the record is deployed.

Press Enter to Continue

Please deploy a DNS TXT record under the name
_acme-challenge.yoc.jpn.com with the following value:

HWPfCfN-NahXhLmW1cDAbP2xfJTjriPAvMw8idHnmHg

Before continuing, verify the record is deployed.
(This must be set up in addition to the previous challenges; do not remove,
replace, or undo the previous challenge tasks yet. Note that you might be
asked to create multiple distinct TXT records with the same name. This is
permitted by DNS standards.)

Press Enter to Continue
Waiting for verification…
Challenge failed for domain yoc.jpn.com
Challenge failed for domain www.yoc.jpn.com
dns-01 challenge for yoc.jpn.com
dns-01 challenge for www.yoc.jpn.com
Cleaning up challenges
Some challenges have failed.

IMPORTANT NOTES:

  • The following errors were reported by the server:

    Domain: yoc.jpn.com
    Type: dns
    Detail: DNS problem: SERVFAIL looking up TXT for
    _acme-challenge.yoc.jpn.com

    Domain: www.yoc.jpn.com
    Type: dns
    Detail: DNS problem: SERVFAIL looking up TXT for
    _acme-challenge.www.yoc.jpn.com

If you look at the debug log, you may not be able to refer to DNS.
I can see it manually.

Please tell me how to resolve.

My domain is:
yoc.jpn.com

I ran this command:
./certbot-auto certonly --manual --dry-run -w /www/yoc.jpn.com -d www.yoc.jpn.com --expand -d yoc.jpn.com --preferred-challenges dns

It produced this output:

My web server is (include version):
yoc.jpn.com
www.yoc.jpn.com

The operating system my web server runs on is (include version):
CentOS release 6.10 (Final)

My hosting provider, if applicable, is:
own server

I can login to a root shell on my machine (yes or no, or I don’t know):
yes

I’m using a control panel to manage my site (no, or provide the name and version of the control panel):
no

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you’re using Certbot):
certbot 0.40.1

1 Like
2

Hi @YMatsuki,

I’m sorry you’re having trouble with this. The machine translation is no problem—the quality of the translation is great!

When you use the HTTP challenge method instead of the DNS method, do you also get a DNS-related error message?

While using the DNS challenge method, could you try to look up the DNS TXT records with unboundtest.com?

https://unboundtest.com/

This performs a TXT lookup that’s very similar to the DNS lookup performed by the Let’s Encrypt certificate authority.

1 Like
3

Thank you for your reply.

https://unboundtest.com/

Testing is no problem.

;; QUESTION SECTION:
; _acme-challenge.yoc.jpn.com. IN TXT

;; ANSWER SECTION:
_acme-challenge.yoc.jpn.com. 0 IN TXT “HWPfCfN-NahXhLmW1cDAbP2xfJTjriPAvMw8idHnmHg”

;; QUESTION SECTION:
;_acme-challenge.www.yoc.jpn.com. IN TXT

;; ANSWER SECTION:
_acme-challenge.www.yoc.jpn.com. 0 IN TXT “7atz3UNXFIrozBci6dN-9O1mDbV0_rc-rAcXxv1X0eM”

SERVFAIL also appears in the test on http.

1 Like
4

@lestaff, could someone please take a look at why this TXT record (or A record in the same zone) may be giving a SERVFAIL for Let’s Encrypt but apparently not for unboundtest?

(I guess it might be a matter of bad luck because there are apparently four different authoritative servers for this domain name, run by three different organizations.)

1 Like
5

If you had an error before,
I tested http authentication and it was successful.

[root@www ~]# ./certbot-auto certonly --manual --dry-run -w /www/yoc.jpn.com -d www.yoc.jpn.com --expand -d yoc.jpn.com
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator manual, Installer None
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for www.yoc.jpn.com
http-01 challenge for yoc.jpn.com

NOTE: The IP of this machine will be publicly logged as having requested this
certificate. If you’re running certbot in manual mode on a machine that is not
your server, please ensure you’re okay with that.

Are you OK with your IP being logged?

(Y)es/(N)o: y

Create a file containing just this data:

I69R1ZCEGCCXWrI-LousGB0udElrg4ox8eMYlmNSKdE.TESJ4fsG0MtUgDhyMAPkRdDER125mQxY_WpJ8Eh7NPA

And make it available on your web server at this URL:

http://www.yoc.jpn.com/.well-known/acme-challenge/I69R1ZCEGCCXWrI-LousGB0udElrg4ox8eMYlmNSKdE

Press Enter to Continue

Create a file containing just this data:

Ly1WrrKrWO7AcEUOuo0Gy2CcBiUbBTco7-YooqpoFBI.TESJ4fsG0MtUgDhyMAPkRdDER125mQxY_WpJ8Eh7NPA

And make it available on your web server at this URL:

http://yoc.jpn.com/.well-known/acme-challenge/Ly1WrrKrWO7AcEUOuo0Gy2CcBiUbBTco7-YooqpoFBI

(This must be set up in addition to the previous challenges; do not remove,
replace, or undo the previous challenge tasks yet.)

Press Enter to Continue
Waiting for verification…
Cleaning up challenges

IMPORTANT NOTES:

  • The dry run was successful.
1 Like
6

This does make me think that one of your four authoritative DNS servers may be failing, while the other three work properly. This could help explain why it sometimes works in tests and other times doesn’t work.

2 Likes
7

I understand DNS authentication
The same is true for HTTP authentication errors.
It means that a certain DNS server did not respond properly.
Check the secondary DNS server.
Thank you very much.

2 Likes
8

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.