# Error issuing/renewingcertificates **URL:** \ **Category:** Help\ **Created:** [January 11, 2021, 3:59am UTC](https://community.letsencrypt.org/t/error-issuing-renewingcertificates/142422 "2021-01-11T03:59:55Z")\ **Posts on this page:** 17\ **Page:** 1
**Author:** ![rammohan](https://avatars.discourse-cdn.com/v4/letter/r/a9a28c/32.png) [@rammohan](https://community.letsencrypt.org/u/rammohan)\ **Post date:** [January 11, 2021, 3:59am UTC](https://community.letsencrypt.org/t/error-issuing-renewingcertificates/142422/1 "2021-01-11T03:59:55Z")
I am trying to generate certificate wildcard certificates on a Linux(Ubuntu 18.04 LTS) VM. I have been able to generate the certificates in the past. They are coming up for renewal in a couple of days. Following is the command I ran and the output I got; \*$ sudo certbot certonly --manual -d _.drcloudemr.com -d [drcloudemr.com](http://drcloudemr.com) --agree-tos --email [cs.ops@drcloudemr.com](mailto:cs.ops@drcloudemr.com) --no-bootstrap --manual-public-ip-logging-ok --preferred-challenges dns-01 --server [https://acme-v02.api.letsencrypt.org/directory](https://acme-v02.api.letsencrypt.org/directory)_ _Use of --manual-public-ip-logging-ok is deprecated._ _Saving debug log to /var/log/letsencrypt/letsencrypt.log_ _Plugins selected: Authenticator manual, Installer None_ \*Requesting a certificate for _.drcloudemr.com and [drcloudemr.com](http://drcloudemr.com)_ _Performing the following challenges:_ _dns-01 challenge for [drcloudemr.com](http://drcloudemr.com)_ _dns-01 challenge for [drcloudemr.com](http://drcloudemr.com)_ _- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -_ _Please deploy a DNS TXT record under the name_ _\_acme-challenge.drcloudemr.com with the following value:_ _-KquIRQbLMTZd\_-aQXKoa8c9EHnMJtRhuw0hw7YzwkU_ _Before continuing, verify the record is deployed._ _- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -_ _Press Enter to Continue_ _- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -_ _Please deploy a DNS TXT record under the name_ _\_acme-challenge.drcloudemr.com with the following value:_ _k9r-YW2GNVuynAEZB00i1GOGelrmo07HcRTs4dORahM_ _Before continuing, verify the record is deployed._ _(This must be set up in addition to the previous challenges; do not remove,_ _replace, or undo the previous challenge tasks yet. Note that you might be_ _asked to create multiple distinct TXT records with the same name. This is_ _permitted by DNS standards.)_ _- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -_ _Press Enter to Continue_ _Waiting for verification..._ _Challenge failed for domain [drcloudemr.com](http://drcloudemr.com)_ _Challenge failed for domain [drcloudemr.com](http://drcloudemr.com)_ _dns-01 challenge for [drcloudemr.com](http://drcloudemr.com)_ **strong text** _dns-01 challenge for [drcloudemr.com](http://drcloudemr.com)_ _Cleaning up challenges_ _Some challenges have failed._ _IMPORTANT NOTES:_ - - The following errors were reported by the server:\* - Domain: [drcloudemr.com](http://drcloudemr.com)\* - Type: unauthorized\* - Detail: Incorrect TXT record\* - "gER4iVEWxBf938iBgMhNhExGvXdI\_OtfJaoAX41u\_nw" (and 19 more) found\* - at \_acme-challenge.drcloudemr.com\* - Domain: [drcloudemr.com](http://drcloudemr.com)\* - Type: unauthorized\* - Detail: Incorrect TXT record\* - "fn6xGzNYHRCjf1nGu025RJNYLXTRyil3x553xrj18WE" (and 19 more) found\* - at \_acme-challenge.drcloudemr.com\* - To fix these errors, please make sure that your domain name was\* - entered correctly and the DNS A/AAAA record(s) for that domain\* - contain(s) the right IP address.\* I followed the instructions and updated the TXT records onto my DNS provider(PowWeb). When I ran "nslookup -q=txt \_acme-challenge.drcloudemr.com", it returned about 20 records,. I'm not sure why there are so many entries and which one's are really needed. I don't see those records on my DNS. I am wondering if the cause for failure is that there are so many entries. If that is indeed the case, is there a way to delete unused/old entries ? How can I get around this error and generate/renew certificates ? Please advise. Thanks, Ram Reddy ---
**Author:** ![griffin](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/griffin/32/50204_2.png) [@griffin](https://community.letsencrypt.org/u/griffin)\ **Post date:** [January 11, 2021, 4:23am UTC](https://community.letsencrypt.org/t/error-issuing-renewingcertificates/142422/2 "2021-01-11T04:23:34Z")
Welcome to the Let's Encrypt Community, Ram 🙂 TXT records for dns-01 challenges can always be deleted once the challenges have been completed. There is no purpose in keeping them around. Delete them then try this command instead: `sudo certbot certonly --cert-name drcloudemr.com --manual --preferred-challenges dns -d "drcloudemr.com,*.drcloudemr.com" --keep` ---
**Author:** ![rammohan](https://avatars.discourse-cdn.com/v4/letter/r/a9a28c/32.png) [@rammohan](https://community.letsencrypt.org/u/rammohan)\ **Post date:** [January 11, 2021, 4:25am UTC](https://community.letsencrypt.org/t/error-issuing-renewingcertificates/142422/3 "2021-01-11T04:25:16Z")
Thanks, Griffin! Regards, Ram ---
**Author:** ![griffin](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/griffin/32/50204_2.png) [@griffin](https://community.letsencrypt.org/u/griffin)\ **Post date:** [January 11, 2021, 4:30am UTC](https://community.letsencrypt.org/t/error-issuing-renewingcertificates/142422/4 "2021-01-11T04:30:56Z")
You're quite welcome. 🙂 See my (expanded) previous post, please. ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [January 11, 2021, 4:39am UTC](https://community.letsencrypt.org/t/error-issuing-renewingcertificates/142422/5 "2021-01-11T04:39:08Z")
> [@rammohan](#): > > Please deploy a DNS TXT record under the name ... I guess the instructions lack the... _You can now delete the requested TXT records._ [at the end of each manual run] ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [January 11, 2021, 7:03am UTC](https://community.letsencrypt.org/t/error-issuing-renewingcertificates/142422/6 "2021-01-11T07:03:41Z")
> [@rammohan](#): > > How can I get around this error and generate/renew certificates ? Although it seems Let's Encypt _eventually_ can see the TXT records, it might take some time for the latest to propogate to all DNS servers. You might want to wait some more time between adding the TXT record and continue in certbot. ---
**Author:** ![JimPas](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jimpas/32/33270_2.png) [@JimPas](https://community.letsencrypt.org/u/JimPas)\ **Post date:** [January 11, 2021, 7:16am UTC](https://community.letsencrypt.org/t/error-issuing-renewingcertificates/142422/7 "2021-01-11T07:16:37Z")
> [@Osiris](#): > > it might take some time for the latest to propogate to all DNS servers. You might want to wait some more time between adding the TXT record and continue in certbot. Should that be included in the guide or within the directions about deploying the text records? ---
**Author:** ![rammohan](https://avatars.discourse-cdn.com/v4/letter/r/a9a28c/32.png) [@rammohan](https://community.letsencrypt.org/u/rammohan)\ **Post date:** [January 11, 2021, 7:19am UTC](https://community.letsencrypt.org/t/error-issuing-renewingcertificates/142422/8 "2021-01-11T07:19:26Z")
Thank you all for the quick replies. I'm looking to delete the existing TXT records on my DNS provider. My DNS provider has only 2 TXT records for \_acme-challenge.drcloudemr.com: \_acme-challenge.drcloudemr.com=BMurhLUHDcR17o0twT6YKUsg8274Iasqw2nU3agnmqU \_acme-challenge.drcloudemr.com=KPzrw\_K9l13kQZHbd41wNCMjmIkwekW8I8zEKcs1uWM (These 2 are from the certificates I generated successfully couple of months ago.) But, when I run: nslookup -q=txt \_acme-challenge.drcloudemr.com I see all the following entries(which are not on my DNS provider): \Non-authoritative answer: \_acme-challenge.drcloudemr.com canonical name = [drcloudemr.com.letsencrypt.vdeck.eigdyn.com](http://drcloudemr.com.letsencrypt.vdeck.eigdyn.com) [drcloudemr.com.letsencrypt.vdeck.eigdyn.com](http://drcloudemr.com.letsencrypt.vdeck.eigdyn.com) text = ``` "5_PODV-u76lEniSVPRDutu7ima6noDGrOrLKHTiCXfE" ``` [drcloudemr.com.letsencrypt.vdeck.eigdyn.com](http://drcloudemr.com.letsencrypt.vdeck.eigdyn.com) text = ``` "qxzbQZuOQMTLmxflwDmtrD1cuPwwG6YDUO7JmYsrN3Q" ``` [drcloudemr.com.letsencrypt.vdeck.eigdyn.com](http://drcloudemr.com.letsencrypt.vdeck.eigdyn.com) text = ``` "A2_k9cT1mKmHTL5JLeBi-RIGz4EHwhGYwpdyw41e4tE" ``` [drcloudemr.com.letsencrypt.vdeck.eigdyn.com](http://drcloudemr.com.letsencrypt.vdeck.eigdyn.com) text = ``` "kObDOVFTJRYoD7J-4TZ-mzz0pXZAMZ-CxxvV6yfH--M" ``` [drcloudemr.com.letsencrypt.vdeck.eigdyn.com](http://drcloudemr.com.letsencrypt.vdeck.eigdyn.com) text = ``` "_BM1JJtENUgOh17kJtYb-zOHbjhTCJMExiFR-GeTCVg" ``` [drcloudemr.com.letsencrypt.vdeck.eigdyn.com](http://drcloudemr.com.letsencrypt.vdeck.eigdyn.com) text = ``` "gER4iVEWxBf938iBgMhNhExGvXdI_OtfJaoAX41u_nw" ``` [drcloudemr.com.letsencrypt.vdeck.eigdyn.com](http://drcloudemr.com.letsencrypt.vdeck.eigdyn.com) text = ``` "T9SvTW55eHucywKogCv6cC6oR-IMDlag7StdSERGr0Y" ``` [drcloudemr.com.letsencrypt.vdeck.eigdyn.com](http://drcloudemr.com.letsencrypt.vdeck.eigdyn.com) text = ``` "KalRVlV3mHL3y-1V8U3XyMMg1C5QvhFdzWUO5lWo1fA" ``` [drcloudemr.com.letsencrypt.vdeck.eigdyn.com](http://drcloudemr.com.letsencrypt.vdeck.eigdyn.com) text = ``` "iS7aXgjbLLs6bImsAGgebwajjmy4kNw-MA6171UzA1g" ``` [drcloudemr.com.letsencrypt.vdeck.eigdyn.com](http://drcloudemr.com.letsencrypt.vdeck.eigdyn.com) text = ``` "xZ_k0CMRRX6G8bnpVR3ScRiDzHJZBuhR6oC5Z5EHl0c" ``` [drcloudemr.com.letsencrypt.vdeck.eigdyn.com](http://drcloudemr.com.letsencrypt.vdeck.eigdyn.com) text = ``` "UoMJeMhAKOz2lFnrrmZSM-GG0kceZLRInZTGUOERfws" ``` [drcloudemr.com.letsencrypt.vdeck.eigdyn.com](http://drcloudemr.com.letsencrypt.vdeck.eigdyn.com) text = ``` "fn6xGzNYHRCjf1nGu025RJNYLXTRyil3x553xrj18WE" ``` [drcloudemr.com.letsencrypt.vdeck.eigdyn.com](http://drcloudemr.com.letsencrypt.vdeck.eigdyn.com) text = ``` "_ic0AnYj87HtIKLagnekYJlRIa1FD-eH7fZ-8Pa7ZuE" ``` [drcloudemr.com.letsencrypt.vdeck.eigdyn.com](http://drcloudemr.com.letsencrypt.vdeck.eigdyn.com) text = ``` "81fYaP8icWGtU4ZDzWoRru2qvp0g_C73JhjLvYY8OvY" ``` [drcloudemr.com.letsencrypt.vdeck.eigdyn.com](http://drcloudemr.com.letsencrypt.vdeck.eigdyn.com) text = ``` "XC8SG-dov2UryfDqURbwvv7BndgctxPTJ1QfCJHafnw" ``` [drcloudemr.com.letsencrypt.vdeck.eigdyn.com](http://drcloudemr.com.letsencrypt.vdeck.eigdyn.com) text = ``` "77tCYr0LJ7r2AtcBUGH2MplaM5dTRMhmRlSDBQf-xDY" ``` [drcloudemr.com.letsencrypt.vdeck.eigdyn.com](http://drcloudemr.com.letsencrypt.vdeck.eigdyn.com) text = ``` "XBHsJo-pX8PDuhgmjBK6hIdEwtUuRs_6vyCG7Vn9ko8" ``` [drcloudemr.com.letsencrypt.vdeck.eigdyn.com](http://drcloudemr.com.letsencrypt.vdeck.eigdyn.com) text = ``` "3KmFBVicwg1pWfQmm_4CNAuZSohxKlCyXDeWaSs6vAo" ``` [drcloudemr.com.letsencrypt.vdeck.eigdyn.com](http://drcloudemr.com.letsencrypt.vdeck.eigdyn.com) text = ``` "2mJmFKHoVZZpUTN05b4XYsniyNA3c9sen2hgwHGuCYw" ``` [drcloudemr.com.letsencrypt.vdeck.eigdyn.com](http://drcloudemr.com.letsencrypt.vdeck.eigdyn.com) text = ``` "5LpFOnvWwCrUyXtULB2RG-hJDMuzpPbZ55boI3GHtRE" ``` It seems like until the above TX records get deleted, I won't be able to generate the certificates again. Since, I don't see these TXT records on my DNS provider, I can't delete them from there. Is there a way to get these TXT record deleted ? Thanks, Ram ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [January 11, 2021, 7:27am UTC](https://community.letsencrypt.org/t/error-issuing-renewingcertificates/142422/9 "2021-01-11T07:27:46Z")
I'm still trying to figure out how that is happening... I found this along the way: ```auto nslookup -q=txt drcloudemr.com RETURNS: drcloudemr.com text = "_acme-challenge.drcloudemr.com=BMurhLUHDcR17o0twT6YKUsg8274Iasqw2nU3agnmqU" drcloudemr.com text = "_acme-challenge.drcloudemr.com=KPzrw_K9l13kQZHbd41wNCMjmIkwekW8I8zEKcs1uWM" ``` ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [January 11, 2021, 7:30am UTC](https://community.letsencrypt.org/t/error-issuing-renewingcertificates/142422/10 "2021-01-11T07:30:01Z")
And here is the WHY: ```auto nslookup -q=txt _acme-challenge.drcloudemr.com _acme-challenge.drcloudemr.com canonical name = drcloudemr.com.letsencrypt.vdeck.eigdyn.com ``` The MANY entries are actually at: `nslookup -q=txt drcloudemr.com.letsencrypt.vdeck.eigdyn.com` ---
**Author:** ![rammohan](https://avatars.discourse-cdn.com/v4/letter/r/a9a28c/32.png) [@rammohan](https://community.letsencrypt.org/u/rammohan)\ **Post date:** [January 11, 2021, 7:49am UTC](https://community.letsencrypt.org/t/error-issuing-renewingcertificates/142422/11 "2021-01-11T07:49:14Z")
Correct. There are too many entries there. Everytime I try to generate certificates, it fails with one of those entries, Example: Domain: [drcloudemr.com](http://drcloudemr.com) Type: unauthorized Detail: Incorrect TXT record "fn6xGzNYHRCjf1nGu025RJNYLXTRyil3x553xrj18WE" (and 19 more) found at \_acme-challenge.drcloudemr.com Seems like I need to delete those entries and am not sure how to do that. Thanks ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [January 11, 2021, 10:18am UTC](https://community.letsencrypt.org/t/error-issuing-renewingcertificates/142422/12 "2021-01-11T10:18:42Z")
> [@rammohan](#): > > Since, I don't see these TXT records on my DNS provider, I can't delete them from there. Is there a way to get these TXT record deleted ? Where do you **add** the TXT records then? Because if I understand you correctly _now_, if you _add_ a TXT record, you get some kind of "Succes" message in your DNS zone editor, but it doesn't appear in your DNS zone? Who added the CNAME for the `_acme-challenge` subdomain? Do you see that entry? The CNAME delegates to a zone managed by "[ns1.yourhostingaccount.com](http://ns1.yourhostingaccount.com)." Does "yourhostingaccount" mean anything to you? ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [January 11, 2021, 10:31am UTC](https://community.letsencrypt.org/t/error-issuing-renewingcertificates/142422/13 "2021-01-11T10:31:07Z")
The first two entries are completely useless and should be deleted. The entries contain all that is between the quotes. [which included the name of the destination entry itself and an equal sign] And they are not even located where LE would be looking. The second set is CNAMEd (redirected) and does contain valid entries (although they have all probably expired and should be deleted). LE goes here looking for the entries here: `_acme-challenge.drcloudemr.com` That location says [we moved] you can now find us here: `drcloudemr.com.letsencrypt.vdeck.eigdyn.com` That location isn't being updated properly and contains many old/stale records. You need to understand how the DNS TXT challenge works and how your DNS is setup to deal with it. If that setup doesn't work, you may need to change it to one that does. ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [January 11, 2021, 10:41am UTC](https://community.letsencrypt.org/t/error-issuing-renewingcertificates/142422/14 "2021-01-11T10:41:35Z")
The "EIG" in: `drcloudemr.com.letsencrypt.vdeck.eigdyn.com` Probably refers to the parent company of brands like: `HostGator` ![image](https://global.discourse-cdn.com/letsencrypt/original/3X/6/5/65a021c5355b53bc658aed8792a04734792a030a.png) ---
**Author:** ![rammohan](https://avatars.discourse-cdn.com/v4/letter/r/a9a28c/32.png) [@rammohan](https://community.letsencrypt.org/u/rammohan)\ **Post date:** [January 12, 2021, 4:45am UTC](https://community.letsencrypt.org/t/error-issuing-renewingcertificates/142422/15 "2021-01-12T04:45:13Z")
Thanks. Is there a way to delete entries from [drcloudemr.com.letsencrypt.vdeck.eigdyn.com](http://drcloudemr.com.letsencrypt.vdeck.eigdyn.com) ? Thanks ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [January 12, 2021, 4:48am UTC](https://community.letsencrypt.org/t/error-issuing-renewingcertificates/142422/16 "2021-01-12T04:48:19Z")
There should be. But you would have to have some level of control over that domain to make any changes. OR Just stop using it. [remove the CNAME in your domain that points to it] ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [February 11, 2021, 4:48am UTC](https://community.letsencrypt.org/t/error-issuing-renewingcertificates/142422/17 "2021-02-11T04:48:28Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.