Error renewing SSL certificate - DNS problem: query timed out looking up CAA for linkpc.net

Help
1

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: downiesoft.linkpc.net

I ran this command: certbot certonly -d downiesoft.linkpc.net

It produced this output:
Saving debug log to /var/log/letsencrypt/letsencrypt.log

How would you like to authenticate with the ACME CA?

1: Apache Web Server plugin (apache)
2: Runs an HTTP server locally which serves the necessary validation files under
the /.well-known/acme-challenge/ request path. Suitable if there is no HTTP
server already running. HTTP challenge only (wildcards not supported).
(standalone)
3: Saves the necessary validation files to a .well-known/acme-challenge/
directory within the nominated webroot path. A seperate HTTP server must be
running and serving files from the webroot path. HTTP challenge only (wildcards
not supported). (webroot)

Select the appropriate number [1-3] then [enter] (press 'c' to cancel): 1
Requesting a certificate for downiesoft.linkpc.net

Certbot failed to authenticate some domains (authenticator: apache). The Certificate Authority reported these problems:
Domain: downiesoft.linkpc.net
Type: dns
Detail: DNS problem: query timed out looking up CAA for linkpc.net

Hint: The Certificate Authority failed to verify the temporary Apache configuration changes made by Certbot. Ensure that the listed domains point to this Apache server and that it is accessible from the internet.

Some challenges have failed.
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.

[N.B. Similar results are generated using the command certbot renew
Also this is the first time I have been unable to renew certificates in several years]

My web server is (include version): apache2 2.4.29-1ubuntu4.27

The operating system my web server runs on is (include version):
Ubuntu 18.04.1

My hosting provider, if applicable, is: N/A

I can login to a root shell on my machine (yes or no, or I don't know): yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel): No

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): certbot 2.7.4

2

looks like your nameserver just doesn't working?

2 Likes
3

The online tool https://dnsspy.io/ is in agreement with @orangepizza

image
image1452×909 32.5 KB

1 Like
4

That's what I thought, but I'm not sure if that means the DNS configuration is screwed on my web server, or if it's a problem with the DNSExit nameservers providing the dynamic DNS linkpc.net domain.

I tried switching my DNS lookup to Cloudflare nameservers (1.1.1.1/1.0.0.1) but it didn't make any difference.

I have also verified that LetsEncrypt is accessing the challenge files in .well-known on my web server with response code 200 (OK), so end-to-end communication is working.

So is it just a case of waiting for DNSExit to fix their CAA lookup issue?

5

Nope.

Yes!

Did you open a ticket with them?

2 Likes
6

Sorry, didn't see Bruce5051's reply before my last post.

Thanks for that, as it tends to confirm it's a problem with DNSExit nameservers rather than my local DNS lookup.

1 Like
7

Thanks, rg305. Yes, I opened a ticket with DNSExit yesterday, but as an unpaid user on DNSExit they won't necessarily take any notice.
But I'd hope it would alert them to a serious problem with their DNS servers, although you'd have hoped a Dynamic DNS hosting service would have already detected the problem with their DNS nameservers themselves!

2 Likes
8

Thanks @AGDownie I have the same problem with the same DNS provider that it was working since some times ago. Hopefully they'll solve.

By the way, I'm able to connect with ns10.dnsexit.com, but not ns11,ns12,ns13

1 Like
9

For the record, DNSexit.com have not yet fixed their CAA issue with linkpc.net, so I've decided to ditch them and migrated my DDNS provider to dynu.com, which seems much more competent organisation. A small amount of effort updating my client apps to work with the new DNS addresses (freeddns.org), but all done now.

5 Likes
10

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.