Error to certificate - Incorrect TXT record

[mstoluca]

me manda este error ya le puse el acme a el dns y espere la propagacion pero sige dando error

Certbot failed to authenticate some domains (authenticator: manual). The Certificate Authority reported these problems:
Domain: withx.domain.com
Type: unauthorized
Detail: Incorrect TXT record "oitD_Tswcf8fGgU_w_ggET1iHNFrb076-Kgjrz3b2F85Yp6jgjCIO8" found at _acme-challenge.withx.domain.com

Domain: withx.domain.com
Type: unauthorized
Detail: Incorrect TXT record "oitD_TNwcf8fGgU_w_ggET1iHNFrb076-Kgjrz3b2F85Yp6jgjCIO8" found at _acme-challenge.withx.domain.com

Hint: The Certificate Authority failed to verify the DNS TXT records created by the --manual-auth-hook. Ensure that this hook is functioning correctly and that it waits a sufficient duration of time for DNS propagation. Refer to "certbot --help manual" and the Certbot User Guide.

Some challenges have failed.
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.
root@saas:/etc/apache2/sellyoursaas-enabled#

comando ejecutado

certbot certonly -n --manual-public-ip-logging-ok --server https://acme-v02.api.letsencrypt.org/directory --agree-tos --manual --preferred-challenges=dns --manual-auth-hook /home/admin/wwwroot/dolibarr_sellyoursaas/scripts/letsencrypt_authenticator.sh -d "*.with.domain.com,with.domain.com" -m agp@unboxerp.com --deploy-hook "systemctl restart apache2"

[MikeMcQ]

@mstoluca

Detail: Incorrect TXT record "oitD_Tswcf8fGgU_w_ggET1iHNFrb076-Kgjrz3b2F85Yp6jgjCIO8" found at _acme-challenge.withx.domain.com

I hope you can read English. Is that TXT record still there? Because I don't see it. See unboundtest tool which looks up DNS records similar to Let's Encrypt

I see the name servers are in AWS Route53. Is that where you added the TXT records?

[mstoluca]

@MikeMcQ

I hope you can read English. Is that TXT record still there? Because I don't see it. See unboundtest tool which looks up DNS records similar to Let's Encrypt

I see the name servers are in AWS Route53. Is that where you added the TXT records?

I CREATE THEM IN WHM WHERE I HAVE THE DOMAIN BUT SERVER THEM IF I HAVE THEM IN AWS

I CHANGE THE ONES IT ASKED ME FOR, I CHECK THE PROPAGATION SINCE THEY ARE PROPAGATED, I RUN THE COMMAND AGAIN AND IT MARKS ME AN ERROR AND IT GENERATES NEW ONES,

BUT IF YOU SEE ME WHAT I PUT BEFORE

[MikeMcQ]

@mstoluca

I CHECK THE PROPAGATION SINCE THEY ARE PROPAGATED,

How did you check? Because I don't see any TXT records (below). Did you see them in unboundtest? If so, what domain name did you use?

dig TXT +short _acme-challenge.withx.domain.com
dig A   +short withx.domain.com
dig A   +short domain.com
18.221.195.49

[mstoluca]

[mstoluca]

@MikeMcQ

unboundtest

[MikeMcQ]

@mstoluca

Detail: Incorrect TXT record "oitD_Tswcf8fGgU_w_ggET1iHNFrb076-Kgjrz3b2F85Yp6jgjCIO8" found at _acme-challenge.withx.domain.com

Oh, I understand. That was not your real domain name.

I see two problems. One, your DNS name servers are not configured properly. See the dnsviz test site. It shows your authoritative name servers don't match your delegation set. Let's Encrypt uses the authoritative name servers.

The second problem is those two values should show up as separate lines. You need to enter them differently. Check with your DNS system.

Example using unboundtest:
Yours:

_acme-challenge.withx.unboxcrm.com.	0	IN	TXT	"RIhOFGyfKAHo4d54o3anqpq7Qkhzt_0uBz02s_IgbQg" "MF6Yys7DMXaQgvVk2f0ZhRngLNS_4hcqVh51jAIKB3M"

Should look like:

_acme-challenge.withx.unboxcrm.com.	0	IN	TXT	"Value1"
_acme-challenge.withx.unboxcrm.com.	0	IN	TXT	"Value2"

[mstoluca]

[MikeMcQ]

I don't see any change to your TXT format. unboundtest.com still shows both values on same line.
https://unboundtest.com/m/TXT/_acme-challenge.withx.unboxcrm.com/T3Y2CSF4

You could try asking whoever provides that panel how to do it.

On my system you enter both values in same box but on separate lines. That is, paste in the first value, press enter to get new line and paste the second value.

Maybe in your system you need to enter two records with the same _acme-challenge.withx.unboxcrm.com name with just a single value in each box. I do not know. You will have to experiment or ask for your panel provider advice until it looks like my sample in unboundtest from post #7

What does that manual-auth-hook do? Does it update the DNS records? If so, as a test remove that option from certbot command. Certbot will pause and show you the values.
Then, put the values in your DNS manually until you know the method that works. Then find out how to get the script to do the same thing.

[rg305]

@mstoluca

I CREATE THEM IN WHM WHERE I HAVE THE DOMAIN BUT SERVER THEM IF I HAVE THEM IN AWS

I CHANGE THE ONES IT ASKED ME FOR, I CHECK THE PROPAGATION SINCE THEY ARE PROPAGATED, I RUN THE COMMAND AGAIN AND IT MARKS ME AN ERROR AND IT GENERATES NEW ONES,

BUT IF YOU SEE ME WHAT I PUT BEFORE

Maybe the CAPS LOCK key got stuck and is interfering.
It is definitely interfering with my understanding, I can't read ALL CAPS well.