Error while renewing ceritificates using acme.sh DNSapi method

Help
21

@rg305
This is the same server that was used to generate the certificates the first time for all three domains. Also, I can renew certificates for backtoschoolimmunization.org but not the other two domains from this server. So I think that is not an issue.

22

@mnordhoff

for int.backtoschoolimmunization.org, the DNS entry is

_acme-challenge.int.backtoschoolimmunization.org CNAME _acme-challenge.ekicocvalidation.com

For qa.backtoschoolimmunization.org, The DNS entry is
_acme-challenge.qa CNAME _acme-challenge.ekicocvalidation.com

For this when I do dig, it is returning with an answer

[SVC-apache@dw21wil50 acme.sh-master]$ dig _acme-challenge.qa.backtoschoolimmunization.org

; <<>> DiG 9.9.4-RedHat-9.9.4-72.el7 <<>> _acme-challenge.qa.backtoschoolimmunization.org
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 47319
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4000
;; QUESTION SECTION:
;_acme-challenge.qa.backtoschoolimmunization.org. IN A

;; ANSWER SECTION:
_acme-challenge.qa.backtoschoolimmunization.org. 3600 IN CNAME _acme-challenge.ekicocvalidation.com.

;; AUTHORITY SECTION:
ekicocvalidation.com. 135 IN SOA ns31.domaincontrol.com. dns.jomax.net. 2018120415 28800 7200 604800 600

;; Query time: 4 msec
;; SERVER: 10.96.254.16#53(10.96.254.16)
;; WHEN: Tue Dec 04 11:42:17 CST 2018
;; MSG SIZE rcvd: 194

23

It doesn’t exist in your public DNS zone. The CNAME and TXT records have to exist in public, not just on the private side of your split horizon setup.

24

@mnordhoff

I am sorry, I didnt understand what you meant. Do you mean the entries should also be added in external DNS. Right now they are only added in internal DNS. Can you please elaborate.

Thank you for the quick response

25

Yes, exactly. The CNAME records -- and TXT records -- need to be in the external DNS, if that's what you call it.

26

Thank you @mnordhoff. After adding the entry in external DNS, I could renew certificates to the domains.

@stevenzhu @rg305 @JuergenAuer @mnordhoff Thank you guys. Great Support

1 Like
27

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.