Guidance needed: Setting up Google Domain with Google Cloud DNS and Lets Encrypt wildcard... possible?

Help
21

ok, thnx, let me try again...
i create a new zone "abc.com" , in lets encrypt i use the wildcard "*.abc.com"

deleted all records on google domain, nothing to see there now

if i run, then i receive this error:

Requesting a certificate for *.abc.com
Waiting 60 seconds for DNS changes to propagate
Certbot failed to authenticate some domains (authenticator: dns-google). The Certificate Authority reported these problems:
  Domain: abc.com
  Type:   dns
  Detail: DNS problem: NXDOMAIN looking up TXT for _acme-challenge.abc.com - check that a DNS record exists for this domain
22

if i do create that cname record "_acme-challenge.abc.com" on google domains, then it succeeds... if i remove it , then the same error again

23

What did you "create" exactly.
I can't see what you're doing.
:eyes:

All this secrecy is silly.
Is the domain ABC.COM?
If not, then don't type that anymore - that is a real domain name.

24

ok, the domain is "pergola-quintens.com"

screens :

image

with that it fails...

if i create this cname on google domain:

image
image1018×205 11.9 KB

then i get a step further it can find the TXT record, but it complains about the NS servers

Certbot failed to authenticate some domains (authenticator: dns-google). The Certificate Authority reported these problems:
  Domain: pergola-quintens.com
  Type:   dns
  Detail: DNS problem: SERVFAIL looking up TXT for _acme-challenge.pergola-quintens.com - the domain's nameservers may be malfunctioning
25

the name servers on google cloud dns and google domains, are different, maybe thats why ?

26

There is still a CNAME wreaking havoc!:

nslookup -q=txt _acme-challenge.pergola-quintens.com
_acme-challenge.pergola-quintens.com    canonical name = _acme-challenge.pergola-quintens.com

It is doing a CNAME to itself!

Plese delete that CNAME.

27

yes, for the second test i created that cname... if i remove it , like now its removed from google domain, then i receive this error:

Requesting a certificate for *.pergola-quintens.com
Waiting 60 seconds for DNS changes to propagate
Certbot failed to authenticate some domains (authenticator: dns-google). The Certificate Authority reported these problems:
  Domain: pergola-quintens.com
  Type:   dns
  Detail: DNS problem: NXDOMAIN looking up TXT for _acme-challenge.pergola-quintens.com - check that a DNS record exists for this domain

thnx for your help btw, appreciated!!

28

Is there any way to run through the cert request completely manually?
[again, I'm not familiar with that ACME client used by Home Assistant]

29

no experiance with that, but can provide you my google.json file with all secrets ... ? its just for testing now, i can remove the project and start again

30

Can you log in to HA (linux prompt)?

31

No - don't do that!

32

yes, linux prompt works , but dont know the command line what i need to execute

33

Let's try finding the ACME client, with (some clever searching):
grep -R fullchain /etc/*

34

hmm, there is none in , its a docker based system...
i do have a test debian system, i can install there an acme client , or on my windows system

35

ok, installed one acme.sh version v3.0.2

36

Aaaah!

But that is technically on the wrong system - not the one that will be using the cert.
Unless you plan on proxying everything through this system then onto the docker...(via HTTP)?

Sorry mixing threads - lack of sleep.
If you can get the cert via acme.sh and then "move" it to wherever it will be used, then that can work better.
Since more people here can help with any related issues (a lot faster).

37

yeah, cant access that specific lets encrypt docker, since its always stopped
so installed acme.sh on a debian client, but not sure how the command looks like to create certificates with json file from google with all secrets

38

indeed, i'm not going to use it on that server

thet lets encrypt docker (addon on home assistant) just creates the 2 ssl files ... i can move them to whatever system i want, did it before when i was using the free duckdns one

39

Review their docs, it supports many DNS systems.

40

certbot/certbot-dns-google/certbot_dns_google at master · certbot/certbot · GitHubinit.py