We try certbot, certmanager y finaly
getssl ver. 2.27
always same issue, no resolution from let’s encrypt server, this is for political reasons ?
from internet, same machines, etc works great, but i can’t get let’s encrypt certificates …
sleep 5 secs before testing verify again
checking if challenge is complete
response {
“type”: “http-01”,
“status”: “invalid”,
“error”: {
“type”: “urn:ietf:params:acme:error:dns”,
“detail”: “DNS problem: SERVFAIL looking up A for pvtdev.sed.srcei.cl - the domain’s nameservers may be malfunctioning”,
“status”: 400
},
“url”: “https://acme-staging-v02.api.letsencrypt.org/acme/chall-v3/57601405/Y5MSRQ”,
“token”: “FNzsT2do6_iSws1xjfv8wYqBaRfbLZl10e6bsdaxpII”
}
code 200
response status = invalid
getssl: pvtdev.sed.srcei.cl:Verify error: “detail”: “DNS problem: SERVFAIL looking up A for pvtdev.sed.srcei.cl - the domain’s nameservers may be malfunctioning”,
I have found this topic very interesting, however if possible I would like to know which RFCs talk about the need to support Echo Capitalized, if I’m not mistaken the RFC 4343 mentions that it is case insensitive. Nevertheless I think that name servers should support this, however we know that two domains with the same name cannot exist be it with uppercase or lowercase differences so what would be the security advantange to support Echo Capitalized? For domain resolution there seems to be no problem at all.
As I said, I would like to know more and if you have any documentation or the time (and patience) to elaborate further that would be awesome.
Thank you!
EDIT: In the siccl’s case, the error:
Domain: pvtdev.sed.srcei.cl Type: dns Detail: DNS problem: SERVFAIL looking up CAA for pvtdev.sed.srcei.cl - the domain’s nameservers may be malfunctioning**
5.2. It is strongly urged that the DNS specification be amended to require that the question section from the request MUST be copied, exactly, bit for bit, into the question section of the response. The DNS specification is silent on the matter of altering 0x20 bits in the question name when copying it from the request to the response, so, this change is "within the spirit."
So Name Servers should do that. Resolvers can use it to check, if the answer isn't changed.
It's an additional step to check, if the answer is correct / not spoofed etc.
Letsencrypt uses an Unbound instance with the same config like unboundtest. So if unboundtest fails because of the echo capitalization, Letsencrypt will fail too.