I cannot issue a wildcard certificate

Help
1

My domain is: qpalzm.tk

I ran this command: acme.sh --issue --dns dns_cf -d qpalzm.tk -d *.qpalzm.tk --force
It produced this output:

Sign failed, finalize code is not 200.
{
  "type": "urn:ietf:params:acme:error:unauthorized",
  "detail": "Error finalizing order :: CSR is missing Order domain \"*.qpalzm.tk\"",
  "status": 403
}

My web server is (include version): Nginx:latest

The operating system my web server runs on is (include version): CentOS 7

My hosting provider, if applicable, is: Cloudflare

I can login to a root shell on my machine: yes

I'm using a control panel to manage my site: no

The version of my client is: acme.sh v2.8.9

2 Likes
2

Welcome to the Let's Encrypt Community, Michael :slightly_smiling_face:

Please try the following command and let us know the result:

acme.sh --issue -d 'qpalzm.tk' -d '*.qpalzm.tk' --dns dns_cf

1 Like
3

I'm not an expert on acme.sh but a quick google suggests that your wildcard domain should be quoted :

e.g. acme.sh --issue --dns dns_cf -d qpalzm.tk -d '*.qpalzm.tk'
https://www.cyberciti.biz/faq/issue-lets-encrypt-wildcard-certificate-with-acme-sh-and-cloudflare-dns/

2 Likes
4

You're a bit late there @webprofusion. :slightly_smiling_face:

1 Like
5

Story of my life :smile:

2 Likes
8

Same response.

Sign failed, finalize code is not 200.
{
  "type": "urn:ietf:params:acme:error:unauthorized",
  "detail": "Error finalizing order :: CSR is missing Order domain \"*.qpalzm.tk\"",
  "status": 403
}
2 Likes
9

Everybody knows how to use google. And there's no difference between with and without a quotation mark for a wildcard domain.

1 Like
10

Ha, yes, I wasn't saying that you didn't know how to google stuff but I can see how that may be implied from my response. I was saying that I had to google it because I don't know much about acme.sh.

Where I've seen issues like this before there has sometimes been a hidden character (such as a unicode hidden space) in the original configuration which meant that *.qpalzm.tk wasn't the same as *.qpalzm.tk‏‏‎​‎‎ despite looking the same.

2 Likes
11

If you have a file in your local filesystem's working directory that matches the wildcard, the shell will replace it before running the command.

$ echo *.example.com is a domain name
*.example.com is a domain name
$ echo hello > different.example.com
$ echo *.example.com is a domain name
different.example.com is a domain name
$ echo "*.example.com is a domain name"
*.example.com is a domain name
$ rm different.example.com
$ echo *.example.com is a domain name
*.example.com is a domain name

I don't think this is likely to be the reason for the error you're getting, but it's still good advice to use quotes in Unix shell commands when trying to refer to names that contain *, such as DNS wildcard names.

4 Likes
12

wildcard is handy for those who run complex websites with several servers (VMs)

13

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.