Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.
My domain is:loweoak.net
I ran this command:
certbot -v certonly --manual --preferred-challenges dns -d loweoak.net -d *.loweoak.net
It produced this output:
It asked me to put two _acme-challenge.loweoak.net in, but, my provider responded with "cannot create multiple TXT records with same name in standard web-interface."
My web server is (include version):
Apache
The operating system my web server runs on is (include version):
Fedora
My hosting provider, if applicable, is:
I can login to a root shell on my machine (yes or no, or I don't know):
yes
I'm using a control panel to manage my site (no, or provide the name and version of the control panel):
The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot):
You could switch to another authentication method... [Like: HTTP-01]
OR
Use one TXT record at a time.
This path is somewhat of a "trick".
It plays on the caching of the partial authentication.
Your request remains the same.
But you enter only the first TXT record.
Then after that request fails, you make the same request again.
But this time you enter only the second TXT record.
If all goes to plan, the combined individual validations will pass the authentication and you will receive the requested cert.
You probably want to change DNS provider, as this is a rather silly limitation from their part. It's perfectly fine and allowed by RFCs to have multiple TXT RR for the same name in a DNS zone.
As Rudy already said, you might also want to change to the http-01 challenge, but you wouldn't get a wildcard certificate then (as that's not allowed with the http-01 challenge).. Do you really require the wildcard certificate to begin with?
If you reaaaally need to use the dns-01 challenge, moving DNS provider also helps with handling the challenge itself, as there are multiple DNS providers out there with an API Certbot can interact with. See e.g. DNS providers who easily integrate with Let's Encrypt DNS validation for a non-comprehensively list.
Edit: Hmm, it seems Dyn is already on that list. It seems Lego is supported, so you might be able to use the certbot-dns-multi Certbot plugin, which uses lego under the hood, as a DNS plugin.
I don't think Certbot can combine different challenges in a single go. Not when using separate authenticators in any case. Certbot can only use a single authenticator plugin per invocation.
Using the manual plugin however, it might be possible. But I would not recommend the manual plugin at all.
$ nmap -Pn -p80,443 loweoak.net
Starting Nmap 7.80 ( https://nmap.org ) at 2023-09-06 10:26 PDT
Nmap scan report for loweoak.net (47.209.245.83)
Host is up (0.064s latency).
PORT STATE SERVICE
80/tcp filtered http
443/tcp open https
Nmap done: 1 IP address (1 host up) scanned in 2.09 seconds
Same here, wherever Google is making this VPN exit
❯ curl ifconfig.co; nmap -Pn -p80,443 loweoak.net
2606:40:c8:608d::6a:7f2
Starting Nmap 7.94 ( https://nmap.org ) at 2023-09-06 19:34 CEST
Nmap scan report for loweoak.net (47.209.245.83)
Host is up (0.21s latency).
PORT STATE SERVICE
80/tcp filtered http
443/tcp open https
Nmap done: 1 IP address (1 host up) scanned in 3.60 seconds
My router blocks the incoming ICMP error packets for some reason when using TCP So no proper trace in between. But the port 443 stops at the correct IP at hop 18 and the port 80 trace just keeps going till hop 30 (timeout).
So no proper trace in between. But the port 443 stops at the correct IP at hop 18 and the port 80 trace just keeps going till hop 30 (timeout).