We have a problem where lets encrypt server occasionally doesn’t verity dns-01 tasks and keeps these in “pending” state for ever (or until we send “resource”: “challenge” again). Example, we get new authz for psql02.trm-trans.beep.pl: 2019-03-12 15:09:58,236 - DEBUG - JWS payload: b'{\n "identifi…

Hi @arek [image] arek: But until now it didn’t verify dns zones and status stays in pending. I'm not so firm with the ACME-version 1, I've used only v2. But did you send a confirmation that the challenge is done? Your link https://acme-v01.api.letsencrypt.org/acme/authz/vwKBbydMj09GXl6Cw-…

[image] arek: 2019-03-12 15:15:05,484 - DEBUG - JWS payload: b'{\n "resource": "challenge",\n "keyAuthorization": "5BsMA6xfGs1h5tVPL-C7fbv_nIK2lpeai_hfs_QrsPA.ndBNik9Qn4ddsVca8VLjaHENcFnRCFa1Rg30N_p3M8w",\n "type": "dns-01"\n}' 2019-03-12 15:15:05,516 - DEBUG - Sending POST request to https://ac…

[image] arek: Isn’t above doing that? Yes, it would appear to be doing the right thing. ACME v1 never implemented the processing state on challenge resources. It could only ever be (pending, valid, invalid). So it's hard to distinguish between challenge getting 'stuck' at the RA and any oth…

[image] arek: Isn’t above doing that? What was the response to this request? What ACME client are you using?

[image] cpu: What was the response to this request? See "Where letsencrypt accepted that:" part in initial post. All requests/replies to/from letsencrypt server are there. [image] cpu: What ACME client are you using? It's our own client (based on acme library from older version of cer…

Thanks, I will ask the on-call engineer to investigate.

@lestaff Any progress with checking?

I’ve reminded someone to follow-up. Thanks

Ok. Another case for comparision 2019-03-11 16:15:18,604 - DEBUG - JWS payload: b'{\n "identifier": {\n "type": "dns",\n "value": "mysql07.bcsolutions.beep.pl"\n },\n "resource": "new-authz"\n}' 2019-03-11 16:15:18,633 - DEBUG - Sending POST request to https://acme-v01.api.letsencrypt.…

Sorry for the delay here. It looks like our RPCs to store the updated challenge information after validation are failing some fraction of the time. Our SRE team is looking into what’s causing an elevated error rate there. We’ll update you when we know more.

Letsencrypt doesn't verify dns-01 and leaves challenge in status: pending state

Issuance Tech

Topic		Replies	Views
DNS validation remains in pending status Help	8	5896	August 23, 2017
DNS challenge is in staging Feature Requests	49	28057	February 10, 2016
Dns-01 challenge has been circulating for a long time, but I still haven't been able to achieve it Client dev	25	2849	July 20, 2019
DNS problem: SERVFAIL looking up A Help	25	4687	February 13, 2020
DNS Challenge is "pending" 2 days Help	16	5262	January 5, 2020

Letsencrypt doesn't verify dns-01 and leaves challenge in status: pending state

Related topics