Manual Renewal fails with a CAA error yet CAA record is OK

Help
1

I'm getting wrapped around the axle trying to renew a certificate with (newly) DNSEC enabled.

I have a host "sol" inside my domain "prograde.net" and used -d prograde.net,sol.prograde.net to get the host name into the SAN list. But certbot seems to be trying to fetch a CAA record for "sol.prograde.net" which is a hostname. When a CAA fetch fails isn't it suppose to look to the containing domain? That doesn't seem to happen.

My domain is: prograde.net

I ran this command: certbot certonly --agree-tos -m 'mcashwell@icloud.com' --manual --config-dir=. --work-dir=. --logs-dir=. --preferred-challenges=dns --cert-name prograde.net -d prograde.net,sol.prograde.net

It produced this output:
Certbot failed to authenticate some domains (authenticator: manual). The Certificate Authority reported these problems:
Domain: sol.prograde.net
Type: dns
Detail: DNS problem: looking up CAA for sol.prograde.net: DNSSEC: Bogus: validation failure <sol.prograde.net. CAA IN>: nodata proof failed from 172.64.52.250

My web server is (include version): N/A (no web server. cert is for email over TLS)

The operating system my web server runs on is (include version): macOS 15.2

My hosting provider, if applicable, is: web.com (for DNS only)

I can login to a root shell on my machine (yes or no, or I don't know): yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel): no

The version of my client is: certbot 3.0.1

After the CAA error "dig @172.64.53.155 prograde.net. CAA" produced:

;; ANSWER SECTION:
prograde.net. 3600 IN CAA 0 issue "letsencrypt.org"

So the parent domain has a Let's Encrypt CAA record. Why isn't certbot using that?

Is there some way to get a hostname into the SAN without certbot thinking that hostname is a domain that must have its own CAA record?

I'm so confused. I suppose I can just disable DNSSEC which I think triggered all this.

2

No, only when there is no CAA RR present, which would show itself by a successful DNS query, but with no answer. However, in your situation your DNS' DNSSEC is malfunctioning. And an error is not acceptable.

You should fix your DNSSEC problem and afterwards try again.

Also, to be clear, Certbot is not giving this error, the Let's Encrypt ACME/validation server gives the error. Please appreciate the distinction between the ACME client and server.

1 Like
3

1: I originally had no CAA records. Fetches for CAA for sol.prograde.net and prograde.net did return "no answer" but the renewal process failed anyway.

2: My DNS provider is handling DNSSEC so I have no way to debug. Nor do I have even a cogent question I can ask them.

Turning off DNSSEC is my only path forward currently. Oh well.

4

Show them sol.prograde.net | DNSViz, especially the "sol.prograde.net/CAA (NODATA): No NSEC RR(s) were returned to validate the NODATA response. See RFC 4035, Sec. 3.1.3.1, RFC 5155, Sec. 7.2.3, RFC 5155, Sec. 7.2.4. (172.64.52.250, 172.64.53.155, UDP_-_EDNS0_4096_D_KN)" part.

2 Likes
5

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.