My domain is: mountaintrips.com I ran this command: Options used in the renewal process [renewalparams] account = 2b8838f9899d92d51a3f2ba91aa3dd0c manual_public_ip_logging_ok = True renew_hook = /etc/letsencrypt/renewal-hooks/deploy/deploy.sh manual_auth_hook = /etc/letsencrypt/renewal-hooks/p…

Yes. Let's Encrypt asks the authoritative DNS servers for all the TXT records under the label, and then checks if any one of them matches the one it's looking for. Here is the literal text from RFC8555: To validate a DNS challenge, the server performs the following steps: Compute the SHA-256 d…

I think what’s happening is that the PUT API replaces all the TXT entries under _acme-challenge, so you’re wiping out your other challenge by accident. So if the order of operations in Certbot is: Call auth hook for first _acme-challenge challenge Call auth hook for second _acme-challenge challen…

Thanks for the reply. Hmm. But how did it work for the initial certificate request which was successful? Problem is that the location of the _acme-challenge TXT record for *.domain.com and domain.com are in the same place. If I removed the -d domain.com then it would work but anyone browsing to …

[image] jeffsani: But how did it work for the initial certificate request which was successful? I would guess that you fluked it by performing one of the authorizations on one run, and the other on another run. Because authorizations on a single Let's Encrypt account get remembered/reused fo…

To add some context, when Let’s Encrypt added wildcard support in the first place, heaps of custom hooks and clients had this precise issue, that they were incapable of creating multiple _acme-challenge TXT records against a single DNS label. So there was a lot of rewriting and bug fixing undertaken…

Ok, so are you saying I need to have multiple _acme-challenge records? I still do not understand how that would work. The LE DNS call would get a random response from GoDaddy in that scenario right? In my zone * is not a subdomain. Also, if you look at the logs, Certbot issues the same request f…

[image] jeffsani: I still do not understand how that would work. The LE DNS call would get a random response from GoDaddy in that scenario right? I think what needs to be understood in this context is that DNS is capable of serving multiple TXT records under a single label. For example, one …

[image] _az: I think what needs to be understood in this context is that DNS is capable of serving multiple TXT records under a single label. If it helps with understanding, it's exactly the same as having multiple A records for a given label when using DNS round robin.

Yes I know that. But when you have multiple records (A, TXT, etc…), when you query them, you will get a random response. So unless LE is requesting all TXT records and parsing through those, the authentication will potentially fail.

Aha! Ok, let me try this. Thank you.

Multi-level Wildcard Renewal is failing

Help

jeffsani February 15, 2020, 12:35am 11

Yes - this is my problem…

Topic		Replies	Views
Wildcard cert request renders "Incorrect TXT record" error Help	7	9562	April 19, 2018
Dns-01 challenge failing for only one specific domain Help	2	225	December 2, 2025
Failed authorization procedure: No TXT record found at _acme-challenge Help	4	4843	October 28, 2020
Letsencrypt + godaddy = fail Help	15	13371	August 7, 2020
Wildcard DNS challenge fails due to duplicate TXT record? Help	12	3542	August 13, 2021

Multi-level Wildcard Renewal is failing

Related topics