mySSLclient.Certificate.Obtain error:error: one or more domains had a problem:\n[.panghui.life] [.panghui.life] acme: error presenting token: no subdomain because the domain and the zone are identical

s1007149053 · April 10, 2023, 3:49am

Apply for SSL，report errors：%smySSLclient.Certificate.Obtain error:error: one or more domains had a problem:acme: error presenting token: no subdomain because the domain and the zone are identical

schoen · April 10, 2023, 3:52am

Hi @s1007149053,

This looks like an error from Traefik. According to this recent bug report, it might potentially be a bug that was introduced in a newer version of Traefik:

github.com/traefik/traefik

Error renewing certificate from LE

opened 11:36PM - 05 Apr 23 UTC

Izanagi52

status/0-needs-triage contributor/waiting-for-feedback

### Welcome! - [X] Yes, I've searched similar issues on [GitHub](https://gith…ub.com/traefik/traefik/issues) and didn't find any. - [X] Yes, I've searched similar issues on the [Traefik community forum](https://community.traefik.io) and didn't find any. ### What did you do? My let's encrypt certificate expiration date was in less than 30 day. ### What did you see instead? Certificate doesn't renew. Downgrade to 2.8.8 make my certificate renewed immediately. ### What version of Traefik are you using? ``` Version: 2.9.9 Codename: banon Go version: go1.20.2 Built: 2023-03-21T15:52:28Z OS/Arch: linux/arm64 ``` ### What is your environment & configuration? ```toml [entryPoints.websecure.http.tls] certResolver = "letsencrypt" [[entryPoints.websecure.http.tls.domains]] main = "exemple.fr" sans = ["*. exemple.fr"] [certificatesResolvers.letsencrypt.acme] email = "exemple@xx.yy" preferredChain = "ISRG Root X1" storage = "/acme/acme.json" [certificatesResolvers.letsencrypt.acme.dnsChallenge] provider = "ovh" delayBeforeCheck = 10 resolvers = ["1.1.1.1:53", "8.8.8.8:53"] ``` ### If applicable, please paste the log output in DEBUG level ``` time="2023-04-03T18:22:30+02:00" level=error msg="Error renewing certificate from LE: {exemple.fr [*.exemple.fr]}" providerName=letsencrypt.acme ACME CA="https://acme-v02.api.letsencrypt.org/directory" error="error: one or more domains had a problem:\n[*.exemple.fr] [*.exemple.fr] acme: error presenting token: ovh: no subdomain because the domain and the zone are identical: exemple.fr.\n[exemple.fr] [exemple.fr] acme: error presenting token: ovh: no subdomain because the domain and the zone are identical: exemple.fr.\n" ```

I would suggest posting in that issue and/or in the Traefik community forum

The reason for my suggestion is that this appears to be a Traefik-specific error, and I don't believe any Traefik developers are currently participating on this forum.

schoen · April 10, 2023, 3:58am

Sorry, the underlying error seems to come from Lego and might not be specific to Traefik! (It's just that the only reference I could find to someone else getting this message was that report from a Traefik user.)

This error message is actually generated by the Lego client under certain circumstances:

github.com

go-acme/lego/blob/master/challenge/dns01/domain.go

package dns01

import (
	"fmt"
	"strings"

	"github.com/miekg/dns"
)

// ExtractSubDomain extracts the subdomain part from a domain and a zone.
func ExtractSubDomain(domain, zone string) (string, error) {
	canonDomain := dns.Fqdn(domain)
	canonZone := dns.Fqdn(zone)

	if canonDomain == canonZone {
		return "", fmt.Errorf("no subdomain because the domain and the zone are identical: %s", canonDomain)
	}

	if !dns.IsSubDomain(canonZone, canonDomain) {
		return "", fmt.Errorf("%s is not a subdomain of %s", canonDomain, canonZone)

This file has been truncated. show original

I wonder if something else was changed in Lego (or in a Lego DNS API integration) which makes this error more likely to be triggered when it wouldn't have been triggered in older Lego versions.

s1007149053 · April 10, 2023, 4:04am

So what should I do? I'm not a professional programmer, could you please give me a solution.

schoen · April 10, 2023, 4:06am

I have just opened a discussion at

If you have a GitHub account, you could add more details in that discussion about your environment and what you were doing when you got this error. Otherwise, if you provide those details here, I can add them to the discussion there.

s1007149053 · April 10, 2023, 4:08am

2023-04-10 11:59:48	time=2023-04-10T11:59:48+08:00 level=info msg=CADirURL:https://acme-v02.api.letsencrypt.org/directory
2023-04-10 11:59:49	time=2023-04-10T11:59:49+08:00 level=info msg=[INFO] acme: Registering account for 1007149053@qq.com
2023-04-10 11:59:50	time=2023-04-10T11:59:50+08:00 level=info msg=[INFO] [panghui.life, *.panghui.life] acme: Obtaining bundled SAN certificate
2023-04-10 11:59:51	time=2023-04-10T11:59:51+08:00 level=info msg=[INFO] [*.panghui.life] AuthURL: https://acme-v02.api.letsencrypt.org/acme/authz-v3/218167292207
2023-04-10 11:59:51	time=2023-04-10T11:59:51+08:00 level=info msg=[INFO] [panghui.life] AuthURL: https://acme-v02.api.letsencrypt.org/acme/authz-v3/218167292217
2023-04-10 11:59:51	time=2023-04-10T11:59:51+08:00 level=info msg=[INFO] [*.panghui.life] acme: use dns-01 solver
2023-04-10 11:59:51	time=2023-04-10T11:59:51+08:00 level=info msg=[INFO] [panghui.life] acme: Could not find solver for: tls-alpn-01
2023-04-10 11:59:51	time=2023-04-10T11:59:51+08:00 level=info msg=[INFO] [panghui.life] acme: Could not find solver for: http-01
2023-04-10 11:59:51	time=2023-04-10T11:59:51+08:00 level=info msg=[INFO] [panghui.life] acme: use dns-01 solver
2023-04-10 11:59:51	time=2023-04-10T11:59:51+08:00 level=info msg=[INFO] [*.panghui.life] acme: Preparing to solve DNS-01
2023-04-10 11:59:51	time=2023-04-10T11:59:51+08:00 level=info msg=[INFO] Found CNAME entry for _acme-challenge.panghui.life.: \panghui.life.\|
2023-04-10 11:59:51	time=2023-04-10T11:59:51+08:00 level=info msg=[INFO] [panghui.life] acme: Preparing to solve DNS-01
2023-04-10 11:59:51	time=2023-04-10T11:59:51+08:00 level=info msg=[INFO] Found CNAME entry for _acme-challenge.panghui.life.: \panghui.life.\|
2023-04-10 11:59:51	time=2023-04-10T11:59:51+08:00 level=info msg=[INFO] [*.panghui.life] acme: Cleaning DNS-01 challenge
2023-04-10 11:59:51	time=2023-04-10T11:59:51+08:00 level=info msg=[INFO] Found CNAME entry for _acme-challenge.panghui.life.: \panghui.life.\|
2023-04-10 11:59:52	time=2023-04-10T11:59:52+08:00 level=info msg=[WARN] [*.panghui.life] acme: cleaning up failed: alicloud: no subdomain because the domain and the zone are identical: panghui.life.
2023-04-10 11:59:52	time=2023-04-10T11:59:52+08:00 level=info msg=[INFO] [panghui.life] acme: Cleaning DNS-01 challenge
2023-04-10 11:59:52	time=2023-04-10T11:59:52+08:00 level=info msg=[INFO] Found CNAME entry for _acme-challenge.panghui.life.: \panghui.life.\|
2023-04-10 11:59:52	time=2023-04-10T11:59:52+08:00 level=info msg=[WARN] [panghui.life] acme: cleaning up failed: alicloud: no subdomain because the domain and the zone are identical: panghui.life.

s1007149053 · April 10, 2023, 4:09am

I don't know if these can help you.

schoen · April 10, 2023, 4:10am

A little bit, thanks! Can you also indicate which web server application and hosting environment you're using, and how you administer your web site?

s1007149053 · April 10, 2023, 4:11am

schoen · April 10, 2023, 4:17am

Sorry, I don't quite understand what that software is; how are you using it? And how and where is your web site hosted?

s1007149053 · April 10, 2023, 4:19am

My small server is unraid,This application runs on Docker.I manage security certificates through it.Alibaba provides DNS services.

schoen · April 10, 2023, 4:23am

Thanks, and can you describe what you did in order to request the certificate?

s1007149053 · April 10, 2023, 4:27am

I filled in Alibaba's ID and the program helped me with everything

schoen · April 10, 2023, 4:28am

Where did you do that? In a web interface? For Unraid, or for something else?

s1007149053 · April 10, 2023, 4:29am

For Unraid

schoen · April 10, 2023, 4:49am

OK, I passed that information along to the Lego developers. We'll see if they can identify the source of the problem.

You might also find it useful to post over at the Unraid forum:

https://forums.unraid.net/

s1007149053 · April 10, 2023, 8:56am

The cause of the problem has been identified. It is that the secondary domain name in the DNS supplier directly uses the IP of the primary domain name. By DDNS the secondary domain name separately, the problem can be solved.

system · May 10, 2023, 8:57am

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.

mySSLclient.Certificate.Obtain error:error: one or more domains had a problem:\n[*.panghui.life] [*.panghui.life] acme: error presenting token: no subdomain because the domain and the zone are identical

mySSLclient.Certificate.Obtain error:error: one or more domains had a problem:\n[.panghui.life] [.panghui.life] acme: error presenting token: no subdomain because the domain and the zone are identical