My domain is:
carrz-fox-fire.com (Primary domain, there are others)
I ran this command:
nsupdate -d -k /tmp/acme/carrz-fox-fire/carrz-fox-fire.comnsupdate_acme-challenge.carrz-fox-fire.com.key
Then
server 192.168.2.32
zone carrz-fox-fire.com
update delete _acme-challenge.carrz-fox-fire.com TXT
update add _acme-challenge.carrz-fox-fire.com 60 TXT "carrz-fox-fire.com"
show
send
It produced this output:
It inserted the test record, but then gave the error.
;; UPDATE SECTION:
_acme-challenge.carrz-fox-fire.com. 0 ANY TXT
_acme-challenge.carrz-fox-fire.com. 60 IN TXT "carrz-fox-fire.com"
;; TSIG PSEUDOSECTION:
pfsense-key. 0 ANY TSIG hmac-md5.sig-alg.reg.int. 1779496607 300 16 xVE/AI2f2AY1oLy4ikRqoA== 11188 NOERROR 0
; TSIG error with server: tsig verify failure
When I try to use pfSense [Issue/Renew], I receive this error.
dns_request_getresponse: expected a TSIG or SIG(0)
My web server is (include version):
IIS 10
The operating system my web server runs on is (include version):
Windows 2016 Server Core
My hosting provider, if applicable, is:
Myself. I self-host
I can log in to a root shell on my machine (yes or no, or I don't know):
I am logged in to pfSense, DNS Server, and IIS Server.
I'm using a control panel to manage my site (no, or provide the name and version of the control panel):
IIS Manager through the Domain Network
The version of my client is (e.g., output of certbot --version or certbot-auto --version if you're using Certbot):
Through pfSense 2.8.1-RELEASE
ACME 1.2 (Just updated today)
Additional Information
DNS Setup
DNS Settings for each domain
Dynamic updates: Nonsecure and secure
pfSense
- Services
- ACME
- Certificates
- Edit
Validation
SAN list
Each record is set up like this, but with its own domain, of course.
| Status | SAN | Validation Method |
|---|---|---|
| Enabled | carrz-fox-fire.com | DNS-NSupdate / RFC 2136 |
| Enabled | *.carrz-fox-fire.com | DNS-NSupdate / RFC 2136 |
| Server | 192.168.2.32 |
|---|---|
| Key Name | pfsense-key (With and without a period at the end) |
| Key Algorithm | HMAC-MD5 |
| Key | long string |
| Zone | carrz-fox-fire.com (With and without the domain in the Zone) |
It used to work; the last update was on
Wed, 29 Apr 2026 19:34:25 -0400
Issued Certificate Dates:
Valid From: Wed, 29 Apr 2026 18:35:54 -0400
Valid Until: Tue, 28 Jul 2026 18:35:53 -0400
Nothing on the Windows Server has changed.
I updated today the Cert from 1.0 to 1.2 on pfSense (Mentioned above)
I researched and found another thread on here about Python versions being an issue, but there is no Python folder in the /usr/lib/
Test I have run.
drill
/root: drill TXT _acme-challenge.carrz-fox-fire.com @192.168.2.32
;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 56240
;; flags: qr aa rd ; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;; _acme-challenge.carrz-fox-fire.com. IN TXT
;; ANSWER SECTION:
_acme-challenge.carrz-fox-fire.com. 60 IN TXT "carrz-fox-fire.com"
;; AUTHORITY SECTION:
;; ADDITIONAL SECTION:
;; Query time: 0 msec
;; SERVER: 192.168.2.32
;; WHEN: Fri May 22 21:40:01 2026
;; MSG SIZE rcvd: 83
I also removed the main folder
rm -rf /tmp/acme/carrz-fox-fire
And then created it again.
mkdir -p /tmp/acme/carrz-fox-fire
Then run [Issue/Renew] in pfSense, but the error persists.
Running grep gives me this.
grep -R "pfsense-key" /tmp/acme /usr/local/etc /var
/tmp/acme/carrz-fox-fire/carrz-fox-fire.comnsupdate_acme-challenge.carrz-fox-fire.com.key:key "pfsense-key." {
I even reverted pfSense to my last backup from three weeks ago, around the time of the last cert update, but the issue persisted.
I am at a complete loss. It worked last month. Updated the records, the script ran to copy the cert to a Share on the network, which was then picked up by CCS in IIS. It all worked great, but now, it is not working.
Any information on how to resolve this would be wonderful.
Thank you in advance.
Wayne
