Problem generating wildcard certificate through NPM

Help
1

My domain is: bdigital.uncu.edu.ar

Hello all

I am using NPMPlus to manage my domains and certificates. I need to generate a wildcard certificate *.bdigital.uncu.edu.ar

The guys that manage te DNS provided me the info to configure the RFC2136 plugin at NPMPlus but I keep getting a SERVFAIL error

I can't determine if there is something wrong with the info I used to confiigure it or with the plugin itself

my certbot_log file contains the following:

2026-09-17 13:02:46,092:DEBUG:certbot._internal.main:certbot version: 5.8.0
2026-09-17 13:02:46,092:DEBUG:certbot._internal.main:Location of certbot entry point: /usr/local/bin/certbot
2026-09-17 13:02:46,092:DEBUG:certbot._internal.main:Arguments: ['--config', '/etc/certbot.ini', '--server', 'https://acme-v02.api.letsencrypt.org/directory', '--cert-name', 'npm-108', '--domains', '*.bdigital.uncu.edu.ar', '--no-reuse-key', '--authenticator', 'dns-rfc2136', '--dns-rfc2136-credentials', '/tmp/certbot-credentials/credentials-108']
2026-09-17 13:02:46,093:DEBUG:certbot._internal.main:Discovered plugins: PluginsRegistry(PluginEntryPoint#dns-rfc2136,PluginEntryPoint#manual,PluginEntryPoint#null,PluginEntryPoint#standalone,PluginEntryPoint#webroot)
2026-09-17 13:02:46,098:DEBUG:certbot._internal.log:Root logging level set at 30
2026-09-17 13:02:46,098:DEBUG:certbot._internal.plugins.selection:Requested authenticator dns-rfc2136 and installer None
2026-09-17 13:02:46,098:DEBUG:certbot._internal.plugins.selection:Single candidate plugin: * dns-rfc2136
Description: Obtain certificates using a DNS TXT record (if you are using BIND for DNS).
Interfaces: Authenticator, Plugin
Entry point: EntryPoint(name='dns-rfc2136', value='certbot_dns_rfc2136._internal.dns_rfc2136:Authenticator', group='certbot.plugins')
Initialized: <certbot_dns_rfc2136._internal.dns_rfc2136.Authenticator object at 0x7f4e207ac6e0>
Prep: True
2026-09-17 13:02:46,098:DEBUG:certbot._internal.plugins.selection:Selected authenticator <certbot_dns_rfc2136._internal.dns_rfc2136.Authenticator object at 0x7f4e207ac6e0> and installer None
2026-09-17 13:02:46,098:INFO:certbot._internal.plugins.selection:Plugins selected: Authenticator dns-rfc2136, Installer None
2026-09-17 13:02:46,256:DEBUG:certbot._internal.main:Picked account: <Account(RegistrationResource(body=Registration(key=None, contact=(), agreement=None, status=None, terms_of_service_agreed=None, only_return_existing=None, external_account_binding=None), uri='https://acme-v02.api.letsencrypt.org/acme/acct/3712422276', new_authzr_uri=None, terms_of_service=None), 643fd0c99da2cd3ca1a82042eb6b77f4, Meta(creation_dt=datetime.datetime(2026, 9, 5, 15, 8, 51, tzinfo=datetime.timezone.utc), creation_host='bc-server-i9', register_to_eff=None))>
2026-09-17 13:02:46,257:DEBUG:acme.client:Sending GET request to https://acme-v02.api.letsencrypt.org/directory.
2026-09-17 13:02:46,257:DEBUG:urllib3.connectionpool:Starting new HTTPS connection (1): acme-v02.api.letsencrypt.org:443
2026-09-17 13:02:46,745:DEBUG:urllib3.connectionpool:https://acme-v02.api.letsencrypt.org:443 "GET /directory HTTP/1.1" 200 961
2026-09-17 13:02:46,745:DEBUG:acme.client:Received response:
HTTP 200
Server: nginx
Date: Thu, 17 Sep 2026 16:02:46 GMT
Content-Type: application/json
Content-Length: 961
Connection: keep-alive
Cache-Control: public, max-age=0, no-cache
X-Frame-Options: DENY
Strict-Transport-Security: max-age=604800

{
  "hLAN0B6u-sg": "https://community.letsencrypt.org/t/adding-random-entries-to-the-directory/33417",
  "keyChange": "https://acme-v02.api.letsencrypt.org/acme/key-change",
  "meta": {
    "caaIdentities": [
      "letsencrypt.org"
    ],
    "profiles": {
      "classic": "https://letsencrypt.org/docs/profiles#classic",
      "shortlived": "https://letsencrypt.org/docs/profiles#shortlived",
      "tlsserver": "https://letsencrypt.org/docs/profiles#tlsserver"
    },
    "termsOfService": "https://letsencrypt.org/documents/LE-SA-v1.8-July-06-2026.pdf",
    "website": "https://letsencrypt.org"
  },
  "newAccount": "https://acme-v02.api.letsencrypt.org/acme/new-acct",
  "newNonce": "https://acme-v02.api.letsencrypt.org/acme/new-nonce",
  "newOrder": "https://acme-v02.api.letsencrypt.org/acme/new-order",
  "renewalInfo": "https://acme-v02.api.letsencrypt.org/acme/renewal-info",
  "revokeCert": "https://acme-v02.api.letsencrypt.org/acme/revoke-cert"
}
2026-09-17 13:02:46,746:DEBUG:certbot._internal.display.obj:Notifying user: Requesting a certificate for *.bdigital.uncu.edu.ar
2026-09-17 13:02:46,749:DEBUG:acme.client:Requesting fresh nonce
2026-09-17 13:02:46,749:DEBUG:acme.client:Sending HEAD request to https://acme-v02.api.letsencrypt.org/acme/new-nonce.
2026-09-17 13:02:46,909:DEBUG:urllib3.connectionpool:https://acme-v02.api.letsencrypt.org:443 "HEAD /acme/new-nonce HTTP/1.1" 200 0
2026-09-17 13:02:46,910:DEBUG:acme.client:Received response:
HTTP 200
Server: nginx
Date: Thu, 17 Sep 2026 16:02:46 GMT
Connection: keep-alive
Cache-Control: public, max-age=0, no-cache
Link: <https://acme-v02.api.letsencrypt.org/directory>;rel="index"
Replay-Nonce: dll9i3XqJbJEdW8gzhZcZtgwgzqeWt_uH8RXaEcWHq5zoqSn1yk
X-Frame-Options: DENY
Strict-Transport-Security: max-age=604800


2026-09-17 13:02:46,910:DEBUG:acme.client:Storing nonce: dll9i3XqJbJEdW8gzhZcZtgwgzqeWt_uH8RXaEcWHq5zoqSn1yk
2026-09-17 13:02:46,911:DEBUG:acme.client:JWS payload:
b'{\n  "profile": "shortlived",\n  "identifiers": [\n    {\n      "type": "dns",\n      "value": "*.bdigital.uncu.edu.ar"\n    }\n  ]\n}'
2026-09-17 13:02:46,924:DEBUG:acme.client:Sending POST request to https://acme-v02.api.letsencrypt.org/acme/new-order:
{
  "protected": "eyJhbGciOiAiUlMyNTYiLCAia2lkIjogImh0dHBzOi8vYWNtZS12MDIuYXBpLmxldHNlbmNyeXB0Lm9yZy9hY21lL2FjY3QvMzcxMjQyMjI3NiIsICJub25jZSI6ICJkbGw5aTNYcUpiSkVkVzhnemhaY1p0Z3dnenFlV3RfdUg4UlhhRWNXSHE1em9xU24xeWsiLCAidXJsIjogImh0dHBzOi8vYWNtZS12MDIuYXBpLmxldHNlbmNyeXB0Lm9yZy9hY21lL25ldy1vcmRlciJ9",
  "signature": "aVZGjnJrrHk6jpDu3CMN6WZVBTEgq_G1rfrrseMmxYSllRWQdm_TeW4mCe-vI4xtLEXfgWFuhn3QvMqRN6yQCQOjUgpGJJnEgZvmsAH3uix96j6iBLW4YPwDtKkgk7i4MU96LgSOoGlv9QKccUZr6UfH1MhfvjrsMuzCGi85K9DnlqeFTj9cMY3ur-r4-ujtT-rh6OAkqGSGxZjmer-M8xzr2FVwuzWheOebmZ6BvONYKJ1f_O1aXeUzeZceZzuwW207qMUlj1MFR9-Jvpgz3S0BsOsoZCQnxRVqZBxKdyIb4jUUuGLGoAbZLs0_eD2yCNj1c8JdnIoV9j51SbSICk12wS0jgMzCpIBmn1gEz-uvbRaci6oQ3R0upnVrcdZcWfk8w0yiuvT9oLmf4ztuZGl_58HcgohA4UcMfOOIKkrJVVjM2t57DEhesieBU7wNTarwA6u6x8X0fGW5ngIu_2vk5m7OQcxpm8pKH564SHmkntZu95zcYIwkCykdPe58YOeSFb9aBH1HJh73NzY23wpLiPooSNAiVdE-L5224aNUs6iRPhBD7HPQ_OM9XXwT2fXdGWYLH_WaEOA6SY7yxfU0dWyphcKyoxUAhSSWnPletHuAizET96FAf3tTJJ5LpkBygDce9vtAz4vdSBipgz99Wdyl2debw4u2bc3JIBs",
  "payload": "ewogICJwcm9maWxlIjogInNob3J0bGl2ZWQiLAogICJpZGVudGlmaWVycyI6IFsKICAgIHsKICAgICAgInR5cGUiOiAiZG5zIiwKICAgICAgInZhbHVlIjogIiouYmRpZ2l0YWwudW5jdS5lZHUuYXIiCiAgICB9CiAgXQp9"
}
2026-09-17 13:02:47,183:DEBUG:urllib3.connectionpool:https://acme-v02.api.letsencrypt.org:443 "POST /acme/new-order HTTP/1.1" 201 383
2026-09-17 13:02:47,184:DEBUG:acme.client:Received response:
HTTP 201
Server: nginx
Date: Thu, 17 Sep 2026 16:02:47 GMT
Content-Type: application/json
Content-Length: 383
Connection: keep-alive
Boulder-Requester: 3712422276
Cache-Control: public, max-age=0, no-cache
Link: <https://acme-v02.api.letsencrypt.org/directory>;rel="index"
Location: https://acme-v02.api.letsencrypt.org/acme/order/3712422276/558547565916
Replay-Nonce: dwBChqYhtQPWKvO7ZuyYekzMD9WEv7DNBMoxO2jWh2q4eQNKiCc
X-Frame-Options: DENY
Strict-Transport-Security: max-age=604800

{
  "status": "pending",
  "expires": "2026-09-17T17:02:47Z",
  "identifiers": [
    {
      "type": "dns",
      "value": "*.bdigital.uncu.edu.ar"
    }
  ],
  "authorizations": [
    "https://acme-v02.api.letsencrypt.org/acme/authz/3712422276/781951240116"
  ],
  "finalize": "https://acme-v02.api.letsencrypt.org/acme/finalize/3712422276/558547565916",
  "profile": "shortlived"
}
2026-09-17 13:02:47,184:DEBUG:acme.client:Storing nonce: dwBChqYhtQPWKvO7ZuyYekzMD9WEv7DNBMoxO2jWh2q4eQNKiCc
2026-09-17 13:02:47,184:DEBUG:acme.client:JWS payload:
b''
2026-09-17 13:02:47,187:DEBUG:acme.client:Sending POST request to https://acme-v02.api.letsencrypt.org/acme/authz/3712422276/781951240116:
{
  "protected": "eyJhbGciOiAiUlMyNTYiLCAia2lkIjogImh0dHBzOi8vYWNtZS12MDIuYXBpLmxldHNlbmNyeXB0Lm9yZy9hY21lL2FjY3QvMzcxMjQyMjI3NiIsICJub25jZSI6ICJkd0JDaHFZaHRRUFdLdk83WnV5WWVrek1EOVdFdjdETkJNb3hPMmpXaDJxNGVRTktpQ2MiLCAidXJsIjogImh0dHBzOi8vYWNtZS12MDIuYXBpLmxldHNlbmNyeXB0Lm9yZy9hY21lL2F1dGh6LzM3MTI0MjIyNzYvNzgxOTUxMjQwMTE2In0",
  "signature": "Dma7I5hJkDD47j2AvPfvxqsQZ4nFfQEfQgqrarlfbnQdWIPW0BMr-dN0GgFlpSyx91-ibM3NAGWxCL4fnqKfAbO3y8kNZPmShP-yCxuRRTTybEC_0GOsMmsJceb4MGoKEY9FnwJdrVLLaUDylFIGO0k0iPNTxSFDel-JBIf03IZIPEfPJqi_G3_d_0VKTEmo8oNLLe5v0U101zpgCiMdAucIOyp8t_U_x-G_kYFDL7eivBTKQon82AU_vW0_fDcHIJAD2W4jrTP0n_QgBE0zmPbJ9m-Yt4Plb3dEp-Ye_XIPptmIg7414CKPm2TkfzJC-lMPXEh7WVlqNoo0WtHR_5Xb8o1j1bu1uL4xZhM7w-4a4Acx7pxzshSl6ZQp8-ymvL6yuEpqPknkZezZxYCgSr3Aek-OG0zE_-KsTKzDlIpwEIuiZHukWQYBfoiZRLt89LbE3EfH70DyIlEXLOFngjSzg7ekxTJ4DJ8TMlDf87pLE7aI_jMpRR1CmE5Vcv_CaPLIa8Uki4-TWx09kkvOZAKEM7fx600BU3yaFP2Jcz1nrhbB-x5M5SZJMcgTb-nOA76FPHkGdYPa0OTPVU8pvoOqL2TA9N3Pt4lRePZaMEgPv_TgUYPj425g_guyAwy-8nNEDOY87b6qUvcn44xTZuNUr-n7fkTKAFYJulL95-8",
  "payload": ""
}
2026-09-17 13:02:47,351:DEBUG:urllib3.connectionpool:https://acme-v02.api.letsencrypt.org:443 "POST /acme/authz/3712422276/781951240116 HTTP/1.1" 200 402
2026-09-17 13:02:47,351:DEBUG:acme.client:Received response:
HTTP 200
Server: nginx
Date: Thu, 17 Sep 2026 16:02:47 GMT
Content-Type: application/json
Content-Length: 402
Connection: keep-alive
Boulder-Requester: 3712422276
Cache-Control: public, max-age=0, no-cache
Link: <https://acme-v02.api.letsencrypt.org/directory>;rel="index"
Replay-Nonce: dll9i3XqLGOgl02z8zelYWJ_oE0qQ18uits4zWjNh48kGb31KpY
X-Frame-Options: DENY
Strict-Transport-Security: max-age=604800

{
  "identifier": {
    "type": "dns",
    "value": "bdigital.uncu.edu.ar"
  },
  "status": "pending",
  "expires": "2026-09-17T17:02:47Z",
  "challenges": [
    {
      "type": "dns-01",
      "url": "https://acme-v02.api.letsencrypt.org/acme/chall/3712422276/781951240116/oxpcMA",
      "status": "pending",
      "token": "LtHp6Fw1ITkg11znPP4dPH0yAgWKs5LcKMqg44VSDkw"
    }
  ],
  "wildcard": true
}
2026-09-17 13:02:47,352:DEBUG:acme.client:Storing nonce: dll9i3XqLGOgl02z8zelYWJ_oE0qQ18uits4zWjNh48kGb31KpY
2026-09-17 13:02:47,352:INFO:certbot._internal.auth_handler:Performing the following challenges:
2026-09-17 13:02:47,352:INFO:certbot._internal.auth_handler:dns-01 challenge for Identifier(typ=IdentifierType(dns), value='bdigital.uncu.edu.ar')
2026-09-17 13:02:47,365:DEBUG:certbot_dns_rfc2136._internal.dns_rfc2136:No authoritative SOA record found for _acme-challenge.bdigital.uncu.edu.ar
2026-09-17 13:02:47,381:DEBUG:certbot_dns_rfc2136._internal.dns_rfc2136:Received authoritative SOA response for bdigital.uncu.edu.ar
2026-09-17 13:02:47,393:DEBUG:certbot._internal.error_handler:Encountered exception:
Traceback (most recent call last):
  File "/usr/local/lib/python3.14/site-packages/certbot/_internal/auth_handler.py", line 84, in handle_authorizations
    resps = self.auth.perform(achalls)
  File "/usr/local/lib/python3.14/site-packages/certbot/plugins/dns_common.py", line 78, in perform
    self._perform(domain, validation_domain_name, validation)
    ~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.14/site-packages/certbot_dns_rfc2136/_internal/dns_rfc2136.py", line 85, in _perform
    self._get_rfc2136_client().add_txt_record(validation_name, validation, self.ttl)
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.14/site-packages/certbot_dns_rfc2136/_internal/dns_rfc2136.py", line 152, in add_txt_record
    raise errors.PluginError('Received response from server: {0}'
                             .format(dns.rcode.to_text(rcode)))
certbot.errors.PluginError: Received response from server: SERVFAIL

2026-09-17 13:02:47,393:DEBUG:certbot._internal.error_handler:Calling registered functions
2026-09-17 13:02:47,393:INFO:certbot._internal.auth_handler:Cleaning up challenges
2026-09-17 13:02:47,398:DEBUG:certbot_dns_rfc2136._internal.dns_rfc2136:No authoritative SOA record found for _acme-challenge.bdigital.uncu.edu.ar
2026-09-17 13:02:47,402:DEBUG:certbot_dns_rfc2136._internal.dns_rfc2136:Received authoritative SOA response for bdigital.uncu.edu.ar
2026-09-17 13:02:47,406:DEBUG:certbot_dns_rfc2136._internal.dns_rfc2136:Successfully deleted TXT record _acme-challenge.bdigital.uncu.edu.ar
2026-09-17 13:02:47,407:DEBUG:certbot._internal.log:Exiting abnormally:
Traceback (most recent call last):
  File "/usr/local/bin/certbot", line 6, in <module>
    sys.exit(main())
             ~~~~^^
  File "/usr/local/lib/python3.14/site-packages/certbot/main.py", line 18, in main
    return internal_main.main(cli_args)
           ~~~~~~~~~~~~~~~~~~^^^^^^^^^^
  File "/usr/local/lib/python3.14/site-packages/certbot/_internal/main.py", line 1889, in main
    return config.func(config, plugins)
           ~~~~~~~~~~~^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.14/site-packages/certbot/_internal/main.py", line 1601, in certonly
    lineage = _get_and_save_cert(le_client, config, sans, certname, lineage)
  File "/usr/local/lib/python3.14/site-packages/certbot/_internal/main.py", line 143, in _get_and_save_cert
    lineage = le_client.obtain_and_enroll_certificate(sans, certname)
  File "/usr/local/lib/python3.14/site-packages/certbot/_internal/client.py", line 533, in obtain_and_enroll_certificate
    cert, chain, key, _ = self.obtain_certificate(sans)
                          ~~~~~~~~~~~~~~~~~~~~~~~^^^^^^
  File "/usr/local/lib/python3.14/site-packages/certbot/_internal/client.py", line 434, in obtain_certificate
    orderr = self._get_order_and_authorizations(csr.data, self.config.allow_subset_of_names)
  File "/usr/local/lib/python3.14/site-packages/certbot/_internal/client.py", line 512, in _get_order_and_authorizations
    authzr = self.auth_handler.handle_authorizations(orderr, self.config, best_effort)
  File "/usr/local/lib/python3.14/site-packages/certbot/_internal/auth_handler.py", line 84, in handle_authorizations
    resps = self.auth.perform(achalls)
  File "/usr/local/lib/python3.14/site-packages/certbot/plugins/dns_common.py", line 78, in perform
    self._perform(domain, validation_domain_name, validation)
    ~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.14/site-packages/certbot_dns_rfc2136/_internal/dns_rfc2136.py", line 85, in _perform
    self._get_rfc2136_client().add_txt_record(validation_name, validation, self.ttl)
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.14/site-packages/certbot_dns_rfc2136/_internal/dns_rfc2136.py", line 152, in add_txt_record
    raise errors.PluginError('Received response from server: {0}'
                             .format(dns.rcode.to_text(rcode)))
certbot.errors.PluginError: Received response from server: SERVFAIL
2026-09-17 13:02:47,409:ERROR:certbot._internal.log:Received response from server: SERVFAIL
2

Highly likely that it's something to do with the info you used to configure it. I don't think that there's much in that log that gives more details, you probably need to contact your DNS provider to have them look in their logs as to why the request is failing.

Note that NPM can sometimes make problems difficult to debug. Also, many times people who think they need a wildcard certificate really don't and could just have each subdomain responsible for getting its own non-wildcard certificate. Though there certainly are some cases where wildcards are useful.

4

Thanks for the reply @petercooperjr

You were right. There was something at the DNS provider (apparmor blocking something from what they explained)

As for the need of the wildcard certificate, I agree. In fact, we managed to work without one for a couple of years so far, but reached the point where we need one.

Best regards!