# Problem with DNS challenge with Cloudflare **URL:** \ **Category:** Help\ **Created:** [April 3, 2024, 12:50pm UTC](https://community.letsencrypt.org/t/problem-with-dns-challenge-with-cloudflare/215902 "2024-04-03T12:50:59Z")\ **Posts on this page:** 17\ **Page:** 1
**Author:** ![tumiro](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/tumiro/32/78668_2.png) [@tumiro](https://community.letsencrypt.org/u/tumiro)\ **Post date:** [April 3, 2024, 12:50pm UTC](https://community.letsencrypt.org/t/problem-with-dns-challenge-with-cloudflare/215902/1 "2024-04-03T12:50:59Z")
I hope it's ok to continue in this thread. I got domain from namecheap and configurated DNS records on Cloudflare site with working Cloudflare nameservers records. My DNS records are: ![image](https://global.discourse-cdn.com/letsencrypt/original/3X/d/3/d3f4762df9dab733c3531724a94445e70f492ea6.png) I'm trying to get the certificate to my ReadyNAS102 server. I couldn't install certbot but somehow I got acme.sh working. Unfortunately, the process cannot be finalized. root@ReadyNAS:/home/mirssh# acme.sh --issue --dns dns\_cf -d \_acme-challenge.mirnas.xyz [Wed Apr 3 14:40:55 CEST 2024] Using CA: [https://acme.zerossl.com/v2/DV90](https://acme.zerossl.com/v2/DV90) [Wed Apr 3 14:40:55 CEST 2024] Single domain='\_acme-challenge.mirnas.xyz' [Wed Apr 3 14:41:01 CEST 2024] Create new order error. Le\_OrderFinalize not found. {"type":"urn:ietf:params:acme:error:rejectedIdentifier","status":400,"detail":"DNS identifier is invalid [\_acme-challenge.mirnas.xyz]"} [Wed Apr 3 14:41:01 CEST 2024] Please check log file for more details: /root/.acme.sh/acme.sh.log Log file shows quite a lengthy output which I don't want to present here now, bur if anybody willing to help me would like to have a look I would put it online. What I suspect is that I might not identified my server sufficiently with a key. I don't know how to get it and how to use it. Your help will be much appreciated. P.S. I suddenly realized that my acme-challenge goes to [zerossl.com](http://zerossl.com) ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [April 3, 2024, 12:57pm UTC](https://community.letsencrypt.org/t/problem-with-dns-challenge-with-cloudflare/215902/2 "2024-04-03T12:57:21Z")
> [@tumiro](#): > > I hope it's ok to continue in this thread. It's not, actually. Even if some problems look the same at a glance, they often are not. So we prefer separate threads for separate problems. Thus, I've moved your post to a new thread. > [@tumiro](#): > > root@ReadyNAS:/home/mirssh# acme.sh --issue --dns dns\_cf -d \_acme-challenge.mirnas.xyz You should not include the `_acme-challenge` label for requesting a certificate for a certain hostname. > [@tumiro](#): > > I suddenly realized that my acme-challenge goes to [zerossl.com](http://zerossl.com) Yes, `acme.sh` defaults to ZeroSSL. See [The acme.sh will change default CA to ZeroSSL on August-1st 2021](https://community.letsencrypt.org/t/the-acme-sh-will-change-default-ca-to-zerossl-on-august-1st-2021/144052) for more information and how to change this to Let's Encrypt. > [@tumiro](#): > > ![image](https://global.discourse-cdn.com/letsencrypt/original/3X/d/3/d3f4762df9dab733c3531724a94445e70f492ea6.png) Why is there a TXT RR for `mirnas.xyz` with the value `_acme-challenge.mirnas.xyz`? That doesn't make any sense. ---
**Author:** ![tumiro](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/tumiro/32/78668_2.png) [@tumiro](https://community.letsencrypt.org/u/tumiro)\ **Post date:** [April 3, 2024, 1:07pm UTC](https://community.letsencrypt.org/t/problem-with-dns-challenge-with-cloudflare/215902/3 "2024-04-03T13:07:50Z")
I'm now trying to get the certificate from ZeroSSL. I got the error "We were unable to verify your CNAME entry. Please check for errors on your side and try again after 5-10 minutes." CNAME has been changed and I will delete TXT as well. Tnx ---
**Author:** ![tumiro](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/tumiro/32/78668_2.png) [@tumiro](https://community.letsencrypt.org/u/tumiro)\ **Post date:** [April 3, 2024, 1:31pm UTC](https://community.letsencrypt.org/t/problem-with-dns-challenge-with-cloudflare/215902/4 "2024-04-03T13:31:02Z")
Still error with ZeroSSL. mirnas.xyz domain is working as I can get to my insecure server, so I don't understand why ZeroSSL cannot identify my domain. Done everything as they suggested. I'm considering going over to Letsencrypt acme.sh --issue -d [example.com](http://example.com) --dns dns\_cf --server letsencrypt Would it be easier? ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [April 3, 2024, 1:36pm UTC](https://community.letsencrypt.org/t/problem-with-dns-challenge-with-cloudflare/215902/5 "2024-04-03T13:36:14Z")
While I prefer Let's Encrypt over ZeroSSL (and this is the Let's Encrypt support forum, not the ZeroSSL support forum) I don't think switching CAs would actually differ, as all ACME CAs adhere to RFC 8555 and would, in essence, do the same. I also have no clue why ZeroSSL would complain about the CNAME: is there still a CNAME in place? Because CNAMEs are not allowed next to most other DNS records, such as TXT (only exceptions that I know of would be RRs for DNSSEC). So my advice would be to remove the CNAME and change it for a A RR. Then, the challenge, which uses a TXT RR, should work. If not, please post the exact command used, the _exact_ output and also the current DNS zone settings. ---
**Author:** ![tumiro](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/tumiro/32/78668_2.png) [@tumiro](https://community.letsencrypt.org/u/tumiro)\ **Post date:** [April 3, 2024, 1:44pm UTC](https://community.letsencrypt.org/t/problem-with-dns-challenge-with-cloudflare/215902/6 "2024-04-03T13:44:24Z")
I got this "Congratulations, your SSL certificate is en route! However, you need to verify ownership of your domain before installing your certificate. Please follow the steps below." which means I have to choose a verification method for mirnas.xyz I need to upload a AuthFile to my server. Be back.. Thank you. ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [April 3, 2024, 2:06pm UTC](https://community.letsencrypt.org/t/problem-with-dns-challenge-with-cloudflare/215902/7 "2024-04-03T14:06:35Z")
I'm not familiar with `acme.sh` myself, but you specified the Cloudflare DNS plugin with `--dns dns_cf`, right? Maybe you need to instruct `acme.sh` to actually use that plugin somehow for the `dns-01` challenge? Uploading a file won't work if you domain name points to a private IP address space.. ---
**Author:** ![tumiro](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/tumiro/32/78668_2.png) [@tumiro](https://community.letsencrypt.org/u/tumiro)\ **Post date:** [April 3, 2024, 3:03pm UTC](https://community.letsencrypt.org/t/problem-with-dns-challenge-with-cloudflare/215902/8 "2024-04-03T15:03:15Z")
I tried another option with ZeroSSL Upload the Auth File to my HTTP server under: /.well-known/pki-validation/ Not working. "The requested URL /.well-known/pki-validation/0AD057D02D059xxxxxxxxxxxxx.txt was not found on this server. Otherwise mirnas/xyz/subdirs are working. AI says that some systems don't allow /. files I don't understand the reason, but this option is seemingly close to me. I need a break and I will consider your thought. Thank you very much. ---
**Author:** ![9peppe](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/9peppe/32/31596_2.png) [@9peppe](https://community.letsencrypt.org/u/9peppe)\ **Post date:** [April 3, 2024, 3:18pm UTC](https://community.letsencrypt.org/t/problem-with-dns-challenge-with-cloudflare/215902/9 "2024-04-03T15:18:27Z")
you are supposed to add a txt record on the `_acme-challenge.mirnas.xyz` subdomain, your acme client will tell you about the string you have to put there. you should automate that with cloudflare apis, tho. > [@tumiro](#): > > -d \_acme-challenge.mirnas.xyz this does not make any sense. you should use `-d mirnas.xyz`, and you have no actual reason to use dns validation. Please use http-01. ---
**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\ **Post date:** [April 3, 2024, 3:27pm UTC](https://community.letsencrypt.org/t/problem-with-dns-challenge-with-cloudflare/215902/10 "2024-04-03T15:27:22Z")
> [@9peppe](#): > > you have no actual reason to use dns validation. Please use http-01. The Cloudflare DNS is pointing to a private IP address. So DNS Challenge would be needed. I think Cloudflare also offer tunneling which might allow HTTP Challenge but DNS Challenge probably easier. ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [April 3, 2024, 3:43pm UTC](https://community.letsencrypt.org/t/problem-with-dns-challenge-with-cloudflare/215902/11 "2024-04-03T15:43:25Z")
> [@9peppe](#): > > you should automate that with cloudflare apis, tho. That's what `--dns dns_cf` is for, although I don't have enough knowledge of `acme.sh` (the things I do know about it, makes me not like it at all) to say how that actually works. Perhaps it's as simple as specifying the challenge type to `dns-01`? I dunno 🤷🏻‍♂️ ---
**Author:** ![9peppe](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/9peppe/32/31596_2.png) [@9peppe](https://community.letsencrypt.org/u/9peppe)\ **Post date:** [April 3, 2024, 3:45pm UTC](https://community.letsencrypt.org/t/problem-with-dns-challenge-with-cloudflare/215902/12 "2024-04-03T15:45:55Z")
I have no idea, but there should be docs. ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [April 3, 2024, 3:46pm UTC](https://community.letsencrypt.org/t/problem-with-dns-challenge-with-cloudflare/215902/13 "2024-04-03T15:46:35Z")
> [@9peppe](#): > > but there should be docs Yeah, if you can find the answer somewhere, sure. 😛 ---
**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\ **Post date:** [April 3, 2024, 3:52pm UTC](https://community.letsencrypt.org/t/problem-with-dns-challenge-with-cloudflare/215902/14 "2024-04-03T15:52:24Z")
@tumiro Maybe review these docs? > **[dnsapi](https://github.com/acmesh-official/acme.sh/wiki/dnsapi)** > > A pure Unix shell script implementing ACME client protocol - acmesh-official/acme.sh ---
**Author:** ![tumiro](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/tumiro/32/78668_2.png) [@tumiro](https://community.letsencrypt.org/u/tumiro)\ **Post date:** [April 4, 2024, 6:53am UTC](https://community.letsencrypt.org/t/problem-with-dns-challenge-with-cloudflare/215902/15 "2024-04-04T06:53:25Z")
Thank you all for your help. I succeded with the verification of my domain. ZeroSSL has an email verification procedure which after proper configuration on Claudflare, worked. I received my cert-files by email and now I'm going to install them on my Apache2 server. Good forum, Congrats. ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [April 4, 2024, 7:00am UTC](https://community.letsencrypt.org/t/problem-with-dns-challenge-with-cloudflare/215902/16 "2024-04-04T07:00:55Z")
Please note that ZeroSSL only offers a maximum of 3 free certificates per account if those certificates aren't issued through their ACME API. And I don't think email verification works with ACME. ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [May 4, 2024, 7:01am UTC](https://community.letsencrypt.org/t/problem-with-dns-challenge-with-cloudflare/215902/17 "2024-05-04T07:01:51Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.