# Problem with Round Robin DNS

**URL:** <https://community.letsencrypt.org/t/problem-with-round-robin-dns/13992>\
**Category:** Issuance Tech\
**Created:** [April 10, 2016, 4:55pm UTC](https://community.letsencrypt.org/t/problem-with-round-robin-dns/13992 "2016-04-10T16:55:08Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![indrarisa](https://avatars.discourse-cdn.com/v4/letter/i/58956e/32.png) [@indrarisa](https://community.letsencrypt.org/u/indrarisa)\
**Post date:** [April 10, 2016, 4:55pm UTC](https://community.letsencrypt.org/t/problem-with-round-robin-dns/13992/1 "2016-04-10T16:55:08Z")

</div>

Hi Everyone,

I got problem with domain which use Round Robin DNS, it’s just can generate at ones time, but can not generate again. I got random error, here is :

[first error]  
Failed authorization procedure. [ha.sample-domain.org](http://ha.sample-domain.org) (tls-sni-01): urn:acme:error:unauthorized :: The client lacks sufficient authorization :: Correct zName not found for TLS SNI challenge. Found ‘[ssl1.sample.org](http://ssl1.sample.org), [ssl2.sample.org](http://ssl2.sample.org)’

IMPORTANT NOTES:

- The following errors were reported by the server:

[second error]  
Failed authorization procedure. [ha.sample-domain.org](http://ha.sample-domain.org) (tls-sni-01): urn:acme:error:connection :: The server could not connect to the client to verify the domain :: Failed to connect to host for DVSNI challenge

IMPORTANT NOTES:

- The following errors were reported by the server:

I generate cert with the same command, using this :  
/usr/local/letsencrypt/letsencrypt-auto --agree-tos --agree-dev-preview auth --standalone --csr /test/5/ha.csr --cert-path /test/5/ha.crt --fullchain-path /test/5/ha.full.pem --chain-path /test/5/ha.pem --email [mymail@gmail.com](mailto:mymail@gmail.com)

What must I do?

If I use dig for get A record, here is the result :  
me@device:~$ dig A [ha.sample-domain.org](http://ha.sample-domain.org)

; \<\<\>\> DiG 9.9.5-9+deb8u6-Debian \<\<\>\> A [ha.sample-domain.org](http://ha.sample-domain.org)  
;; global options: +cmd  
;; Got answer:  
;; -\>\>HEADER\<\<- opcode: QUERY, status: NOERROR, id: 16160  
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:  
;[ha.sample-domain.org](http://ha.sample-domain.org). IN A

;; ANSWER SECTION:  
[ha.sample-domain.org](http://ha.sample-domain.org). 30 IN A X.X.X.X  
[ha.sample-domain.org](http://ha.sample-domain.org). 30 IN A Y.Y.Y.Y  
[ha.sample-domain.org](http://ha.sample-domain.org). 30 IN A Z.Z.Z.Z

;; Query time: 439 msec  
;; SERVER: 192.168.0.254#53(192.168.0.254)  
;; WHEN: Sun Apr 10 23:00:42 WIB 2016  
;; MSG SIZE rcvd: 86

='FYI, 2 days ago I try generate cert and got 2-3 times error, but I can generate until 5 cert.

\*\* [sample-domain.org](http://sample-domain.org) is not real, I just change for sample.  
Thank you so much.

---

<div class="post-metadata">

**Author:** ![pfg](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/pfg/32/1924_2.png) [@pfg](https://community.letsencrypt.org/u/pfg)\
**Post date:** [April 10, 2016, 5:11pm UTC](https://community.letsencrypt.org/t/problem-with-round-robin-dns/13992/2 "2016-04-10T17:11:29Z")

</div>

In order to verify ownership of your domain, Let’s Encrypt’s CA server will attempt to connect to your domain and request a specific resource that you need to serve in order to demonstrate that you have full control over the domain.

If you’re using round-robin DNS , you don’t know which of your IPs the CA server will connect to ahead of time, so you’ll have to ensure _all_ IPs will be able to respond to the challenge.

There are a number of approaches you could try:

- If you have some kind of shared storage between your nodes, I would recommend using the [webroot plugin](https://letsencrypt.readthedocs.org/en/latest/using.html#webroot). Pass the path to your shared storage as the `-w` argument and make sure all nodes serve the files in that directory when a request is sent to `http://example.com/.well-known/acme-challenge/{random}`.
- You could also designate one of your nodes as the “verification” node (or even a separate node, for that matter) and configure all your other nodes to redirect requests to that node. Let’s say you have `a.example.com`, `b.example.com` and `c.example.com`. All three are configured to redirect requests for `/.well-known/acme-challenge/*` to `http://a.example.com/.well-known/acme-challenge/*`, where `a.example.com` is your verification node - the one where you run the client using the webroot plugin.
- Finally, you could use the `dns-01` challenge which works by creating a TXT record on your DNS server to verify ownership. This is probably only an option if you have an automated way to modify your DNS, as you’ll have to repeat this every three months. The official client currently doesn’t support `dns-01` yet, but the [three bash clients](https://github.com/letsencrypt/letsencrypt/wiki/Links#bash) do.

Note that with all three options, it’s up to you to distribute the keys to all nodes securely.

---

<div class="post-metadata">

**Author:** ![indrarisa](https://avatars.discourse-cdn.com/v4/letter/i/58956e/32.png) [@indrarisa](https://community.letsencrypt.org/u/indrarisa)\
**Post date:** [April 10, 2016, 5:25pm UTC](https://community.letsencrypt.org/t/problem-with-round-robin-dns/13992/3 "2016-04-10T17:25:49Z")

</div>

Hi,

Thank you for your explain, so the essence is all node is must be same if we want to use round-robin DNS.

🙂

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\
**Post date:** [May 10, 2016, 5:25pm UTC](https://community.letsencrypt.org/t/problem-with-round-robin-dns/13992/4 "2016-05-10T17:25:57Z")

</div>

Closed on May 10, 2016, 5:25pm UTC

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.