I'm surprised to see 100 subproblems that are all identical. Does it mean that LE system tried to recheck the CAA for this domain 100 times before giving up?
I ran this command:
certbot certonly --webroot --staging --csr /var/cert_manager/certs/san132.csr -w /var/www/html -d ace.pusd.org -d admin.ace.pusd.org -d admin.alcott.pusd.org -d admin.anderson.moreland.org -d admin.armstrong.pusd.org -d admin.arroyo.pusd.org -d admin.baker.moreland.org -d admin.barfield.pusd.org -d admin.bradfield.hpisd.org -d admin.cortez.pusd.org -d admin.countrylane.moreland.org -d admin.decker.pusd.org -d admin.dellagoacademy.org -d admin.es.moodyisd.org -d admin.es.nscougars.com -d admin.hms.huntingtonisd.com -d admin.hpisd.org -d admin.hs.hpisd.org -d admin.hs.nscougars.com -d admin.hsd153.org -d admin.hubbardisd.com -d admin.huntingtonisd.com -d admin.hyer.hpisd.org -d admin.jameshart.hsd153.org -d admin.kellogg.pusd.org -d admin.kingsley.pusd.org -d admin.leadership.kippneworleans.org -d admin.lincoln.pusd.org -d admin.lopez.pusd.org -d admin.marshall.pusd.org -d admin.mcems.cherokee.k12.nc.us -d admin.mesacharter.org -d admin.mhs.cherokee.k12.nc.us -d admin.mishpms.hpisd.org -d admin.mms.cherokee.k12.nc.us -d admin.montvue.pusd.org -d admin.mrhs.hwrsd.org -d admin.ms.moodyisd.org -d admin.ms.nscougars.com -d admin.nbfacademy.org -d admin.nscougars.com -d admin.parkwest.pusd.org -d admin.pes.cherokee.k12.nc.us -d admin.popcs.org -d admin.ranchhills.pusd.org -d admin.sacredheartacademy.org -d admin.sanjose.pusd.org -d admin.tcec.cherokee.k12.nc.us -d admin.toa.cherokee.k12.nc.us -d admin.up.hpisd.org -d aes.cherokee.k12.nc.us -d ams.cherokee.k12.nc.us -d ar.hpisd.org -d armstrong.hpisd.org -d arroyo.pusd.org -d bookertwashington.kippneworleans.org -d br.hpisd.org -d bradfield.hpisd.org -d centralcityacademy.kippneworleans.org -d cherokee.k12.nc.us -d churchill.hsd153.org -d es.moodyisd.org -d es.nscougars.com -d hdems.cherokee.k12.nc.us -d hdhs.cherokee.k12.nc.us -d hes.huntingtonisd.com -d hhs.huntingtonisd.com -d hms.huntingtonisd.com -d hpisd.org -d hpms.hpisd.org -d hs.hpisd.org -d hs.moodyisd.org -d hs.nscougars.com -d hsd153.org -d huntingtonisd.com -d hy.hpisd.org -d hyer.hpisd.org -d jameshart.hsd153.org -d mcems.cherokee.k12.nc.us -d mis.hpisd.org -d mishpms.hpisd.org -d mms.cherokee.k12.nc.us -d ms.nscougars.com -d mt.hwrsd.org -d nscougars.com -d pes.cherokee.k12.nc.us -d popcs.org -d sacredheartacademy.org -d tcec.cherokee.k12.nc.us -d toa.cherokee.k12.nc.us -d universitypark.hpisd.org -d up.hpisd.org -d wms.hwrsd.org -d www.hpisd.org -d www.inspiredteachingschool.org -d www.moodyisd.org -d www.nscougars.com -d www.payne.moreland.org -d www.popcs.org -d www.sacredheartacademy.org
It produced this output:
Error finalizing order :: Rechecking CAA for "admin.mrhs.hwrsd.org" and 99 more identifiers failed. Refer to sub-problems for more information
Since my command to generate SAN includes 100 total domains, I thought it was telling me all 100 failed Rechecking CAA, based on the log ... and 99 more identifiers failed
However, within the log, all 100 subproblems are about admin.mrhs.hwrsd.org and not about any of the other domains in the original command:
Within the logs...
Content-Type: application/problem+json
Transfer-Encoding: chunked
Connection: keep-alive
Boulder-Requester: 12404031
Cache-Control: public, max-age=0, no-cache
Link: <https://acme-staging-v02.api.letsencrypt.org/directory>;rel="index"
Replay-Nonce: 0002Cyc6K095FkRG2eFShQx1DKIrJJt8azieih4SXFg7xIk
{
"type": "urn:ietf:params:acme:error:caa",
"detail": "Error finalizing order :: Rechecking CAA for \"admin.mrhs.hwrsd.org\" and 99 more identifiers failed. Refer to sub-problems for more information",
"status": 403,
"subproblems": [
{
"type": "urn:ietf:params:acme:error:urn:ietf:params:acme:error:caa",
"detail": "Error finalizing order :: While processing CAA for admin.mrhs.hwrsd.org: DNS problem: SERVFAIL looking up CAA for admin.mrhs.hwrsd.org - the domain's nameservers may be malfunctioning",
"status": 403,
"identifier": {
"type": "dns",
"value": "admin.mrhs.hwrsd.org"
}
},
{
"type": "urn:ietf:params:acme:error:urn:ietf:params:acme:error:caa",
"detail": "Error finalizing order :: While processing CAA for admin.mrhs.hwrsd.org: DNS problem: SERVFAIL looking up CAA for admin.mrhs.hwrsd.org - the domain's nameservers may be malfunctioning",
"status": 403,
"identifier": {
"type": "dns",
"value": "admin.mrhs.hwrsd.org"
}
},
That identical subproblem for admin.mrhs.hwrsd.org is repeated 99 times.
My web server is (include version):
Apache
The operating system my web server runs on is (include version):
Ubuntu 18
The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot):
certbot 0.31.0
I'm about to write a PR for our system that will allow it to retry without the hostname present in the error message Error finalizing order :: Rechecking CAA for "admin.mrhs.hwrsd.org" , but I'm a little concerned that perhaps the log output is wrong and it's actually all 100 domains are failing?
. I got spooked by seeing two duplicate CAA checks at the VA during finalize and none for the other domain in the order, but it turned out to be because of tree climbing lol.