Renew not working, return error. Same scripts works for years!

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. https://crt.sh/?q=example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain are 18 domains, wtrade.com i the first

I ran this command: running win-acme.v2.1.19.1142.x64

It produced this output: (see at the end)
My web server is (include version): IIS however I hope is not used
The operating system my web server runs on is (include version): Windows Server 2019
My hosting provider, if applicable, is: None
I can login to a root shell on my machine (yes or no, or I don't know): yes
I'm using a control panel to manage my site (no, or provide the name and version of the control panel): Application use powershell
The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): not sure

#################################################
The process was able to check correctly all domains against DNS, however after end of each verification

[DBUG] [*.drximenaflanders.com] Preliminary validation from 23.126.143.86 looks good

I get the following message (one for each domain)
[VERB] Request completed with status OK
** [EROR] [.drximenaflanders.com] Authorization result: invalid**
** [EROR] [
.drximenaflanders.com] {**
** "type": "urn:ietf:params:acme:error:dns",**
** "detail": "DNS problem: NXDOMAIN looking up TXT for _acme-challenge.drximenaflanders.com - check that a DNS record exists for**

is there any additional DNS record required ?


[DBUG] [.drximenaflanders.com] Looking for TXT value OVN33LyeW4ie9Qr24yOprxFmhyFld0CTLyUgwekU-n4...
[DBUG] [
.drximenaflanders.com] Preliminary validation asking 108.248.7.231...
[DBUG] [.drximenaflanders.com] Preliminary validation from 108.248.7.231 looks good
[DBUG] [
.drximenaflanders.com] Preliminary validation asking 52.91.162.105...
[DBUG] [.drximenaflanders.com] Preliminary validation from 52.91.162.105 looks good
[DBUG] [
.drximenaflanders.com] Preliminary validation asking 23.126.143.86...
[DBUG] [.drximenaflanders.com] Preliminary validation from 23.126.143.86 looks good
[DBUG] [
.drximenaflanders.com] Preliminary validation asking 52.86.234.215...
[DBUG] [.drximenaflanders.com] Preliminary validation from 52.86.234.215 looks good
[INFO] [
.drximenaflanders.com] Preliminary validation succeeded
[VERB] Commit was successful
[DBUG] [.drximenaflanders.com] Submitting challenge answer
[DBUG] Send POST request to https://acme-v02.api.letsencrypt.org/acme/chall-v3/369212932617/bSN33Q
[VERB] Request completed with status OK
[DBUG] Refreshing authorization (1/15)
[DBUG] Send POST request to https://acme-v02.api.letsencrypt.org/acme/chall-v3/369212932617/bSN33Q
[VERB] Request completed with status OK
[EROR] [
.drximenaflanders.com] Authorization result: invalid
[EROR] [*.drximenaflanders.com] {
"type": "urn:ietf:params:acme:error:dns",
"detail": "DNS problem: NXDOMAIN looking up TXT for _acme-challenge.drximenaflanders.com - check that a DNS record exists for
this domain",
"status": 400
}
[VERB] Starting post-validation cleanup
[INFO] Script C:\Repos\win-acme.v2.1.19.1142.x64.pluggable\Scripts\microsoft-dns.ps1 starting with parameters delete drximenafl
anders.com _acme-challenge.drximenaflanders.com OVN33LyeW4ie9Qr24yOprxFmhyFld0CTLyUgwekU-n4
[DBUG] Process launched: powershell.exe (ID: 14804)
[VERB] Waiting for process to finish...
[VERB] Waiting for process to finish...
[VERB] Process output without data received
[VERB] Process error without data received
[INFO] Script finished
[VERB] Waiting for process to finish...
[VERB] Post-validation cleanup was succesfull

Welcome @fceledon

I see you run your own DNS servers. Have you made changes to them recently? Because a common testing tool we use shows problems with their configuration. These could explain the errors

See both the Errors and Warnings
https://dnsviz.net/d/drximenaflanders.com/dnssec/

5 Likes

Manually create your _acme-challenge TXT record with a test value then check it using the TXT option of:
https://unboundtest.com/

3 Likes

Thanks for the hint.
Indeed changed Internet vendor (and Ip's). The Glue records were not updated properly. On our in house DNS, we only changed the 'NS' records.

3 Likes

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.