Hi! Strange situation occurs. I have 29 servers with his own FQDNs (one root domain). I've installed separate server to issue\renew cert for those servers. I'm issued one SAN certificate which contains 58 domain names (2 names for server) with certbot (snap installed) and dns-cloudflare plugin. Ev…

[image] Comandante: But in past month (and now) when I try to renew cert I'm getting error about CAA records. CAA records are in place. If I renew few domains (1-10) it's ok. But all 58 - error. I think the discrepancy might be due to authorization caching (when you reissue certificates cove…

It could be related to this new Let's Encrypt server-side error: [image] ACME challenge fails because CAA record is not found Help S… This error appears to be making CAA records effectively mandatory rather than optional, at least some of the time for some people. (I…

I wonder if the DNS server (or some firewall in front of it) is seeing all the CAA requests coming at once and considering it an "attack" that it's blocking. [image] Comandante: One thing that I've done within this time - I activated IPv6 stack on servers and add AAAA records to CF DNS. That…

[image] schoen: It could be related to this new Let's Encrypt server-side error Only in Staging, and it looks like this is attempting against production. [image] Comandante: --force-renewal But remove this immediately, it will only cause you pain and will never "fix" a problem.

In staging everything ok (dry-run). Error only in production. I know about limit of 100 FQDN in cert, but I have only 58. --force-renewal I run my script once a month. Dont waiting for certbot renewal. My script doing some other things after getting new certificate. And what the problem with this …

[image] Comandante: --force-renewal I run my script once a month. Dont waiting for certbot renewal. … And what the problem with this option? Well, it allows you to force renewal only one month in, when you don't need to. Why are you running certbot manually in order to renew? [image] Coma…

Well, it allows you to force renewal only one month in, when you don't need to. Why are you running certbot manually in order to renew? Situation is the next - today I have 29 servers, and tomorrow I'll get 32. And I have to issue new cert with those new servers. Copy cert to servers, restart doc…

[image] Comandante: If I renew few domains (1-10) it's ok. But all 58 - error. Why not just do the fewer domains (i.e. more batches of smaller loads)?

Why not just do the fewer domains (i.e. more batches of smaller loads)? I need one cert on all servers. Its more easy than divide servers into different parts

SAN certificate with dns-cloudflare

Help

Bruce5051 May 24, 2023, 7:14pm 2

Hello @Comandante, welcome to the Let's Encrypt community.

You might want to read this. I don't think Let's Encrypt has adjust the number, but possibly.

Topic		Replies	Views
LetsEncrypt renewal error - Error finalizing order :: While processing CAA, SERVFAIL looking up CAA Help	8	1388	February 1, 2024
Spurious CAA SERVFAIL responses during finalize Help	39	1936	December 5, 2023
Problem generating cert with large number of SANs (60+) Help	21	1847	August 31, 2020
Detail: DNS problem: server failure at resolver looking up CAA for Help	11	5223	February 15, 2018
Problem at renewing a certificate (CAA) Help	10	2122	June 18, 2020

SAN certificate with dns-cloudflare

Related topics