Strange behaviour and resulting failure on cert renewal

Help
1

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: mfno.org

I ran this command: certbot certonly --manual --preferred-challenges dns --cert-name mfno.org -d mfno.org -d "*.mfno.org"

It produced this output:
~ % certbot certonly --manual --preferred-challenges dns --cert-name mfno.org -d mfno.org -d "*.mfno.org"

Saving debug log to /usr/local/etc/certbot/logs/letsencrypt.log

Renewing an existing certificate for mfno.org and *.mfno.org

Please deploy a DNS TXT record under the name:

_acme-challenge.mfno.org.

with the following value:

VfL6CNRbDWS1sm1RO9gH1afuQrb4QjAH3oX1_iRwsL4

Press Enter to Continue

Please deploy a DNS TXT record under the name:

_acme-challenge.mfno.org.

with the following value:

HA_bZe9CEpmiKYlVd0K9D_2WkWEr--EtoCv935tWUHI

(This must be set up in addition to the previous challenges; do not remove,

replace, or undo the previous challenge tasks yet. Note that you might be

asked to create multiple distinct TXT records with the same name. This is

permitted by DNS standards.)

Before continuing, verify the TXT record has been deployed. Depending on the DNS

provider, this may take some time, from a few seconds to multiple minutes. You can

check if it has finished deploying with aid of online tools, such as the Google

Admin Toolbox: Dig (DNS lookup).

Look for one or more bolded line(s) below the line ';ANSWER'. It should show the

value(s) you've just added.

Press Enter to Continue

Certbot failed to authenticate some domains (authenticator: manual). The Certificate Authority reported these problems:

Domain: mfno.org

Type: unauthorized

Detail: Incorrect TXT record "HA_bZe9CEpmiKYlVd0K9D_2WkWEr--EtoCv935tWUHI" found at _acme-challenge.mfno.org

Hint: The Certificate Authority failed to verify the manually created DNS TXT records. Ensure that you created these in the correct location, or try waiting longer for DNS propagation on the next attempt.

Some challenges have failed.

Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /usr/local/etc/certbot/logs/letsencrypt.log or re-run Certbot with -v for more details.

My web server is (include version): Apache/HomeBrew

The operating system my web server runs on is (include version): MacOS 12.7.6

My hosting provider, if applicable, is: I run my own server - yes to below

I can login to a root shell on my machine (yes or no, or I don't know):

I'm using a control panel to manage my site (no, or provide the name and version of the control panel): no - terminal

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): 3.0.1

2

Yeah, both of those TXT values should appear in your DNS because you are asking for a certificate with two domain names. Only one of those values appears so it looks like you overwrote the first with the second.

https://unboundtest.com/m/TXT/_acme-challenge.mfno.org/JAS4QKDG

1 Like
3

I did because I didn't realize I can two entries with the same prefix "_acme-challenge.mfno.org" is it normal to have two with same prefix or you put two strings in same entry separated with carriage return?

4

I don't recall having to do this before. I was only asked once to update string.

5

It is normal to have more than one. Some DNS providers want each listed on their own line some do other ways. You'll have to refer to your DNS panel instructions on how to do that.

This isn't new so maybe you just got lucky last time ?

1 Like
6

Prolly tried twice where one of the challenges was cached from the first attempt.

3 Likes
7

One auth would have been cached from the Jan10 cert that used just the wildcard domain name.

The Jan13 cert with that and the apex would have only needed the one challenge.

@cursulak So, you are right that you were only asked once before due to this caching and the change to add your apex name to your cert. But, the need for two isn't new so you'll need to sort that out for now and the future.

image
image1629×345 74.4 KB

2 Likes
8

I use DynDNS and they do support multiple same named txt entries so I went back to recert prepared to enter both, but it only asked me once this time. I believe I know what to do now. Thank you all. I will enter two lines if it asks me twice. This was the first time it had asked me to do that so I was unprepared. Learned something today... I guess it's a good day. Thank you.

2 Likes
9

Yeah, one of the two you did just before was cached so the next time just the one.

But, your next normal renewal in about 60 days will ask for two. I promise :slight_smile:

2 Likes