Trouble with dns-rfc2136 plugin

Help
1

Hi all. I'm testing certbot+dns-rfc2136 container (version certbot 5.6.0) in a on-premises kubernetes. Also in kubernetes I have a bind9 configured to handle dynamic updates on a specific domain (_acme-challenge.l39a.space), and many domains with _acme-challenge as a CNAME pointing to _acme-challenge.l39a.space.

The most strange thing is that for some domains the certificates are released without any problem (l39a.space, l39a.com as two examples), but for other domains there is the error:

"Encountered exception during recovery: certbot.errors.PluginError: Unable to determine base domain for _acme-challenge.vsforme.com using names: ['_acme-challenge.vsforme.com', 'vsforme.com', 'com']."

vsforme.com is one of the failing domains, of course. But the domain configuration is, or should be, exactly the same of the working domains... I directly hosts the dns for some of the domains, others are on different providers, but I can't see any correlation between the working domains and the non working ones.

All of these domains where handled, correctly, with certbot with --manual option and some self-made script to handle the dns update.

2

I don't think Certbot likes CNAMEs with the dns-01 challenge. This has been a feature request since 2015 already:

Unfortunately I'm not sure if this feature is going to land very soon. There are PR requests on the Certbot GH repo like

But it has not seen updates for over a year now and there were some issues raised by the Certbot devs.

3

Yes, but... why some, could be the majority, of the domains are working and some not??

4

Hm, yes, that's curious. I read l39a.space as a working domain and that would make sense, as that's the "destination" of the CNAME. But l39a.com shouldn't work. I dunno TBH :person_shrugging: