Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.
My domain is: ess.eu
I ran this command: certbot --text --agree-tos --non-interactive certonly --rsa-key-size 4096 -a dns-rfc2136 --cert-name 'sftp.ess.eu' -d 'sftp.ess.eu' --dns-rfc2136-credentials /etc/letsencrypt/dns-rfc2136.ini --dns-rfc2136-propagation-seconds 10 --keep-until-expiring
It produced this output:
Performing the following challenges:
dns-01 challenge for sftp.ess.eu
Cleaning up challenges
Encountered exception during recovery: PluginError: Unable to determine base domain for _acme-challenge.sftp.ess.eu using names: ['_acme-challenge.sftp.ess.eu', 'sftp.ess.eu', 'ess.eu', 'eu'].
Unable to determine base domain for _acme-challenge.sftp.ess.eu using names: ['_acme-challenge.sftp.ess.eu', 'sftp.ess.eu', 'ess.eu', 'eu'].
This command works:
certbot --text --agree-tos --non-interactive certonly --rsa-key-size 4096 -a dns-rfc2136 --cert-name 'wildcard' -d '*.ess.eu' --dns-rfc2136-credentials /etc/letsencrypt/dns-rfc2136.ini --dns-rfc2136-propagation-seconds 10 --keep-until-expiring
My web server is (include version): haproxy 1.8
The operating system my web server runs on is (include version): CentOS 7
My hosting provider, if applicable, is:
I can login to a root shell on my machine (yes or no, or I don't know): yes
I'm using a control panel to manage my site (no, or provide the name and version of the control panel):
no
The version of my client is (e.g. output of certbot --version
or certbot-auto --version
if you're using Certbot):
certbot 1.11.0
I created a new name server and migrated to it recently. After that, dns-01 failed.
The dns-rfc2136.ini config is:
dns_rfc2136_server=new_ns.domain
dns_rfc2136_port=53
dns_rfc2136_name=key_name
dns_rfc2136_secret=secret
dns_rfc2136_algorithm=HMAC-SHA256
Is there anything wrong with the configuration or my name server?