Unable to determine zone identifier for takepaymentsplus.com using zone names: ['takepaymentsplus.com', 'com']

[abadger1406]

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: takepaymentsplus.com

I ran this command:

/root/venv/bin/certbot certonly --dns-ovh --dns-ovh-credentials /root/.ovhapi --dns-ovh-propagation-seconds 120 --agree-tos --email dave@visitor.express -d takepaymentsplus.com -d '*.takepaymentsplus.com'

It produced this output:

Unable to determine zone identifier for takepaymentsplus.com using zone names: ['takepaymentsplus.com', 'com']

My web server is (include version):

nginx

The operating system my web server runs on is (include version):

Ubuntu 20.04

My hosting provider, if applicable, is:

OVH

I can login to a root shell on my machine (yes or no, or I don't know):

yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel):

no

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot):

(venv) root@lb1:~# certbot --version
certbot 1.27.0

[abadger1406]

Think the issue is related to using delegation - have

(venv) root@lb1:~# dig _acme-challenge.takepaymentsplus.com.

; <<>> DiG 9.18.1-1ubuntu1-Ubuntu <<>> _acme-challenge.takepaymentsplus.com.
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 48565
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 65494
;; QUESTION SECTION:
;_acme-challenge.takepaymentsplus.com. IN A

;; ANSWER SECTION:
_acme-challenge.takepaymentsplus.com. 3600 IN CNAME _acme-challenge.visitor.express.

;; AUTHORITY SECTION:
visitor.express. 300 IN SOA dns103.ovh.net. tech.ovh.net. 2022051765 86400 3600 3600000 300

;; Query time: 19 msec
;; SERVER: 127.0.0.53#53(127.0.0.53) (UDP)
;; WHEN: Tue May 17 23:20:32 BST 2022
;; MSG SIZE rcvd: 165

(venv) root@lb1:~#

[_az]

Certbot's DNS plugins don't support delegating the _acme-challenge subdomain in this way.

Maybe give acme.sh a go: DNS alias mode · acmesh-official/acme.sh Wiki · GitHub

[abadger1406]

Thank you so much - that resolved the issue. Did not realise how easy it is with acme.sh to mix and match the dns delegation;-

Now using acme.sh like this...

/root/.acme.sh/acme.sh --issue \
	--dns dns_ovh --server letsencrypt \
	-d netfm.org --challenge-alias no \
	-d '*.netfm.org' --challenge-alias no \
	-d takepaymentsplus.com  --challenge-alias  visitor.express \
	-d '*.takepaymentsplus.com' --challenge-alias  visitor.express