Unable to update challenge :: authorization must be pending

[petercooperjr]

@_az

Previously, Boulder would (for the purposes of CAA) consider everything except for SERVFAIL to be a success, and look for CAA RRs in the response. However, the change that was introduced recently would treat NXDOMAIN as an error response, and cause the CAA check to fail.

Maybe there is something happening with cached authorizations where certificates are being re-issued after the original TXT/A/AAAA RRs have been pulled (changing the query result from NOERROR to NXDOMAIN), but the CAA recheck happens anyway, and leads to this error outcome.

Hmm… It may be even normal with a DNS-01 challenge for the client to delete the TXT record after the challenge succeeds but before requesting issuance, at which point many DNS servers might switch to NXDOMAIN by the time CAA is being checked. I'm not sure what exactly CAA requires, but either Let's Encrypt should change to allow for NXDOMAIN when checking CAA, or clients need to ensure that their DNS server still returns NOERROR for CAA until after issuance actually happens (in which case maybe some existing certs are misissued?).

@shahar-h

Any update? Are you working on a fix?

Nobody who actually works for Let's Encrypt has responded yet; we're just random people on the Internet trying to help. It's not clear to me yet whether Let's Encrypt needs to change or your ACME client and/or DNS server software would need to change, in order to properly handle CAA checking.