Why I do not receive a prompt?

Help
#1

Hi all

I am trying to setup DNS01 for my subdomains and have done the following:

sudo certbot certonly \
  --dns-digitalocean \
  --dns-digitalocean-credentials dns-secret.ini \
  -d "*.tool.databaker.io" \
  -d "*.service.databaker.io"

As the ouput I’ve got:

Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator dns-digitalocean, Installer None
Enter email address (used for urgent renewal and security notices) (Enter 'c' to
cancel): example@example.io

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Please read the Terms of Service at
https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf. You must
agree in order to register with the ACME server at
https://acme-v02.api.letsencrypt.org/directory
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(A)gree/(C)ancel: A

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Would you be willing to share your email address with the Electronic Frontier
Foundation, a founding partner of the Let's Encrypt project and the non-profit
organization that develops Certbot? We'd like to send you email about our work
encrypting the web, EFF news, campaigns, and ways to support digital freedom.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: Y
Obtaining a new certificate
Performing the following challenges:
dns-01 challenge for service.databaker.io
dns-01 challenge for tool.databaker.io
Unsafe permissions on credentials configuration file: dns-secret.ini
Waiting 10 seconds for DNS changes to propagate
Waiting for verification...
Cleaning up challenges

IMPORTANT NOTES:
 - Congratulations! Your certificate and chain have been saved at:
   /etc/letsencrypt/live/tool.databaker.io/fullchain.pem
   Your key file has been saved at:
   /etc/letsencrypt/live/tool.databaker.io/privkey.pem
   Your cert will expire on 2020-08-03. To obtain a new or tweaked
   version of this certificate in the future, simply run certbot
   again. To non-interactively renew *all* of your certificates, run
   "certbot renew"
 - Your account credentials have been saved in your Certbot
   configuration directory at /etc/letsencrypt. You should make a
   secure backup of this folder now. This configuration directory will
   also contain certificates and private keys obtained by Certbot so
   making regular backups of this folder is ideal.
 - If you like Certbot, please consider supporting our work by:

   Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
   Donating to EFF:                    https://eff.org/donate-le

As you can see, I do not receive any TXT for DNS entries. What am I doing wrong?

Thanks

1 Like
#2

Euh, I fail to see the problem here. You’re using the Digital Ocean DNS plugin. That plugin handles all the TXT record adding (and removing after everything is done). You HAVE succesful got a certificate!

Why would you need to receive the TXT RRs?

Also, it’s probably a good idea to include the base domain when getting a wildcard certificate. For example, if you’ve just got the wildcard certificate for *.example.com, this would be valid for https://foo.example.com and https://bar.example.com but NOT for https://example.com.

1 Like
#3

Thanks so much for your answer.

I can not see any entries on DigitalOcean Domain maintenance site.
Why? Or how can I prove it, that the entries have been made.

I tested it, but the certificate can not be received.

Screenshot from 2020-05-05 17-58-09
Screenshot from 2020-05-05 17-58-09892×289 6.58 KB

What am I doing wrong?

#4

After a succesful authorization, the TXT records aren’t needed any longer, so they are deleted.

You used certonly. That means you only get the certificate. You have to install it yourself.

1 Like
#5

What does it mean? What is the purpose of certonly? What do I have to do, to get it running?

#6

Installing the certificate means you have to configure your webserver to actually use it.

Some people don’t want certbot to mess with their webserver configuration. Sometimes the webserver configuration is too complex for certbot to handle properly. Sometimes the webserver isn’t even supported at all.

It seems you’re running Kubernetes. I don’t have any experience with Kubernetes, so I can’t help you with that. Perhaps Google knows. Or someone else here on the community.

2 Likes
#7

I have described in detail here https://stackoverflow.com/questions/61618281/waiting-for-certificaterequest-hello-kubernetes-tls-1352652369.

Yes, I am using it. But what does it have to do with Kubernetes? Aha…I know what you mean.

1 Like
#8

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.