# Wildcard and domain registration breaks registration? **URL:** \ **Category:** Help\ **Created:** [April 30, 2023, 4:25pm UTC](https://community.letsencrypt.org/t/wildcard-and-domain-registration-breaks-registration/197411 "2023-04-30T16:25:50Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![ikke42](https://avatars.discourse-cdn.com/v4/letter/i/a88e57/32.png) [@ikke42](https://community.letsencrypt.org/u/ikke42)\ **Post date:** [April 30, 2023, 4:25pm UTC](https://community.letsencrypt.org/t/wildcard-and-domain-registration-breaks-registration/197411/1 "2023-04-30T16:25:50Z")
My domain is: 1236.be I ran this command: certbot certonly --dry-run -d '1236.be,\*.1236.be' -n --agree-tos --email some@address --manual --preferred-challenges dns --manual-auth-hook /home/logoadmin/auth-hook.sh --manual-cleanup-hook /home/logoadmin/scripts/server2/letsencrypt/cleanup-hook.sh Note that this works when I pass only the base domain (1236.be) or only the wildcard domain (\*.1236.be) or several non-wildcard domains, but not when I pass the base domain and the wildcard domain together, which seems like a common usecase (?). It produced this output: Certbot failed to authenticate some domains (authenticator: manual). The Certificate Authority reported these problems: Domain: 1236.be Type: unauthorized Detail: Incorrect TXT record "oqF56pLpYPeNic7FSyIAIuslG5eRvd5mKGLaq6kgZ0I" found at \_acme-challenge.1236.be I changed my hook script to output information while being called: Saving debug log to /var/log/letsencrypt/letsencrypt.log Simulating a certificate request for \*.1236.be and 1236.be Hook '--manual-auth-hook' for 1236.be ran with output: auth for 1236.be with validation 675M4pIxGHNAcqQLo4q3Y93AZjEBiakBhXTJn5AyP4c New key, using POST Reading back after setting - expecting : 675M4pIxGHNAcqQLo4q3Y93AZjEBiakBhXTJn5AyP4c response text: {"rrset\_name":"\_acme-challenge","rrset\_type":"TXT","rrset\_ttl":300,"rrset\_values":[""675M4pIxGHNAcqQLo4q3Y93AZjEBiakBhXTJn5AyP4c""],"rrset\_href":"[https://api.gandi.net/v5/livedns/domains/1236.be/records/\_acme-challenge/TXT](https://api.gandi.net/v5/livedns/domains/1236.be/records/_acme-challenge/TXT)"} Hook '--manual-auth-hook' for 1236.be ran with output: auth for 1236.be with validation FzOg3BePN1L5GZvbiFI1G8rlpWgIZ4ZoHHVXpEXJ0qo Existing key, using PUT Reading back after setting - expecting : FzOg3BePN1L5GZvbiFI1G8rlpWgIZ4ZoHHVXpEXJ0qo response text: {"rrset\_name":"\_acme-challenge","rrset\_type":"TXT","rrset\_ttl":300,"rrset\_values":[""FzOg3BePN1L5GZvbiFI1G8rlpWgIZ4ZoHHVXpEXJ0qo""],"rrset\_href":"[https://api.gandi.net/v5/livedns/domains/1236.be/records/\_acme-challenge/TXT](https://api.gandi.net/v5/livedns/domains/1236.be/records/_acme-challenge/TXT)"} Certbot failed to authenticate some domains (authenticator: manual). The Certificate Authority reported these problems: Domain: 1236.be Type: unauthorized Detail: Incorrect TXT record "FzOg3BePN1L5GZvbiFI1G8rlpWgIZ4ZoHHVXpEXJ0qo" found at \_acme-challenge.1236.be It seems certbot first calls the auth-hook script for each domain it needs to register before reading back the DNS values for these domains. Hence this fails when a wildcard and a base domain are both present, since the CERTBOT\_DOMAIN passed for both is (in my case) '1236.be', and hence they cannot be created with the same key and a different value at the same time. Solution could be to check domain by domain, or to use a different CERTBOT\_DOMAIN for wildcards. First posting it here to see if this is worth mentioning as a bug or whether I am completely missing something 😉 My web server is (include version): nginx 1.18.0 The operating system my web server runs on is (include version): Ubuntu 22.04.02 LTS I can login to a root shell on my machine (yes or no, or I don't know): yes (sudo) I'm using a control panel to manage my site (no, or provide the name and version of the control panel): no The version of my client is (e.g. output of `certbot --version` or `certbot-auto --version` if you're using Certbot): certbot 1.21.0 ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [April 30, 2023, 4:38pm UTC](https://community.letsencrypt.org/t/wildcard-and-domain-registration-breaks-registration/197411/2 "2023-04-30T16:38:09Z")
> [@ikke42](#): > > and hence they cannot be created with the same key and a different value at the same time. That's not true, it's perfectly allowed. But your DNS provider might be limited for some reason with this regard. ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [April 30, 2023, 9:30pm UTC](https://community.letsencrypt.org/t/wildcard-and-domain-registration-breaks-registration/197411/3 "2023-04-30T21:30:49Z")
> [@ikke42](#): > > 1236.be Can you manually add two different TXT record entries for?: `_acme-challenge.1236.be` If so, then your script may need review. If not, then your DNS service may need review. ---
**Author:** ![schoen](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/schoen/32/79_2.png) [@schoen](https://community.letsencrypt.org/u/schoen)\ **Post date:** [May 1, 2023, 12:37am UTC](https://community.letsencrypt.org/t/wildcard-and-domain-registration-breaks-registration/197411/4 "2023-05-01T00:37:22Z")
> [@Osiris](#): > > That's not true, it's perfectly allowed. But your DNS provider might be limited for some reason with this regard. It's also common that DNS providers allow this, but people's DNS hook scripts don't use the DNS provider's API correctly and overwrite the old record unnecessarily (or that the DNS provider's API doesn't expose this functionality correctly). You might want to double-check the functionality of `/home/logoadmin/auth-hook.sh` or talk to whoever wrote it, as some implementers don't think about this subtlety because it may not matter for their own configurations. ---
**Author:** ![ikke42](https://avatars.discourse-cdn.com/v4/letter/i/a88e57/32.png) [@ikke42](https://community.letsencrypt.org/u/ikke42)\ **Post date:** [May 1, 2023, 6:49am UTC](https://community.letsencrypt.org/t/wildcard-and-domain-registration-breaks-registration/197411/5 "2023-05-01T06:49:50Z")
I can create the records manually through the webinterface but not via the API - that causes 'duplicate entry' errors. So I am following that up with them. ... and I learned that DNS is not exactly a key-value store with unique keys, otherwise I would immediately have taken it up with them. Many, many thanks. ---
**Author:** ![petercooperjr](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/petercooperjr/32/84698_2.png) [@petercooperjr](https://community.letsencrypt.org/u/petercooperjr)\ **Post date:** [May 1, 2023, 10:54am UTC](https://community.letsencrypt.org/t/wildcard-and-domain-registration-breaks-registration/197411/6 "2023-05-01T10:54:35Z")
In theory, an ACME client should be able to set up the TXT record for one of the names, have that challenge happen, and then change the TXT record to the value for the other name, have that challenge happen, and then be all set to get the certificate since both challenges completed. I don't think that Certbot's hooks allow one to do it that way, though. ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [May 1, 2023, 1:58pm UTC](https://community.letsencrypt.org/t/wildcard-and-domain-registration-breaks-registration/197411/8 "2023-05-01T13:58:31Z")
[possible temp workaround - until the issue can be properly corrected] Since the hook always tries both names, and `certbot` keeps them in the same order, then it will only be able to pass one of the names (since the TXT record only holds one entry) and will continue to fail for the other name. WORKAROUND #1: It might be able to be _tricked_ to work with: [the _trick_ part is in splitting the requests correctly] - try one name - the name that failed when both names were attempted [get a cert (with one name)] [see the LE logs for this failing detail] - then immediately try both names [get the good cert (with both names)] Otherwise... WORKAROUND #2: [with much less _trickiness_]: - try one name [get a cert] - then immediately try the other name [get another cert] - then immediately try both names [get the good cert (with both names)] With either workaround, you will end up with more certs than you need. But you should be able to get the cert that you do need. ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [May 1, 2023, 4:37pm UTC](https://community.letsencrypt.org/t/wildcard-and-domain-registration-breaks-registration/197411/9 "2023-05-01T16:37:31Z")
Another workaround: - attempt to get a certificate for the apex domain name _AND_ a random non-existing domain name; - this attempt will ultimately fail due to the second domain, _but_ the first hostname will be authorized and Let's Encrypt caches valid authorizations for 30 days currently; - do the same for the wildcard hostname, including a non-existing domain; - again, LE will cache the valid authorized wildcard hostname - get the certificate for both hostnames: no new authorization required, as both should be valid and cached. > [@petercooperjr](#): > > I don't think that Certbot's hooks allow one to do it that way, though. As far as I know that's correct indeed. I believe Certbot sets up all the challenges and afterwards let's the ACME server verify them all at the same time. ---
**Author:** ![ikke42](https://avatars.discourse-cdn.com/v4/letter/i/a88e57/32.png) [@ikke42](https://community.letsencrypt.org/u/ikke42)\ **Post date:** [May 1, 2023, 6:18pm UTC](https://community.letsencrypt.org/t/wildcard-and-domain-registration-breaks-registration/197411/10 "2023-05-01T18:18:34Z")
I am happy to report that everything now works, after discussing with my DNS provider. So no workarounds needed 😉 ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [May 31, 2023, 6:19pm UTC](https://community.letsencrypt.org/t/wildcard-and-domain-registration-breaks-registration/197411/11 "2023-05-31T18:19:10Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.