Wildcard cert renewal failure

Issuance Tech
1

received warning email

Hello,

Your certificate (or certificates) for the names listed below will expire in 19 days (on 25 Feb 19 16:35 +0000). Please make sure to renew your certificate before then, or visitors to your website will encounter errors.

We recommend renewing certificates automatically when they have a third of their
total lifetime left. For Let’s Encrypt’s current 90-day certificates, that means
renewing 30 days before expiration. See
https://letsencrypt.org/docs/integration-guide/ for details.

*.colmena.biz

For any questions or support, please visit https://community.letsencrypt.org/. Unfortunately, we can’t provide support by email.

DNS-based acme challenge-response

RFC 2136

Why not just query a randomly generated subdomain to prove that the * record exists?

It’s supposed to be a cryptographic “challenge,” not a “challenge” of technical proficiency.

Otherwise, I might have to delegate a new zone such as

abejas.colmena.biz

to my own name servers and attempt the “challenge” for

*.abejas.colmena.biz

Sadly, I do not see this as a good faith challenge, and, well, in other news, I was almost gassed to death in my home last night, so I have backed off from using the wildcard for the time being.

2

Hi @justinacolmena

it's simple: If you want a new certificate, you must proof you are the domain owner.

Every certificates expires.

Some CA send a mail with a link. Or you can use the ACME-protocol with a file (http-01) or a dns-entry (dns-01).

But a "permanent dns entry" isn't a proof.

3

It is actually supposed to be "automated".

[and the details should all become irrelevant]

4

If that is easier for you to do, you can create a CNAME record for _acme-challenge.colmena.biz and point it at _acme-challenge.abejas.colmena.biz (assuming the DNS server responsible for colmena.biz allows you to do that) - and Let's Encrypt will happily follow the CNAME and consider the challenge valid. The only catch is that your ACME client needs to be able to request a cert for one domain while answering the challenge for another - I'm not sure if Certbot knows how to do this (anyone?) but I know acme.sh does.

edit ... though I'm not sure that acme.sh supports RFC 2136 - so that might not be as useful as I thought, sorry. looks like it does, though it calls it 'nsupdate'. Obviously I'm not familiar with this stuff :smiley:

7

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.