Wildcard certificates and amazon route 53

Help
1

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: reidbras.dev

I ran this command:
certbot certonly -v -d reidbras.dev -d *.reidbras.dev --dns-route53 --logs-dir /home/reid/letsencrypt/log/ --config-dir /home/reid/letsencrypt/config/ --work-dir /home/reid/letsencrypt/work/ -m reidbras@gmail.com --agree-tos --non-interactive --server https://acme-v02.api.letsencrypt.org/directory

It produced this output:
Saving debug log to /home/reid/letsencrypt/log/letsencrypt.log
Found credentials in shared credentials file: ~/.aws/credentials
Plugins selected: Authenticator dns-route53, Installer None
Requesting a certificate for reidbras.dev and *.reidbras.dev
Performing the following challenges:
dns-01 challenge for reidbras.dev
dns-01 challenge for reidbras.dev
Waiting 10 seconds for DNS changes to propagate
Waiting for verification...
Challenge failed for domain reidbras.dev
Challenge failed for domain reidbras.dev
dns-01 challenge for reidbras.dev
dns-01 challenge for reidbras.dev

Certbot failed to authenticate some domains (authenticator: dns-route53). The Certificate Authority reported these problems:
Domain: reidbras.dev
Type: dns
Detail: DNS problem: NXDOMAIN looking up TXT for _acme-challenge.reidbras.dev - check that a DNS record exists for this domain

Domain: reidbras.dev
Type: dns
Detail: DNS problem: NXDOMAIN looking up TXT for _acme-challenge.reidbras.dev - check that a DNS record exists for this domain

Hint: The Certificate Authority failed to verify the DNS TXT records created by --dns-route53. Ensure the above domains are hosted by this DNS provider, or try increasing --dns-route53-propagation-seconds (currently 10 seconds).

Cleaning up challenges
Some challenges have failed.
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /home/reid/letsencrypt/log/letsencrypt.log or re-run Certbot with -v for more details.

My web server is (include version): nginx version: nginx/1.18.0 (Ubuntu) also will be using Node.js v12.22.9

The operating system my web server runs on is (include version):
Distributor ID: Ubuntu
Description: Ubuntu 22.04.2 LTS
Release: 22.04
Codename: jammy

My hosting provider, if applicable, is:

I can login to a root shell on my machine (yes or no, or I don't know): yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel): no

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): certbot 2.6.0

2

Hi @reid1, and welcome to the LE community forum :slight_smile:

Is that domain registered?
If so, when?

3

Looks like it's not:

How exciting! reidbras.dev is available.

If I go to https://get.dev/ and type it in.

4

Yes Google domain.

Screenshot_20230703-132815.png
Screenshot_20230703-132815.png720×1600 41.9 KB

5

rbras.dev is not the same as reidbras.dev?

6

Sorry, rbras.dev is registered and that is mine. I will try and change the route 53 record. What goes in the TXT record for that domain.
Reid

7

Whatever the Let's Encrypt ACME server tells Certbot to put in the TXT record. The Route53 DNS plugin should take care of all that.

8

I may have to find another DNS server to test with. I received the same message as before.

certbot certonly -v -d rbras.dev -d *.rbras.dev --dns-route53 --logs-dir /home/reid/letsencrypt/log/ --conf
ig-dir /home/reid/letsencrypt/config/ --work-dir /home/reid/letsencrypt/work/ -m reidbras@gmail.com --agree-tos --non-interactive --server
https://acme-v02.api.letsencrypt.org/directory
Saving debug log to /home/reid/letsencrypt/log/letsencrypt.log
Found credentials in shared credentials file: ~/.aws/credentials
Plugins selected: Authenticator dns-route53, Installer None
Requesting a certificate for rbras.dev and *.rbras.dev
Performing the following challenges:
dns-01 challenge for rbras.dev
dns-01 challenge for rbras.dev
Waiting 10 seconds for DNS changes to propagate
Waiting for verification...
Challenge failed for domain rbras.dev
Challenge failed for domain rbras.dev
dns-01 challenge for rbras.dev
dns-01 challenge for rbras.dev

Certbot failed to authenticate some domains (authenticator: dns-route53). The Certificate Authority reported these problems:
Domain: rbras.dev
Type: dns
Detail: DNS problem: NXDOMAIN looking up TXT for _acme-challenge.rbras.dev - check that a DNS record exists for this domain

Domain: rbras.dev
Type: dns
Detail: DNS problem: NXDOMAIN looking up TXT for _acme-challenge.rbras.dev - check that a DNS record exists for this domain

Hint: The Certificate Authority failed to verify the DNS TXT records created by --dns-route53. Ensure the above domains are hosted by this
DNS provider, or try increasing --dns-route53-propagation-seconds (currently 10 seconds).

Cleaning up challenges
Some challenges have failed.
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /home/reid/letsencrypt/log/letsencrypt.log or re
-run Certbot with -v for more details.

9

It looks like that domain is at googledomains and not Route53

You could try adding a sample TXT record and check it with
unboundtest.com

See result:
https://unboundtest.com/m/TXT/acme-challenge.rbras.dev/F2QLGMWH

10

The certbot-dns-multi DNS plugin supports Google Domains for automated adding/removing of the TXT records.

11

Thanks,
After re-installing certbot with pip instead of snap the plugins were recognized and I was able to produce a working certificate.

12

I hope you run all that in a virtual environment? Pip is known to not behave properly when everything is installed system wide.

Also, certbot-dns-multi is available as a snap.