Wildcard ssl letsencrypt from cloudflare A-record @ required?

Help
1

Hello.

I generate Wildcard SSL letsencrypt from CloudFlare DNS.

In DNS I have only one record: A - * - MyIP

Can I not add an A-record A - @ - MyIP?
Will there be a check in this case?

Now I have error

Domain: ***.com
Type: unauthorized
Detail: No TXT record found at _acme-challenge.***.com

Domain: ***.com
Type: unauthorized
Detail: No TXT record found at _acme-challenge.***.com

UPD: domain kinoknopka.plus

2

If you actually have a wildcard A record, there’s no problem. It doesn’t interfere with the creation or querying of the _acme-challenge TXT records.

However, if you create a wildcard CNAME record, then things tend to stop working, because resolvers will follow CNAMEs and ignore any TXT records under the same DNS label.

As always, the devil is in the details, so if you want help, post your real domain name.

3

kinoknopka.plus
please check it

5

That domain looks okay to me.

How are you trying to issue the wildcard certificate? What Let’s Encrypt client are you using, what command are you using, and what’s the output?

6

DNS: A-record - *.kinoknopka.plus - IP
Generate:

        docker run \
            --rm \
            -v "/ssl.d:/etc/letsencrypt" \
            -v "/letsencrypt:/var/lib/letsencrypt" \
            -v "/cloudflare.ini:/cloudflare.ini" \
            certbot/dns-cloudflare \
            certonly \
            --dns-cloudflare \
            --dns-cloudflare-credentials /cloudflare.ini \
            --email "support@kinoknopka.plus" \
            --non-interactive \
            --agree-tos \
            -d "kinoknopka.plus" \
            -d "*.kinoknopka.plus" \
            --server https://acme-v02.api.letsencrypt.org/directory

Result:
Domain: kinoknopka.plus
Type: unauthorized
Detail: No TXT record found at _acme-challenge.kinoknopka.plus

Domain: kinoknopka.plus
Type: unauthorized
Detail: No TXT record found at _acme-challenge.kinoknopka.plus

After add DNS: A-record - kinoknopka.plus - IP
Result: Generation was successful.

Is a domain A-record kinoknopka.plus record required? *.kinoknopka.plus not enough?
If I delete the record A-record - kinoknopka.plus - IP after generation, will the certificate renewal also be an error?

1 Like
7

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.