search

acmesh-official / acme.sh

A pure Unix shell script implementing ACME client protocol
https://acme.sh
GNU General Public License v3.0
38.67k stars 4.91k forks source link

acmd.sh does not see that the answer is correct in DNS mode and loops. #2664

Open keltia opened 4 years ago

keltia commented 4 years ago

Steps to reproduce

Trying to renew a certificate with the latest version of acme.sh using DNS mode. It gets the correct answer from either Google/CF DoH server but somehow decides it is not valid and loops over and over with no end:(

Debug log

acme.sh  --issue .....   --debug 2

[Thu Jan  2 13:16:37 UTC 2020] Found domain api file: /admin/etc/dnsapi/dns_keltia.sh
[Thu Jan  2 13:16:37 UTC 2020] Adding txt value: eqKz5THz-YRzR7jLFF1T3w3GUcv8IB5V5GWFCtLBi_w for domain:  _acme-challenge.books.keltia.net
[Thu Jan  2 13:16:37 UTC 2020] Inserting keltia.net
[Thu Jan  2 13:16:37 UTC 2020] fulldomain='_acme-challenge.books.keltia.net'
[Thu Jan  2 13:16:37 UTC 2020] txtvalue='eqKz5THz-YRzR7jLFF1T3w3GUcv8IB5V5GWFCtLBi_w'
[Thu Jan  2 13:16:37 UTC 2020] The txt record is added: Success.
[Thu Jan  2 13:16:37 UTC 2020] books.keltia.net,_acme-challenge.books.keltia.net,,dns_keltia,eqKz5THz-YRzR7jLFF1T3w3GUc
v8IB5V5GWFCtLBi_w,/admin/etc/dnsapi/dns_keltia.sh

[Thu Jan  2 13:16:37 UTC 2020] Let's check each dns records now. Sleep 20 seconds first.
[Thu Jan  2 13:16:59 UTC 2020] _is_idn_d='_acme-challenge.books.keltia.net'
[Thu Jan  2 13:16:59 UTC 2020] _idn_temp
[Thu Jan  2 13:16:59 UTC 2020] _is_idn_d='_acme-challenge.books.keltia.net'
[Thu Jan  2 13:16:59 UTC 2020] _idn_temp
[Thu Jan  2 13:16:59 UTC 2020] d='books.keltia.net'
[Thu Jan  2 13:16:59 UTC 2020] txtdomain='_acme-challenge.books.keltia.net'
[Thu Jan  2 13:16:59 UTC 2020] aliasDomain='_acme-challenge.books.keltia.net'
[Thu Jan  2 13:16:59 UTC 2020] txt='eqKz5THz-YRzR7jLFF1T3w3GUcv8IB5V5GWFCtLBi_w'
[Thu Jan  2 13:16:59 UTC 2020] d_api='/admin/etc/dnsapi/dns_keltia.sh'
[Thu Jan  2 13:16:59 UTC 2020] Checking books.keltia.net for _acme-challenge.books.keltia.net
[Thu Jan  2 13:16:59 UTC 2020] _c_txtdomain='_acme-challenge.books.keltia.net'
[Thu Jan  2 13:16:59 UTC 2020] _c_aliasdomain='_acme-challenge.books.keltia.net'
[Thu Jan  2 13:16:59 UTC 2020] _c_txt='eqKz5THz-YRzR7jLFF1T3w3GUcv8IB5V5GWFCtLBi_w'
[Thu Jan  2 13:16:59 UTC 2020] _ns_ep='https://dns.google/resolve'
[Thu Jan  2 13:16:59 UTC 2020] _ns_domain='_acme-challenge.books.keltia.net'
[Thu Jan  2 13:16:59 UTC 2020] _ns_type='TXT'
[Thu Jan  2 13:16:59 UTC 2020] GET
[Thu Jan  2 13:16:59 UTC 2020] url='https://dns.google/resolve?name=_acme-challenge.books.keltia.net&type=TXT'
[Thu Jan  2 13:16:59 UTC 2020] timeout=
[Thu Jan  2 13:16:59 UTC 2020] Http already initialized.
[Thu Jan  2 13:16:59 UTC 2020] _CURL='curl -L --silent --dump-header /admin/etc/data/http.header  -g '
[Thu Jan  2 13:17:00 UTC 2020] ret='0'
[Thu Jan  2 13:17:00 UTC 2020] response='{"Status": 0,"TC": false,"RD": true,"RA": true,"AD": true,"CD": false,"Questio
n":[ {"name": "_acme-challenge.books.keltia.net.","type": 16}],"Answer":[ {"name": "_acme-challenge.books.keltia.net.",
"type": 16,"TTL": 59,"data": "\"OqOMGLRbeMNfyfyPIQ3HiNMALJNTDmZug9y0FtTwaQo\""}],"Comment": "Response from 2a01:e0d:1:3
:58bf:fa61:0:1."}'
[Thu Jan  2 13:17:00 UTC 2020] _answers='"Answer":[
"name": "_acme-challenge.books.keltia.net.","type": 16,"TTL": 59,"data": "\"OqOMGLRbeMNfyfyPIQ3HiNMALJNTDmZug9y0FtTwaQo
\""
]'
[Thu Jan  2 13:17:00 UTC 2020] Not valid yet, let's wait 10 seconds and check next one.
[Thu Jan  2 13:17:00 UTC 2020] _p_txtdomain='_acme-challenge.books.keltia.net'
[Thu Jan  2 13:17:00 UTC 2020] no purge api for google dns api, just sleep 5 secs
[Thu Jan  2 13:17:18 UTC 2020] Let's wait 10 seconds and check again.
[Thu Jan  2 13:17:29 UTC 2020] _is_idn_d='_acme-challenge.books.keltia.net'
[Thu Jan  2 13:17:29 UTC 2020] _idn_temp
[Thu Jan  2 13:17:29 UTC 2020] _is_idn_d='_acme-challenge.books.keltia.net'
[Thu Jan  2 13:17:29 UTC 2020] _idn_temp
[Thu Jan  2 13:17:29 UTC 2020] d='books.keltia.net'

I dunno how to fix that, every server I ask answers with the correct TXT field but acme.sh does not see it. Please help, I can't renew at all right now.

rayzilt commented 4 years ago

The TXT value: eqKz5THz-YRzR7jLFF1T3w3GUcv8IB5V5GWFCtLBi_w is added to the records but you get a different answer OqOMGLRbeMNfyfyPIQ3HiNMALJNTDmZug9y0FtTwaQo

So it's correct that acme.sh tries again.

Are you sure that no other _acme-challenge.books.keltia.net TXT records exist? Could also be a cache problem from previous attempts.

You can check the controle panel of your DNS provider to verify that the correct _acme-challenge is added when the request is running.