acmesh-official / acme.sh

A pure Unix shell script implementing ACME client protocol
https://acme.sh
GNU General Public License v3.0
38.67k stars 4.91k forks source link

Intermittent Issues - DNS-01, Dynu #3275

Open antiochtech opened 3 years ago

antiochtech commented 3 years ago

without changing a thing, the script is sometimes successful to varying degrees and other times not at all. i've made more attempts than i can count and poured over the logs for each. when it doesnt completely succeed (rare), it fails in one or more of the same ways each time: it cant create the challenge, cant read the record or cant delete the record.

here are some of the logs from the following command: sudo /root/.acme.sh/acme.sh --issue --dns dns_dynu -d $HOSTNAME.antiochtechnologies.net --dnssleep 120 --log --log-level 2 --force --staging --debug 2

antiochtech commented 3 years ago

i wrote a script continuously calling the dynu dns api to add and delete a record. i noticed that the requests usually complete in about a second, but that they occasionally take up to 15 seconds. could a timeout be causing my issue?

spoolio commented 3 years ago

I'm having something similar to your 4th example happen when I try to use acme inside of pfsense. The log looks normal until the detect root zone part. The call to api.dynu.com for my third level domain looks successful (if a little short?), but the getroots to dynu.net and .net return 501's. I know very little about network security, but is this possibly an issue with the request formatting or just a Dynu issue

Relevant portion of log is attached.

J

acme_certissue_log_failure.txt

antiochtech commented 3 years ago

i grew frustrated with dynu's support seeming to blow me off day after day and wrote my own bash script with nsupdate to perform ddns updates on the bind9 server i already operate. it works flawlessly, and now i dont need dynu anymore.

but a real tech did finally reach out as i was running final tests on my solution to request i make my calls to api5.dynu.com instead so that they may study the issue further. maybe that can be of help to you.

spoolio commented 3 years ago

Will give it a shot--Thanks antiotech!