caddy-dns / desec

deSEC module for Caddy
MIT License
12 stars 3 forks source link

ACME Challange not recognized #8

Open Minecodes opened 6 days ago

Minecodes commented 6 days ago

I don't know if this affects everyone, but every time I use this plugin for the DNS challenge, I get this error:

2024/07/03 20:05:51.565 ERROR   tls.issuance.acme.acme_client   challenge failed        {"identifier": "minecodes.de", "challenge_type": "dns-01", "problem": {"type": "urn:ietf:params:acme:error:unauthorized", "title": "", "detail": "Incorrect TXT record \"...................................................................\" (and 1 more) found at _acme-challenge.minecodes.de", "instance": "", "subproblems": []}}
2024/07/03 20:05:51.565 ERROR   tls.issuance.acme.acme_client   validating authorization        {"identifier": "minecodes.de", "problem": {"type": "urn:ietf:params:acme:error:unauthorized", "title": "", "detail": "Incorrect TXT record \"...................................................................\" (and 1 more) found at _acme-challenge.minecodes.de", "instance": "", "subproblems": []}, "order": "https://acme-staging-v02.api.letsencrypt.org/acme/order/........./...........", "attempt": 1, "max_attempts": 3}
2024/07/03 20:05:51.565 ERROR   tls.obtain      could not get certificate from issuer   {"identifier": "minecodes.de", "issuer": "acme-staging-v02.api.letsencrypt.org-directory", "error": "HTTP 403 urn:ietf:params:acme:error:unauthorized - Incorrect TXT record \"...................................................................\" (and 1 more) found at _acme-challenge.minecodes.de"}

With Cloudflare, it's working fine (other domain). I'm currently trying to pin down the problem using the staging server. Could anyone tell me what happened there?

znkr commented 5 days ago

This is very little information to understand the issue, but it looks like the TXT record is not properly updated. This is quite likely a configuration error. Could you share your configuration and more logs?

Minecodes commented 4 days ago

Screenshot 2024-07-05 at 15-24-41 deSEC – Free Secure DNS

2024/07/05 13:21:44.685 INFO    tls.obtain      acquiring lock  {"identifier": "minecodes.de"}
2024/07/05 13:21:44.687 INFO    tls     storage cleaning happened too recently; skipping for now        {"storage": "FileStorage:/home/thies/Website/certs/", "instance": "5232d68e-9859-4ffe-a507-587fac784fbf", "try_again": "2024/07/06 13:21:44.687", "try_again_in": 86399.999999038}
2024/07/05 13:21:44.687 INFO    tls.obtain      lock acquired   {"identifier": "minecodes.de"}
2024/07/05 13:21:44.687 INFO    tls     finished cleaning storage units
2024/07/05 13:21:44.687 INFO    tls.obtain      obtaining certificate   {"identifier": "minecodes.de"}
2024/07/05 13:21:44.688 INFO    tls.issuance.acme       waiting on internal rate limiter        {"identifiers": ["minecodes.de"], "ca": "https://acme-staging-v02.api.letsencrypt.org/directory", "account": "contact@minecodes.de"}
2024/07/05 13:21:44.688 INFO    tls.issuance.acme       done waiting on internal rate limiter   {"identifiers": ["minecodes.de"], "ca": "https://acme-staging-v02.api.letsencrypt.org/directory", "account": "contact@minecodes.de"}
2024/07/05 13:21:44.688 INFO    tls.issuance.acme       using ACME account      {"account_id": "https://acme-staging-v02.api.letsencrypt.org/acme/acct/154007433", "account_contact": ["mailto:contact@minecodes.de"]}
2024/07/05 13:21:45.750 INFO    tls.issuance.acme.acme_client   trying to solve challenge       {"identifier": "minecodes.de", "challenge_type": "dns-01", "ca": "https://acme-staging-v02.api.letsencrypt.org/directory"}
2024/07/05 13:22:53.166 ERROR   tls.issuance.acme.acme_client   challenge failed        {"identifier": "minecodes.de", "challenge_type": "dns-01", "problem": {"type": "urn:ietf:params:acme:error:unauthorized", "title": "", "detail": "No TXT record found at _acme-challenge.minecodes.de", "instance": "", "subproblems": []}}
2024/07/05 13:22:53.166 ERROR   tls.issuance.acme.acme_client   validating authorization        {"identifier": "minecodes.de", "problem": {"type": "urn:ietf:params:acme:error:unauthorized", "title": "", "detail": "No TXT record found at _acme-challenge.minecodes.de", "instance": "", "subproblems": []}, "order": "https://acme-staging-v02.api.letsencrypt.org/acme/order/154007433/17609697553", "attempt": 1, "max_attempts": 3}
2024/07/05 13:22:53.166 ERROR   tls.obtain      could not get certificate from issuer   {"identifier": "minecodes.de", "issuer": "acme-staging-v02.api.letsencrypt.org-directory", "error": "HTTP 403 urn:ietf:params:acme:error:unauthorized - No TXT record found at _acme-challenge.minecodes.de"}
Minecodes commented 4 days ago

I cleaned all records to make a fresh attempt to make it as reproducible as possible. It still has the same outcome

znkr commented 2 days ago

Can you also share your configuration? From a first look, the DNS record is not updated. That is, the desec provider is not used at all.

Minecodes commented 12 hours ago
example.com {
        tls contact@example.com {
               dns desec {
               token "Token"
               }
        }

        respond * "In maintainance" 200
}

This is what I used in the config