Closed deoxykev closed 1 year ago
So it turns out it is because I have a split DNS scenario where subdomain.redacted.net actually does have a SOA on my LAN, but not in Cloudflare, where the SOA would be at redacted.net. However, the program uses the internal DNS where subdomain.redacted.net has a SOA, making it think that the cloudflare zone it's supposed to operate on is subdomain.redacted.net instead of redacted.net.
Any way you could add in support to specify the zone by environment variable rather than dynamic SOA lookup?
Here's the relevant function: https://github.com/go-acme/lego/blob/master/providers/dns/cloudflare/cloudflare.go\#L127
Hello,
Any way you could add in support to specify the zone by environment variable rather than dynamic SOA lookup?
lego is used as a CLI but also as a library, this kind of option can only work in a very specific use case related to CLI with only one zone. We will not add this option.
you can use --dns.resolvers
to choose the right resolver.
you can also use CNAME.
Thank you for reading and responding. The --dns.resolvers
option worked for me.
If any one else comes across this issue, my working example is:
# token api key permissions in cloudflare:
# Zone / Zone / Read
# Zone / DNS / Edit
export CLOUDFLARE_DNS_API_TOKEN="xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
/usr/local/bin/lego \
--dns.resolver 1.1.1.1 \
--accept-tos \
--email you@example.com \
--dns cloudflare \
--domains "*.subdomain.example.com" \
run
Welcome
What did you expect to see?
Getting a wildcard cert on the root domain (
*.redacted.net
) works:What did you see instead?
But a wildcard cert on a subdomain or nested subdomain (
*.subdomain.redacted.net
) does not work.How do you use lego?
Binary
Reproduction steps
CLOUDFLARE_DNS_API_TOKEN=xxxxxxxxx lego --accept-tos --email email@redacted.net --dns cloudflare --domains "*.subdomain.redacted.net" run
Version of lego
Logs
n/a
Go environment (if applicable)
n/a