hakwerk
commented
8 months ago Well, first of all, if your hostname is acme-certmanager.nd.dakota.home, then the domain name is "nd.dakota.home" and not just "dakota.home". Yes, LabCA should work with either of those domains.
The system is doing DNS lookups to look for a CAA record on the domain itself (nd.dakota.home) and if it cannot find one, on the parent domain(s), in your case on dakota.home and then home. Your DNS is not setup properly if the home domain is not defined. The solution is either adding a CAA record in a (sub)domain that does exist in your DNS, or setup the home zone.
Also see https://github.com/hakwerk/labca?tab=readme-ov-file#common-error-messages for some tips on these errors and more background on CAA.
ihatecerts
if i had a domain such as dakota.home, would that work with this service?
OOPS Some unexpected error occurred!
control-1 | Verifying acme-certmanager.nd.dakota.home... control-1 | Traceback (most recent call last): control-1 | File "/opt/labca/acme_tiny.py", line 199, in
control-1 | main(sys.argv[1:])
control-1 | File "/opt/labca/acme_tiny.py", line 195, in main
control-1 | signed_crt = get_crt(args.account_key, args.csr, args.acme_dir, log=LOGGER, CA=args.ca, disable_check=args.disable_check, directory_url=args.directory_url, contact=args.contact, check_port=args.check_port)
control-1 | File "/opt/labca/acme_tiny.py", line 153, in get_crt
control-1 | raise ValueError("Challenge did not pass for {0}: {1}".format(domain, authorization))
control-1 | ValueError: Challenge did not pass for acme-certmanager.nd.dakota.home: {'identifier': {'type': 'dns', 'value': 'acme-certmanager.nd.dakota.home'}, 'status': 'invalid', 'expires': '2024-03-18T14:46:01Z', 'challenges': [{'type': 'http-01', 'status': 'invalid', 'error': {'type': 'urn:ietf:params:acme:error:dns', 'detail': "DNS problem: SERVFAIL looking up CAA for home - the domain's nameservers may be malfunctioning", 'status': 400}, 'url': 'http://boulder:4001/acme/chall-v3/1/zAND0Q', 'token': 'rp1CRhAn6YF9CTPHg_jRmYO5FzMRgB0zePt23WN12nY', 'validationRecord': [{'url': acme-certmanager.nd.dakota.home/.well-known/acme-challenge/rp1CRhAn6YF9CTPHg_jRmYO5FzMRgB0zePt23WN12nY', 'hostname': 'acme-certmanager.nd.dakota.home', 'port': '80', 'addressesResolved': ['198.19.155.252'], 'addressUsed': '198.19.155.252', 'resolverAddrs': ['A:198.19.189.86:53', 'AAAA:198.19.189.86:53']}], 'validated': '2024-03-11T14:46:01Z'}]}
ok