search

jeansergegagnon / zoneedit_letsencrypt

Scripts to enable automated ssl certificate update dns-01 challenge with Linux, Zoneedit and Letsencrypt
16 stars 5 forks source link

Why 2 TXT records? #14

Open rb07 opened 2 years ago

rb07 commented 2 years ago

Hi & thanks for your scripts.

I was trying to renew my certificate and it failed. I went to check the SPF TXT record which seemed to be causing the error you mention but I saw 2 TXT _acme-challenge records, which seems odd but I thought perhaps I left an old one.

I deleted both of those, kept my SPF and retried. This time the script worked fine.

The question is as the subject above, why create 2 different records? Or more to the point, why is one of those making the script fail.

Actually the log did show exactly that:

   Domain: sample.org
   Type:   unauthorized
   Detail: Incorrect TXT record
   "37dOpkVV_Sz719tlbsRbd6NrVyS_UwlwETOxWFhDm88" (and 1 more) found at
   _acme-challenge.sample.org

That was the first record, the second had exactly what the actual acme-challenge was.

jeansergegagnon commented 2 years ago

Thanks for question.

I'm not really sure why there would be 3 TXT records, I'll have to check.

Do you think it's my script that created the 2nd record?

On Mon., Feb. 28, 2022, 3:35 p.m. René Berber, @.***> wrote:

Hi & thanks for your scripts.

I was trying to renew my certificate and it failed. I went to check the SPF TXT record which seemed to be causing the error you mention but I saw 2 TXT _acme-challenge records, which seems odd but I thought perhaps I left an old one.

I deleted both of those, kept my SPF and retried. This time the script worked fine.

The question is a the subject above, why create 2 different records? Or more to the point, why is one of those making the script fail.

Actually the log did show exactly that:

Domain: sample.org Type: unauthorized Detail: Incorrect TXT record "37dOpkVV_Sz719tlbsRbd6NrVyS_UwlwETOxWFhDm88" (and 1 more) found at _acme-challenge.sample.org

That was the first record, the second had exactly what the actual acme-challenge was.

— Reply to this email directly, view it on GitHub https://github.com/jeansergegagnon/zoneedit_letsencrypt/issues/14, or unsubscribe https://github.com/notifications/unsubscribe-auth/ADCAF7672AOVTMWHGZCTKXTU5PFAVANCNFSM5PR7TOEQ . Triage notifications on the go with GitHub Mobile for iOS https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675 or Android https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub.

You are receiving this because you are subscribed to this thread.Message ID: @.***>

rb07 commented 2 years ago

Yes. There are 2 new records after successfully running the script.

jeansergegagnon commented 2 years ago

Oh, the 2 TXT acme are because there's two verifications done by letsencrypt - I'm not sure if they both need to stay there, but I've always kept the 2 there myself.

As for the SPF issue I mentioned, I thought it was fixed although you say you had an issue, so maybe not.

Let me know if you still have issue next time to renew

On Mon, Feb 28, 2022 at 3:42 PM René Berber @.***> wrote:

Yes. There are 2 new records after successfully running the script.

— Reply to this email directly, view it on GitHub https://github.com/jeansergegagnon/zoneedit_letsencrypt/issues/14#issuecomment-1054598819, or unsubscribe https://github.com/notifications/unsubscribe-auth/ADCAF7ZV7GXV2NDT3UWLRALU5PFYZANCNFSM5PR7TOEQ . Triage notifications on the go with GitHub Mobile for iOS https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675 or Android https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub.

You are receiving this because you commented.Message ID: @.***>

rb07 commented 2 years ago

OK, thanks.

If I remember correctly, only the first time there is a need for 2 verifications, but when I've done it manually I just changed the single record. Also there should be no problem with several TXT records, but I don't remember seeing it in use before. What seems important is the log message.

There were no SPF issues as far as I can see. The html output shows that message but I think its part of the page, not the actual error message.