pan-net-security / certbot-dns-powerdns

PowerDNS DNS Authenticator plugin for Certbot
25 stars 16 forks source link

TXT Record Name Incorrect #1

Closed dresch86 closed 5 years ago

dresch86 commented 5 years ago

I am giving this plugin a try, but I think something is wrong. The name of TXT record is supposed to be "_acme-challenge.the.domain.com" but the name of record is only "_acme-challenge" therefore failing the DNS validation. I am trying to create a cert for my primary domain and a wildcard at the same time.

sudo certbot certonly --authenticator certbot-dns-powerdns:dns-powerdns --certbot-dns-powerdns:dns-powerdns-credentials /etc/letsencrypt/pdns-credentials.ini -d mydomain.com -d "*.mydomain.com" --dry-run

Update #1: Actually I am not sure the above is the problem. The error I am getting suggests the TXT record has the wrong token in it....Here is verbose debug:

{
  "identifier": {
    "type": "dns",
    "value": "mydomain.com"
  },
  "status": "valid",
  "expires": "2019-05-17T04:06:41Z",
  "challenges": [
    {
      "type": "dns-01",
      "status": "valid",
      "url": "https://acme-staging-v02.api.letsencrypt.org/acme/challenge/ALNUM/ACCT",
      "token": "TOKEN-1",
      "validationRecord": [
        {
          "hostname": "mydomain.com"
        }
      ]
    },
    {
      "type": "tls-alpn-01",
      "status": "pending",
      "url": "https://acme-staging-v02.api.letsencrypt.org/acme/challenge/ALNUM/ACCT",
      "token": "TOKEN-2"
    },
    {
      "type": "http-01",
      "status": "pending",
      "url": "https://acme-staging-v02.api.letsencrypt.org/acme/challenge/ALNUM/ACCT",
      "token": "TOKEN-3"
    }
  ]
}
.....
   Domain: mydomain.com
   Type:   unauthorized
   Detail: Incorrect TXT record
   "SOME-OTHER-TOKEN" found at
   _acme-challenge.mydomain.com

Update #2: Ok, so if I try to grab the certs one at a time that works! The problem however is I want to SSL the primary domain (mydomain.com) AND the wildcard for subdomains. I guess the TXT record is getting replaced before validation for the first domain is done thus it is an "incorrect TXT record."