rmbolger / Posh-ACME

PowerShell module and ACME client to create certificates from Let's Encrypt (or other ACME CA)
https://poshac.me/docs/latest/
MIT License
755 stars 186 forks source link

Azure DNS Plugin - DnsAlias (challenge domain) cannot be the same as the DNS zone in Azure #348

Closed K-a-r-l closed 3 years ago

K-a-r-l commented 3 years ago

Unsure if the title explains it well, but here's what I mean:

If I have a DNZ zone in Azure "validation.example.com" then I cannot set the -DnsAlias value to "validation.example.com" it must (currently) be a non root zone record, for example _acme-challenge.validation.example.com.

Reason for the issue:

The management API expects a PUT in the format:

[https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/dnsZones/{zoneName}/{recordType}/**{relativeRecordSetName}**?api-version=2018-05-01]()

Where the relativeRecordSetName value must be provided, and for the root of the zone this should be "@" (this doesn't seem well documented anywhere, but I made an assumption and it seemed to work in postman).

In the Get-AZTxtRecord function, the relativeRecordSetName ($relName) is set as below, so when DnsAlias is validation.example.com and the zone is validation.example.com, it gets set to a blank string.

$relName = ($RecordName -ireplace [regex]::Escape($zoneName), [string]::Empty).TrimEnd('.')
$recID = "$ZoneID/TXT/$($relName)"

Then when the management API is called in the Add-DnsTxt function (~line 71) it returns a 404 "Endpoint not found" error.

I guess a fix would be something like below added to the Get-AZTxtRecord function:

if([String]::IsNullOrWhiteSpace($relName)) 
{
    $relName = "@"
}

I really should learn how to git so I can provide a PR, sorry :D

rmbolger commented 3 years ago

Thanks for another great report. No worries on the lack of PR. This is actually a relatively common plugin bug that I'm surprised no one had noticed previously with Azure. And as you guessed, it should be a pretty easy fix. I'll try to get to it soon.

rmbolger commented 3 years ago

This should now be fixed in the main/dev branch and will be included in the next release.