Update dns api to support v2 wildcard cert #1261

Neilpang · 2018-02-13T11:47:22Z

Neilpang · 2018-02-13T11:50:02Z

@wpk- Please update the rm function of dns_ad hook.

Neilpang · 2018-02-13T11:52:14Z

@baiyangliu please support the rm function for dns_ali hook.

Neilpang · 2018-02-13T11:55:19Z

@martgras please make sure dns_azure hook works in this way.

Neilpang · 2018-02-13T11:57:58Z

@boyanpeychev please update dns_cloudns hook

boyanpeychev · 2018-02-14T11:15:36Z

@Neilpang please accept this pull request and I will proceed with the wildcard implementation:
#1094

Neilpang · 2018-02-14T11:23:24Z

@boyanpeychev accepted, please go ahead.

Neilpang · 2018-02-14T11:48:13Z

@pho3nixf1re please update dns_dnsimple hook

Neilpang · 2018-02-14T11:50:46Z

@dkerr64 please update dns_freedns.sh

Neilpang · 2018-02-14T11:59:35Z

@fcrozat please update dns_gandi_livedns.sh

Neilpang · 2018-02-14T12:05:05Z

@justmwa please update dns_me.sh

Neilpang · 2018-02-14T12:06:58Z

@justmwa please also update dns_nsone.sh

Neilpang · 2018-02-14T12:09:08Z

@magna-z please update dns_pdns.sh

Neilpang · 2018-02-14T12:10:55Z

@Aarup please update dns_unoeuro.sh

drybalkadk · 2018-02-14T15:49:49Z

aws work. Thanks a lot

martgras · 2018-02-14T16:12:19Z

I don't think any changes are needed but will double check next week when I'm back

…

________________________________ From: drybalkadk <notifications@github.com> Sent: Wednesday, February 14, 2018 4:49:57 PM To: Neilpang/acme.sh Cc: Martin Grasruck; Mention Subject: Re: [Neilpang/acme.sh] Update dns api to support v2 wildcard cert (#1261) aws work. Thanks a lot — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub<#1261 (comment)>, or mute the thread<https://github.com/notifications/unsubscribe-auth/AYjgXW3X7a88xrFvZiuuvKzzoVXrt3oaks5tUwCkgaJpZM4SDoO5>.

Neilpang · 2018-02-15T02:46:47Z

@martgras thank you.

boyanpeychev · 2018-02-16T14:41:29Z

no changes needed for dns_cloudns.sh

Neilpang · 2018-02-17T01:57:56Z

@boyanpeychev There is an updating logic in the dns_cloudns_add() function.
Are you sure no changes are needed there?

Please make sure this case is passing:

acme.sh  --issue --test  -d example.com  -d *.example.com

justmwa · 2018-02-17T07:47:09Z

Works as is because there's only one TXT sent from what I can see in logs. And since LE accepts it, they changed their mind about the double TXT record ?

justmwa · 2018-02-17T08:08:27Z

Message to those who think it works "as is", try with a subdomain ;) (unless it's not officially supported?)
i.e foo.example.com. Actually it's only an issue with one API so far, need to dig further.

Neilpang · 2018-02-17T11:32:25Z

@justmwa no, never.
please use a new domain to test.

acme.sh --issue  -d  sub.domain.com  -d *.sub.domain.com

martgras · 2018-02-18T15:52:18Z

Fixed the Azure hook only 1 DNS record was added: #1287

boyanpeychev · 2018-02-19T09:11:36Z

@Neilpang, yes, it is tested with completely new domain and sub-domain for Let's Encrypt and it works both for the root domain name and with a sub-domain. The records are added successfully.

However, I do see one problem not related to the cloudns.net api - sometimes the given token is not accepted by Let's Encrypt, even it is resolved absolutely properly. Here is example log:
test.log

The TXT records requested to be added is with token: GUFN5HSXlmothHwsZWbCZW-SfgCaQYCTTB874fZ6Ijw
The same token is found by Let's Encrypt, but reported as invalid. Please check you too.

martgras · 2018-02-19T10:03:28Z

I don't understand the cloudns api well enough but I suspect you run into the the same problem I had with Azure in #1287
Instead of creating 2 txt entries my code was first creating
_acme-challenge.test.cloudns.biz. 10 IN TXT "DyLeOblvCb1I9DqZ2BlB0fdQYsA3or4WVdZN139KaHg" and then the second call to dns_azure_add changed this txt record to
_acme-challenge.test.cloudns.biz. 10 IN TXT "GUFN5HSXlmothHwsZWbCZW-SfgCaQYCTTB874fZ6Ijw"

therefore the validation failed
Make sure you really create 2 entries instead of updating the existing one

Basically I have to use a Json body like this for the Azure DNS REST API call

{
    "properties": {
        "TTL": 10,
        "TXTRecords": [
            {   "value": ["DyLeOblvCb1I9DqZ2BlB0fdQYsA3or4WVdZN139KaHg"] },
            {   "value": ["GUFN5HSXlmothHwsZWbCZW-SfgCaQYCTTB874fZ6Ijw"]  }
        ]
    }
}

you should see something like this when checking with dig

dig -t txt _acme-challenge.test.cloudns.biz
_acme-challenge.test.cloudns.biz. 10 IN TXT "DyLeOblvCb1I9DqZ2BlB0fdQYsA3or4WVdZN139KaHg"
_acme-challenge.test.cloudns.biz. 10 IN TXT "GUFN5HSXlmothHwsZWbCZW-SfgCaQYCTTB874fZ6Ijw"

boyanpeychev · 2018-02-19T12:19:45Z

Thanks for the hint. Fixed. Pull request submitted.

Neilpang · 2018-02-19T12:43:12Z

@boyanpeychev It's not enough yet.
In the rm() function, you must remove the record by the exact txt value.
In the rm() function:

record_id=$(_dns_cloudns_get_record_id "$zone" "$host")

But the _dns_cloudns_get_record_id() function seems not considering the txt value.

martgras · 2018-02-19T12:53:42Z

@Neilpang the same is true for Azure but why does it matter?

first call to dns_azure_rm :
DELETE https://management.azure.com/subscriptions/../dnszones/example.com/TXT/_acme-challenge.somesub1.test?api-version=2017-09-01
http response code 200

second call:
DELETE https://management.azure.com/subscriptions/../dnszones/example.com/TXT/_acme-challenge.somesub1.test?api-version=2017-09-01
http response code 204

so yes the first call removes the record already but I don't see the problem with this approach

Neilpang · 2018-02-19T12:57:35Z

@martgras Yes, it doesn't matter if it's only you that use the domain to verify the cert.
If there are multiple people validating the same domain, you may remove the txt domain from others.
Especially we will soon merge the support for dns alias mode: https://github.com/Neilpang/acme.sh/wiki/DNS-alias-mode

So, it's strongly recommended that you only remove the txt record added by you.

saymonz · 2018-10-09T12:12:57Z

mhhh ok. So the integration with GandiLiveDNS still needs work.
Thanks @zloster for your feedback. :-)

Using Gandi for a domain.tld & *.domain.tld cert. It works, but I have to launch acme.sh two times in "quick" burst : it fails first, and pass on second time. Same with renewal cron job.

tristanbes · 2018-10-09T12:14:27Z

same for us @saymonz using GandLiveDNS, it randomly fails, running it a second time "fixes" it.

dkerr64 · 2018-10-09T12:43:23Z

I ran into a similar problem with FreeDNS and had to code around it. Not sure if you are running into exactly the same reasons for the "required twice" but see comment in the code for dns_freedns.sh around line 59... https://github.com/Neilpang/acme.sh/blob/c31db83b26afa1468aa00aafd63c64f2c410811d/dnsapi/dns_freedns.sh#L59-L63

David

Gandi supports setting multiple entries by setting multiple array items for the rrset_values field in their API. Modify the dns_gandi_livedns.sh script so that it checks for existing entries, appends new ones if needed, and removes existing ones individually. This enabled wildcard certificate support on Gandi. Fixes the dns_gandi_livedns part of acmesh-official#1261. Tested for creating a multidomain, multiple wild-card certificate on Gandi and using a test script executing only the dns_gandi_livedns_add and dns_gandi_livedns_rm functions.

drott · 2019-01-04T21:59:15Z

dns_gandi_livedns

after the merge in 83a0407.

myelsukov · 2019-04-20T23:43:23Z

Hi there!

I am using https://dyn.com/ They support nsupdate method but they require both TXT records to be added in a single update. Basically, they do remove all matching records prior to adding the new ones.
I hacked acme.sh and dnsapi/dns_nsupdate.sh so they work for me, but the hack is pretty ugly, so I am ashamed to post it as a PR :)

In a nutshell: In the acme.sh.issue() I check if the API supports .*_multi_add command.
If the command is supported then in the for ventry in $ventries loop I am collecting an array of values instead of sending individual requests. Then I execute one API call after the loop and pass to the API the collected domain+txt pairs.

I wonder if acme gurus could properly implement the feature allowing adding several TXT records in one update session?

jahlives · 2019-05-07T07:55:54Z

I'm trying to get a wildcard certificate using dns_pdns
Logs tell me that two records are added

[Die Mai 7 09:41:24 CEST 2019] Found domain api file: /root/.acme.sh/dnsapi/dns_pdns.sh
[Die Mai 7 09:41:24 CEST 2019] Adding record
[Die Mai 7 09:41:25 CEST 2019] Found domain api file: /root/.acme.sh/dnsapi/dns_pdns.sh
[Die Mai 7 09:41:25 CEST 2019] Adding record

But as the dns server only shows one value I assume that dns_pdns is not ready for v2 wildcard certs. First post in this report shows dns_pdns not as fixed yet.
Does anyone have a working dns_pdns for v2 wildcard certificates?

output of acme.sh sez that the token is "not valid yet" and acme.sh waits for 10s to repeat the check and fails again (in a loop)

[Die Mai 7 09:53:01 CEST 2019] Checking REDACTED.ch for _acme-challenge.REDACTED.ch
[Die Mai 7 09:53:01 CEST 2019] Not valid yet, let's wait 10 seconds and check next one.

But according to the pdns server at least one record for _acme-challenge.REDACTED.ch does exist

jahlives · 2019-05-07T13:41:41Z

did some more diging in dns_pdns code. It seems to me that the script cannot get the list of already existing challenges as the pdns api uri only gives back a "500 Internal server error"

curl -X GET -H 'X-API-Key: MY_API_KEY' http://127.0.0.1:8081/api/v1/servers/localhost/zones/mydomain.tld

Any pdns user here who can verify if that URI still works or not? I'm using pdns server 4.1.8
It's the only query that does not work so far. All others seem to be fine

jahlives · 2019-05-07T18:26:46Z

dns_pdns is finally working fine. Was never a acme problem but one with the pdns server. We use mysql backend for pdns and our frontend application inserts TXT records like this
v=spf1 mx -all
pdns server then packs the string into " and " before returning it in queries to clients. But the API interface does not perform this step and then sees incorrect TXT records in the zone and therefore the API endpoint returns with the server error. Which leads acme.sh to the assumption that no other challenge exists in the zone.
Long story short: if using pdns with mysql backend one has to ensure that TXT records are inserted like this
"v=spf1 mx -all"
then pdns api is happy

@Neilpang
from my point of view dns_pdns works correctly with LE v2 wildcard certificates.

Neilpang · 2019-05-08T14:15:15Z

@jahlives Thanks.

phedoreanu · 2020-04-10T21:43:37Z

dns_1984hosting

after merging #2852.

The IONOS DNS API is in beta state, please read [1] on how to get started. PLEASE NOTE: The v2 wildcard certification creation [2] is not yet supported as the IONOS API doesn't allow the creation of multiple TXT records with the same domain name. [1] https://beta.developer.hosting.ionos.de/docs/getstarted [2] acmesh-official#1261

Djelibeybi · 2021-08-10T16:38:51Z

dns_oci

GreenUkr · 2022-03-06T09:56:36Z

The same issue (acme.sh --issue --test -d example.com -d *.example.com got error trying to create existent value istead of add key to it) with dns_nsone
Correct it if possible, please.

Neilpang added the bug label Feb 13, 2018

boyanpeychev added a commit to ClouDNS/acme.sh that referenced this issue Feb 19, 2018

Update dns api to support v2 wildcard cert acmesh-official#1261

41e3eca

drott mentioned this issue Dec 28, 2018

[dnsapi] Support adding / removing multiple TXT values for Gandi #1994

Merged

Neilpang mentioned this issue Jan 8, 2019

Native PointHQ API #2012

Merged

This was referenced Jan 22, 2019

Add DNS API support for Nexcess, Thermo.io, and Futurehosting #1812

Closed

Added dns_doapi.sh #2053

Merged

Neilpang mentioned this issue Mar 11, 2019

Add zone.ee (zone.eu) DNS API #2151

Merged

Neilpang pinned this issue Apr 11, 2019

Neilpang unpinned this issue Jul 2, 2019

ArminXG mentioned this issue May 4, 2020

Report Bugs to Schlundtech.de DNS API #2246

Open

Hativ mentioned this issue Dec 19, 2020

dns_pdns doesn't work with wildcard domain #3311

Closed

lbrocke mentioned this issue Dec 24, 2020

Ionos DNS API #3284

Open

Update dns api to support v2 wildcard cert #1261

Update dns api to support v2 wildcard cert #1261

Comments

Neilpang commented Feb 13, 2018 • edited Loading

Neilpang commented Feb 13, 2018

Neilpang commented Feb 13, 2018

Neilpang commented Feb 13, 2018

Neilpang commented Feb 13, 2018

boyanpeychev commented Feb 14, 2018 • edited Loading

Neilpang commented Feb 14, 2018

Neilpang commented Feb 14, 2018

Neilpang commented Feb 14, 2018

Neilpang commented Feb 14, 2018

Neilpang commented Feb 14, 2018

Neilpang commented Feb 14, 2018

Neilpang commented Feb 14, 2018

Neilpang commented Feb 14, 2018

drybalkadk commented Feb 14, 2018

martgras commented Feb 14, 2018 via email

Neilpang commented Feb 15, 2018

boyanpeychev commented Feb 16, 2018

Neilpang commented Feb 17, 2018

justmwa commented Feb 17, 2018

justmwa commented Feb 17, 2018 • edited Loading

Neilpang commented Feb 17, 2018

martgras commented Feb 18, 2018

boyanpeychev commented Feb 19, 2018

martgras commented Feb 19, 2018 • edited Loading

boyanpeychev commented Feb 19, 2018

Neilpang commented Feb 19, 2018

martgras commented Feb 19, 2018

Neilpang commented Feb 19, 2018

saymonz commented Oct 9, 2018 • edited Loading

tristanbes commented Oct 9, 2018

dkerr64 commented Oct 9, 2018 • edited Loading

drott commented Jan 4, 2019

myelsukov commented Apr 20, 2019

jahlives commented May 7, 2019

jahlives commented May 7, 2019 • edited Loading

jahlives commented May 7, 2019

Neilpang commented May 8, 2019

phedoreanu commented Apr 10, 2020

Djelibeybi commented Aug 10, 2021

GreenUkr commented Mar 6, 2022

Neilpang commented Feb 13, 2018 •

edited

Loading

boyanpeychev commented Feb 14, 2018 •

edited

Loading

justmwa commented Feb 17, 2018 •

edited

Loading

martgras commented Feb 19, 2018 •

edited

Loading

saymonz commented Oct 9, 2018 •

edited

Loading

dkerr64 commented Oct 9, 2018 •

edited

Loading

jahlives commented May 7, 2019 •

edited

Loading