fix _get_root() so that it successfully gets the root domain #3542
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The _acme-challenge TXT record is not getting created for subdomains like subdomain.example.com that are part of the same zone as example.com. The issue is at lines 207 and 208 in the
_get_root()
function. Usinghttps://management.1984hosting.com/domains/soacheck/?zone=subdomain.example.com&nameserver=ns0.1984.is.
returns a{"serial": null}
JSON response, instead of{"serial": $SOME_NUMBER}
response that valid zones would get. The if statement on line 208 only checks ifserial
is contained in the response. This results in_domain
getting assigned the valuesubdomain.example.com
and_sub_domain
getting assigned_acme-challenge
. There is no zonesubdomain.example.com
(not my real subdomain/domain, obviously) as my subdomain is part of the same zone my root domain is in. This results in the attempt to add a DNS record for the nonexistent zone predictably failing. (As an aside, if subdomain.example.com and example.com are separate zones, there is a possibilitydns_1984hosting.sh
would not fail to issue/renew certs for either zone in its currently broken state.) Changing the if statement to check if the response containsserial
and does NOT containnull
results in the while loop continuing until_domain
gets assigned the valueexample.com
and_sub_domain
gets assigned_acme-challenge.subdomain
. The final result is that the _acme-challenge TXT record actually gets set. This fix should also work for subdomains like foo.bar.subdomain.example.com and other URLs with larger/"deeper" subdomain depths where the root domain and subdomain are part of the same zone.I was able to renew my pfsense cert with my changes.
Earlier explanation of issue from #2851 (comment).