Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

selectelv2: fix non-ASCII domain #2322

Merged
merged 2 commits into from
Nov 6, 2024
Merged

selectelv2: fix non-ASCII domain #2322

merged 2 commits into from
Nov 6, 2024

Conversation

Archirk
Copy link
Contributor

@Archirk Archirk commented Nov 6, 2024

We have discovered trouble with issuing certs for non-ascii domains. This small PR fixes it.

  • Convert retrieved zone and record names to ASCII since API returns them in Unicode, which leads to failed DNS challenge, since zone and records can not be found
  • Update env names in doc example

Here is run with next setup

#!/bin/bash
SELECTELV2_USERNAME=*** \
SELECTELV2_PASSWORD=***\
SELECTELV2_ACCOUNT_ID=*** \
SELECTELV2_PROJECT_ID=*** \
./dist/lego \
--dns selectelv2 \
--email ***@gmail.com \
-d project-scribbler.art \
-d *.project-scribbler.art \
-d вонни.рф \
-d *.вонни.рф \
run
[14:34] chirkov@chirkov: ~/Repositories/github/lego
$> rm -rf .lego
[14:36] chirkov@chirkov: ~/Repositories/github/lego
$> bash ./test.sh
2024/11/06 14:37:11 No key found for account ***@gmail.com. Generating a P256 key.
2024/11/06 14:37:11 Saved key to /home/chirkov/Repositories/github/lego/.lego/accounts/acme-v02.api.letsencrypt.org/***@gmail.com/keys/***@gmail.com.key
2024/11/06 14:37:11 Please review the TOS at https://letsencrypt.org/documents/LE-SA-v1.4-April-3-2024.pdf
Do you accept the TOS? Y/n
y
2024/11/06 14:37:13 [INFO] acme: Registering account for ***@gmail.com
!!!! HEADS UP !!!!

Your account credentials have been saved in your Let's Encrypt
configuration directory at "/home/chirkov/Repositories/github/lego/.lego/accounts".

You should make a secure backup of this folder now. This
configuration directory will also contain certificates and
private keys obtained from Let's Encrypt so making regular
backups of this folder is ideal.
2024/11/06 14:37:14 [INFO] [project-scribbler.art, *.project-scribbler.art, xn--b1amoad.xn--p1ai, *.xn--b1amoad.xn--p1ai] acme: Obtaining bundled SAN certificate
2024/11/06 14:37:15 [INFO] [*.project-scribbler.art] AuthURL: https://acme-v02.api.letsencrypt.org/acme/authz-v3/426353287357
2024/11/06 14:37:15 [INFO] [*.xn--b1amoad.xn--p1ai] AuthURL: https://acme-v02.api.letsencrypt.org/acme/authz-v3/426353287367
2024/11/06 14:37:15 [INFO] [project-scribbler.art] AuthURL: https://acme-v02.api.letsencrypt.org/acme/authz-v3/426353287377
2024/11/06 14:37:15 [INFO] [xn--b1amoad.xn--p1ai] AuthURL: https://acme-v02.api.letsencrypt.org/acme/authz-v3/426353287387
2024/11/06 14:37:15 [INFO] [*.project-scribbler.art] acme: use dns-01 solver
2024/11/06 14:37:15 [INFO] [*.xn--b1amoad.xn--p1ai] acme: use dns-01 solver
2024/11/06 14:37:15 [INFO] [xn--b1amoad.xn--p1ai] acme: Could not find solver for: tls-alpn-01
2024/11/06 14:37:15 [INFO] [xn--b1amoad.xn--p1ai] acme: Could not find solver for: http-01
2024/11/06 14:37:15 [INFO] [xn--b1amoad.xn--p1ai] acme: use dns-01 solver
2024/11/06 14:37:15 [INFO] [project-scribbler.art] acme: Could not find solver for: tls-alpn-01
2024/11/06 14:37:15 [INFO] [project-scribbler.art] acme: Could not find solver for: http-01
2024/11/06 14:37:15 [INFO] [project-scribbler.art] acme: use dns-01 solver
2024/11/06 14:37:15 [INFO] [*.project-scribbler.art] acme: Preparing to solve DNS-01
2024/11/06 14:37:16 [INFO] Found CNAME entry for "_acme-challenge.project-scribbler.art.": "project-scribbler.art."
2024/11/06 14:37:18 [INFO] [*.xn--b1amoad.xn--p1ai] acme: Preparing to solve DNS-01
2024/11/06 14:37:19 [INFO] Found CNAME entry for "_acme-challenge.xn--b1amoad.xn--p1ai.": "xn--b1amoad.xn--p1ai."
2024/11/06 14:37:26 [INFO] [xn--b1amoad.xn--p1ai] acme: Preparing to solve DNS-01
2024/11/06 14:37:26 [INFO] Found CNAME entry for "_acme-challenge.xn--b1amoad.xn--p1ai.": "xn--b1amoad.xn--p1ai."
2024/11/06 14:37:28 [INFO] [project-scribbler.art] acme: Preparing to solve DNS-01
2024/11/06 14:37:28 [INFO] Found CNAME entry for "_acme-challenge.project-scribbler.art.": "project-scribbler.art."
2024/11/06 14:37:30 [INFO] [*.project-scribbler.art] acme: Trying to solve DNS-01
2024/11/06 14:37:30 [INFO] Found CNAME entry for "_acme-challenge.project-scribbler.art.": "project-scribbler.art."
2024/11/06 14:37:30 [INFO] [*.project-scribbler.art] acme: Checking DNS record propagation. [nameservers=127.0.0.53:53]
2024/11/06 14:37:35 [INFO] Wait for propagation [timeout: 2m0s, interval: 5s]
2024/11/06 14:38:04 [INFO] [*.project-scribbler.art] The server validated our request
2024/11/06 14:38:04 [INFO] [*.xn--b1amoad.xn--p1ai] acme: Trying to solve DNS-01
2024/11/06 14:38:04 [INFO] Found CNAME entry for "_acme-challenge.xn--b1amoad.xn--p1ai.": "xn--b1amoad.xn--p1ai."
2024/11/06 14:38:04 [INFO] [*.xn--b1amoad.xn--p1ai] acme: Checking DNS record propagation. [nameservers=127.0.0.53:53]
2024/11/06 14:38:09 [INFO] Wait for propagation [timeout: 2m0s, interval: 5s]
2024/11/06 14:38:15 [INFO] [*.xn--b1amoad.xn--p1ai] The server validated our request
2024/11/06 14:38:15 [INFO] [xn--b1amoad.xn--p1ai] acme: Trying to solve DNS-01
2024/11/06 14:38:15 [INFO] Found CNAME entry for "_acme-challenge.xn--b1amoad.xn--p1ai.": "xn--b1amoad.xn--p1ai."
2024/11/06 14:38:15 [INFO] [xn--b1amoad.xn--p1ai] acme: Checking DNS record propagation. [nameservers=127.0.0.53:53]
2024/11/06 14:38:20 [INFO] Wait for propagation [timeout: 2m0s, interval: 5s]
2024/11/06 14:38:47 [INFO] [xn--b1amoad.xn--p1ai] The server validated our request
2024/11/06 14:38:47 [INFO] [project-scribbler.art] acme: Trying to solve DNS-01
2024/11/06 14:38:47 [INFO] Found CNAME entry for "_acme-challenge.project-scribbler.art.": "project-scribbler.art."
2024/11/06 14:38:47 [INFO] [project-scribbler.art] acme: Checking DNS record propagation. [nameservers=127.0.0.53:53]
2024/11/06 14:38:52 [INFO] Wait for propagation [timeout: 2m0s, interval: 5s]
2024/11/06 14:39:18 [INFO] [project-scribbler.art] The server validated our request
2024/11/06 14:39:18 [INFO] [*.project-scribbler.art] acme: Cleaning DNS-01 challenge
2024/11/06 14:39:19 [INFO] Found CNAME entry for "_acme-challenge.project-scribbler.art.": "project-scribbler.art."
2024/11/06 14:39:21 [INFO] [*.xn--b1amoad.xn--p1ai] acme: Cleaning DNS-01 challenge
2024/11/06 14:39:21 [INFO] Found CNAME entry for "_acme-challenge.xn--b1amoad.xn--p1ai.": "xn--b1amoad.xn--p1ai."
2024/11/06 14:39:28 [INFO] [xn--b1amoad.xn--p1ai] acme: Cleaning DNS-01 challenge
2024/11/06 14:39:28 [INFO] Found CNAME entry for "_acme-challenge.xn--b1amoad.xn--p1ai.": "xn--b1amoad.xn--p1ai."
2024/11/06 14:39:29 [INFO] [project-scribbler.art] acme: Cleaning DNS-01 challenge
2024/11/06 14:39:30 [INFO] Found CNAME entry for "_acme-challenge.project-scribbler.art.": "project-scribbler.art."
2024/11/06 14:39:32 [INFO] [project-scribbler.art, *.project-scribbler.art, xn--b1amoad.xn--p1ai, *.xn--b1amoad.xn--p1ai] acme: Validations succeeded; requesting certificates
2024/11/06 14:39:33 [INFO] [project-scribbler.art] Server responded with a certificate.

@aidansteele

* Convert retrieved zone and record names to ASCII
  since API returns them in Unicode, which leads to
  failed DNS challenge, since zone and records can not be found
@ldez ldez changed the title Fix selectelv2 provider selectelv2: fix non-ASCII domain Nov 6, 2024
@ldez ldez self-requested a review November 6, 2024 12:25
Copy link
Member

@ldez ldez left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@ldez ldez merged commit 40bf2b0 into go-acme:master Nov 6, 2024
7 checks passed
usarise added a commit to usarise/lego that referenced this pull request Nov 12, 2024
* volcengine: set API information within the default configuration (go-acme#2308)

Co-authored-by: Fernandez Ludovic <ldez@users.noreply.github.com>

* limacity: fix error message (go-acme#2310)

* Add DNS provider for Core-Networks (go-acme#2101)

* chore: update readme generator (go-acme#2311)

* chore: fix readme generator (go-acme#2312)

* chore: embed templates for internal commands (go-acme#2314)

* chore: improve internal release command (go-acme#2315)

* fix: parse printf verbs in log line output (go-acme#2317)

* Add DNS provider for Regfish (go-acme#2320)

* chore: update dependencies (go-acme#2321)

* selectelv2: fix non-ASCII domain (go-acme#2322)

Co-authored-by: Fernandez Ludovic <ldez@users.noreply.github.com>

* brandit: provider deprecation (go-acme#2116)

* cloudxns: provider deprecation (go-acme#2324)

* chore: update issue templates

* docs: use homogenous examples (go-acme#2328)

* regru: update authentication method (go-acme#2325)

* rfc2136: add support for tsig-keygen generated file (go-acme#2330)

Co-authored-by: Dominik Menke <git@dmke.org>

* Add DNS provider for Technitium (go-acme#2332)

* feat: skip the TLS verification of the ACME server (go-acme#2335)

* docs: add documentation for env var only options (go-acme#2337)

* docs: update least privilege instructions for Cloudflare (go-acme#2339)

* feat: attempt to check ARI unless explicitly disabled (go-acme#2298)

Co-authored-by: Fernandez Ludovic <ldez@users.noreply.github.com>

* chore: domain merge simplification (go-acme#2340)

* chore: update linter (go-acme#2341)

* Prepare release v4.20.0

* Detach v4.20.0

* Prepare release v4.20.1

* Detach v4.20.1

* Prepare release v4.20.2

* Detach v4.20.2

* fix: HTTP server IPv6 matching (go-acme#2345)

* docs: improve changelog style (go-acme#2346)

* docs: fix typos

---------

Co-authored-by: 刘瑞斌 <bin@fit2cloud.com>
Co-authored-by: Fernandez Ludovic <ldez@users.noreply.github.com>
Co-authored-by: Dominik Menke <dom@digineo.de>
Co-authored-by: Frederic Hemberger <fhemberger@users.noreply.github.com>
Co-authored-by: Artem Chirkov <45077592+Archirk@users.noreply.github.com>
Co-authored-by: Maksim Kamanin <79706809+tcaty@users.noreply.github.com>
Co-authored-by: Dominik Menke <git@dmke.org>
Co-authored-by: Josh McKinney <joshka@users.noreply.github.com>
Co-authored-by: Samantha Frank <hello@entropy.cat>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Development

Successfully merging this pull request may close these issues.

2 participants