ACME propagation time too long and DNS validation fails : how to raise the timeout value ?

[palijn]

Hello,
I'm trying to generate a certificate with ACME, Let's Encrypt, DNS validation.
DNS Servers : DeSec.io
The TXT records are correctly created at the zone level.
However, they seem to take too much time to propagate, then the procedure fails and I don't get my certificate.

Is there any way to set the timeout to some higher value ?

Thanks for your help !

Note: I've tried setting up the container's resolver DNS servers to "faster" ones but it still fails. Setting the DNS servers to DeSec.io servers does allow the TXT validation to succeed, but they don't allow recursive resolve, and the script still fails because it cannot connect to the letsencrypt servers.

[jwgn]

Same issue here. On Proxmox, I had to increase the timeout to get it working. How do I increase the timeout in Zoraxy?

[tobychui]

@jwgn You cant. Maybe you can create an enhancement request for adding a customize timeout function in ACME option? If you create a discussion instead of a feature request, I guess most contributors will not get the notification and will not have notice this feature is missing. (For example I just notice this discussion exists when you replied to it :P )

[jwgn]

#300

[tunip]

Should work as an environment variable in Zoraxy.

https://go-acme.github.io/lego/dns/desec/index.html

DESEC_POLLING_INTERVAL | Time between DNS propagation check
DESEC_PROPAGATION_TIMEOUT | Maximum waiting time for DNS propagation
DESEC_TTL | The TTL of the TXT record used for the DNS challenge

EDIT:
I tested it with Zoraxy and Cloudflare in Docker and I am able to influence these TTL, PROPAGATION_TIMEOUT & POLLING_INTERVAL values (the Cloudflare related ones of course).

[jwgn]

Looks good, how do we pass these variables to zoraxy during certificate request?

[tunip]

Docker:

services:
  zoraxy:
    image: zoraxydocker/zoraxy:latest
    container_name: zoraxy
    restart: unless-stopped
    ports:
      - 80:80
      - 443:443
      - 8000:8000
    volumes:
      - /appdata/zoraxy:/opt/zoraxy/config/
      - /var/run/docker.sock:/var/run/docker.sock
    environment:
      DESEC_POLLING_INTERVAL: "15"
      DESEC_PROPAGATION_TIMEOUT: "900"
      DESEC_TTL: "900"

CLI:

export DESEC_POLLING_INTERVAL="15"
export DESEC_PROPAGATION_TIMEOUT="900"
export DESEC_TTL="900"
./zoraxy -port=:8000 -webroot=/my/awesome/website ...

Systemd:

[Service]
Environment="DESEC_POLLING_INTERVAL=15"
Environment="DESEC_PROPAGATION_TIMEOUT=900"
Environment="DESEC_TTL=900"
ExecStart=/path/to/zoraxy -port=:8000 -webroot=/my/awesome/website ...

[jwgn]

Environment="DESEC_POLLING_INTERVAL=15"
Environment="DESEC_PROPAGATION_TIMEOUT=900"

Works, thanks!

Environment="DESEC_TTL=900"

This is not valid for deSEC, it has to be 3600 minimum.