Retrieval of an LE wildcard certificate not possible

[dwydler]

Hello everyone,
I have a laboratory environment at home. I use the domain test2.test1.domain.com there. I also registered the domain domain.com to go with it. I manage the DNS entries for the domain via desec.io.

Now I would like to switch from Nginx Proxy Manager to zoraxy. To do this I need a wildcard certificate *.test2.test1.domain.com on zoraxy. I would like to access this via the zoraxy UI.

When retrieving I get the following error message:
Error: one or more domains had a problem: [*.test2.test1.domain.com] [*.test2.test1.domain.com] acme: error presenting token: desec: failed to create records: domainName=test2.test1.domain.com, recordName=_acme-challenge: 404: Not found. [test2.test1.domain.com] [test2.test1.domain.com] acme: error presenting token: desec: failed to create records: domainName=test2.test1.domain.com, recordName=_acme-challenge: 404: Not found.

The log file contains the following entries:
[2024-11-03 17:56:39.086867] [ACME] [system:info] Obtaining certificate for: test2.test1.domain.com, *.test2.test1.domain.com [2024-11-03 17:56:39.086890] [ACME] [system:info] Using https://acme-v02.api.letsencrypt.org/directory for CA Directory URL [2024-11-03 17:56:45.734496] [ACME] [system:error] Obtain certificate failed: error: one or more domains had a problem: [*.test2.test1.domain.com] [*.test2.test1.domain.com] acme: error presenting token: desec: failed to create records: domainName=test2.test1.domain.com, recordName=_acme-challenge: 404: Not found. [test2.test1.domain.com] [test2.test1.domain.com] acme: error presenting token: desec: failed to create records: domainName=test2.test1.domain.com, recordName=_acme-challenge: 404: Not found.

There is a matching CAA entry in the DNS zone at desec.io for the domain test2.test1.domain.com. I rule this out as a source of error because NPM can retrieve the wildcard certificate without any problems. There are no other entries there because the zone is only used in the laboratory.

Is the retrieval of LE wildcard certificates via DNS-01 challenge already supported?

/Daniel

[tobychui]

Hi @dwydler,

domainName=test2.test1.domain.com, recordName=_acme-challenge: 404: Not found.

From this error message, I think there are some routing issues regarding your test2.test1.domain.com where LE cannot reach your Zoraxy via this domain, which means this request actions seems to be using http-01 challenge instead.

Although I am not the ACME module maintainer, but as I recall, you will need to do http-01 and dns-01 challenge separately. Have you tried request certificate for two time, each with just one domain?

[dwydler]

where LE cannot reach your Zoraxy via this domai

Correct. That is what is intended. That is why we use the dns-01 challenge

via this domain, which means this request actions seems to be using http-01 challenge instead.

Why is the http-01 challenge used? As you can see in the screenshot, the parameter "DNS challenge" is set.

but as I recall, you will need to do http-01 and dns-01 challenge separately

I would like to use dns-01 challenge exclusively. Therefore, I have enabledd the "DNS challenge" parameter and inserted an API token. What else do I need to consider here?

[tobychui]

@dwydler Have you tried apply the two domains separately using DNS challenge? I am thinking this might be a bug in the logic in the comma detection algorithm and the ACME handle thinks this is a http-01 challenge domain,

@yeungalan Can you take a look on this?

[dwydler]

Have you tried apply the two domains separately using DNS challenge?

Yes, i tested it already. The same issue with the same error message.

[dwydler]

Any news to this issue?

[tobychui]

I am not an expert in the ACME protocol. What I can do is pinging the ACME module author for you @yeungalan