Incompatible with wildcards #1
Comments
|
Hi, |
|
Hi @Levinus |
|
Afaik it does. See this document from the servercow knowledgebase. If you look at the pyhton snippet above, you can see that I just add all values to an array. |
|
Any update on the issue? |
As discussed here (jhartlep#1) validating wildcard domains requires multiple acme challenges as TXT records with the same name to be set in domain. Servercow's Domain API v1 replaces a TXT entry if another TXT entry with the same name is sent. To set multiple TXT records with the same name Servercow's Domain API v1 needs all of them in one request. To accomplish this a simple Key=Value Cache is needed, so that consecutive requests include acme-Challanges of previous requests. I didn't see any other solution to cache acme-challanges than using a cache file because of acme.sh's plugin design... Greatest downside of my solution is that it requires BASH and doesn't work with posix SH which makes it impossible to add it to acme.sh official plugins according to their dev guidelines (https://github.com/Neilpang/acme.sh/wiki/DNS-API-Dev-Guide)... I may look into this later but as of now I am satisfied with my solution because I don't need posix SH support. I tested it against staging and production servers with and without wildcards and multiple subdomains. I know my solution isn't perfect but it should work (at least in BASH environments) and I wanted to share it with you!
|
#acmesh-official/acme.sh#3449 |
|
Somehow this again is an issue. Trying to issue a cert for '*.mydomain.com' and mydomain.com, but I always get the following error:
Using acme.sh v3.0.1 on Debian Buster with NGinx 1.21.3 (from nginx.org) Setup worked before flawlessly (acme.sh 2.8.6 for long time), but now I wasn't able to get a wildcard cert - got only the mydomain.com cert when issueing it alone Happy to help track this down - pls let me know if I can be of help. |
|
I'll have a look at it in the next few days and make some improvements. But I can't promise anything, I'm a bit busy right now. |
|
Some more infos: Apparently acme.sh now tries to create ECC keys, too, by default, and those have other keylengths. In my opinion this is an error in acme.sh, of course. Trying to issue an RSA key by command line options should be possible, I'd say, but I didn't find a way. So I tried to issue a new combined cert from the backup of the old CSR: Here's the log: |
Not trying to push - any advances with this? |
Hey,
the script does not work for me anymore when requesting wildcards from LE. If I want to get a cert for example.org and *.example.org LE will use two separate challenges and also two different TXT record values for this. acme.sh will call the script two times, one time for the base domain and the second time, with the same name but a different content, for the wildcard (https://community.letsencrypt.org/t/base-domain-validation/59009). The servercow API will override the first record when the script tries to place the second (see DNSAPIv1 documentation). content has to be an array to transfer multiple records with the same name. The script would have to get a list of all records and copy the existing ones into the content array.
In my python script for the API I solved it like this (get_record_list is self-explanatory..):
Maybe this is helpful. I'm not that experienced, esp with shell, that's why I didn't create a PR.
My current workaround is to use the manual mode or to first request a separate cert for each domain I wan't in my final cert and then issue my final cert. The successful challenges will be cached for some time.
The text was updated successfully, but these errors were encountered: