Key name case sensitivity in RFC2136 challenge #1632

collimas · 2022-04-27T09:46:53Z

collimas
Apr 27, 2022

Hi, hope you can help me. I try to obtain a Let's Encrypt cert with LeGo in Windows Server 2019.

set RFC2136_TSIG_KEY=BITS
set RFC2136_TSIG_SECRET=xxxxxx__secret____==

Our existing TSIG key is named "BITS" in upper case letters. If I run my batch file, I get the following response:

acme: error presenting token: rfc2136: failed to insert: DNS update failed: dns: no secrets defined

If I try this:

set RFC2136_TSIG_KEY=bits

the response is:

 Could not obtain certificates:
        error: one or more domains had a problem:
[patch.hrz.uni-bielefeld.de] time limit exceeded: last error: NS dns-2.dfn.de. did not return the expected TXT record [fqdn: _acme-challenge.domain.tld., value: azpuvd2zuRa4GCG123456789N0GKRqS3fxJoFUgnu5E]:

Maybe there is a problem with the upper case name?

Answered by ldez

Apr 27, 2022

Hi,

I checked the RFC and I think there is a bug in our implementation.

I will fix that.

View full answer

ldez · 2022-04-27T10:42:42Z

ldez
Apr 27, 2022
Maintainer

Hi,

I checked the RFC and I think there is a bug in our implementation.

I will fix that.

6 replies

collimas Apr 27, 2022
Author

I'd like to do so, but I just downloaded the binary from the release page. I didn't compile it by myself. Can you compile a new binary for Windows x64 please?

ldez Apr 27, 2022
Maintainer

https://mega.nz/file/tjBWDSTK#T-44HUgxJe8-Yho5hmfuy4Xt8986aA91QJebyrIa64w

collimas Apr 27, 2022
Author

Still the same:

c:\zertifikate\lego>REM LeGo-Zertifikatsbeantragung mit Let's Encrypt
'algorithm' is not recognized as an internal or external command,
operable program or batch file.
2022/04/27 13:51:37 [INFO] [patch.hrz.uni-bielefeld.de] acme: Obtaining bundled SAN certificate
2022/04/27 13:51:37 [INFO] [patch.hrz.uni-bielefeld.de] AuthURL: https://acme-v02.api.letsencrypt.org/acme/authz-v3/102625581497
2022/04/27 13:51:37 [INFO] [patch.hrz.uni-bielefeld.de] acme: Could not find solver for: tls-alpn-01
2022/04/27 13:51:37 [INFO] [patch.hrz.uni-bielefeld.de] acme: Could not find solver for: http-01
2022/04/27 13:51:37 [INFO] [patch.hrz.uni-bielefeld.de] acme: use dns-01 solver
2022/04/27 13:51:37 [INFO] [patch.hrz.uni-bielefeld.de] acme: Preparing to solve DNS-01
2022/04/27 13:51:37 [INFO] [patch.hrz.uni-bielefeld.de] acme: Cleaning DNS-01 challenge
2022/04/27 13:51:37 [WARN] [patch.hrz.uni-bielefeld.de] acme: cleaning up failed: rfc2136: failed to remove: DNS update failed: dns: no secrets defined
2022/04/27 13:51:37 [INFO] Deactivating auth: https://acme-v02.api.letsencrypt.org/acme/authz-v3/102625581497
2022/04/27 13:51:38 Could not obtain certificates:
        error: one or more domains had a problem:
[patch.hrz.uni-bielefeld.de] [patch.hrz.uni-bielefeld.de] acme: error presenting token: rfc2136: failed to insert: DNS update failed: dns: no secrets defined
c:\zertifikate\lego>create_new_cert.bat
c:\zertifikate\lego>REM LeGo-Zertifikatsbeantragung mit Let's Encrypt
'algorithm' is not recognized as an internal or external command,
operable program or batch file.
2022/04/27 13:51:47 [INFO] [patch.hrz.uni-bielefeld.de] acme: Obtaining bundled SAN certificate
2022/04/27 13:51:48 [INFO] [patch.hrz.uni-bielefeld.de] AuthURL: https://acme-v02.api.letsencrypt.org/acme/authz-v3/102626047367
2022/04/27 13:51:48 [INFO] [patch.hrz.uni-bielefeld.de] acme: Could not find solver for: tls-alpn-01
2022/04/27 13:51:48 [INFO] [patch.hrz.uni-bielefeld.de] acme: Could not find solver for: http-01
2022/04/27 13:51:48 [INFO] [patch.hrz.uni-bielefeld.de] acme: use dns-01 solver
2022/04/27 13:51:48 [INFO] [patch.hrz.uni-bielefeld.de] acme: Preparing to solve DNS-01
2022/04/27 13:51:48 [INFO] [patch.hrz.uni-bielefeld.de] acme: Cleaning DNS-01 challenge
2022/04/27 13:51:48 [WARN] [patch.hrz.uni-bielefeld.de] acme: cleaning up failed: rfc2136: failed to remove: DNS update failed: dns: no secrets defined
2022/04/27 13:51:48 [INFO] Deactivating auth: https://acme-v02.api.letsencrypt.org/acme/authz-v3/102626047367
2022/04/27 13:51:48 Could not obtain certificates:
        error: one or more domains had a problem:
[patch.hrz.uni-bielefeld.de] [patch.hrz.uni-bielefeld.de] acme: error presenting token: rfc2136: failed to insert: DNS update failed: dns: no secrets defined

ldez Apr 27, 2022
Maintainer

'algorithm' is not recognized as an internal or external command, operable program or batch file.

can you provide the command line?

A new binary: https://mega.nz/file/0ngB3QRY#I-0xy9ufertaiqyg0BElEiv786ukXjoNx26I3aMZTYE

collimas Apr 27, 2022
Author

With "BITS". Here's my batch file:

REM LeGo-Zertifikatsbeantragung mit Let's Encrypt
@echo off
set RFC2136_NAMESERVER=129.70.182.7
set RFC2136_TSIG_ALGORITHM=hmac-sha512.
set RFC2136_TSIG_KEY=BITS
set RFC2136_TSIG_SECRET=secret
algorithm= hmac-sha512

set RFC2136_POLLING_INTERVAL=5
set RFC2136_PROPAGATION_TIMEOUT=300
set LEGO_EXPERIMENTAL_CNAME_SUPPORT=true

REM Original cert generation:
c:\zertifikate\lego\lego.exe -a --email="netadmin@uni-bielefeld.de" -d "patch.hrz.uni-bielefeld.de" --dns rfc2136 --path c:\zertifikate\letsencrypt run

collimas · 2022-04-27T12:44:08Z

collimas
Apr 27, 2022
Author

c:\zertifikate\lego>create_new_cert.bat

c:\zertifikate\lego>REM LeGo-Zertifikatsbeantragung mit Let's Encrypt
'algorithm' is not recognized as an internal or external command,
operable program or batch file.
2022/04/27 14:38:15 [INFO] [patch.hrz.uni-bielefeld.de] acme: Obtaining bundled SAN certificate
2022/04/27 14:38:16 [INFO] [patch.hrz.uni-bielefeld.de] AuthURL: https://acme-v02.api.letsencrypt.org/acme/authz-v3/102636982507
2022/04/27 14:38:16 [INFO] [patch.hrz.uni-bielefeld.de] acme: Could not find solver for: tls-alpn-01
2022/04/27 14:38:16 [INFO] [patch.hrz.uni-bielefeld.de] acme: Could not find solver for: http-01
2022/04/27 14:38:16 [INFO] [patch.hrz.uni-bielefeld.de] acme: use dns-01 solver
2022/04/27 14:38:16 [INFO] [patch.hrz.uni-bielefeld.de] acme: Preparing to solve DNS-01
2022/04/27 14:38:16 [INFO] [patch.hrz.uni-bielefeld.de] acme: Trying to solve DNS-01
2022/04/27 14:38:16 [INFO] [patch.hrz.uni-bielefeld.de] acme: Checking DNS record propagation using [google-public-dns-a.google.com:53 google-public-dns-b.google.com:53]
2022/04/27 14:38:21 [INFO] Wait for propagation [timeout: 5m0s, interval: 5s]
2022/04/27 14:38:21 [INFO] [patch.hrz.uni-bielefeld.de] acme: Waiting for DNS record propagation.
2022/04/27 14:38:26 [INFO] [patch.hrz.uni-bielefeld.de] acme: Waiting for DNS record propagation.
2022/04/27 14:38:31 [INFO] [patch.hrz.uni-bielefeld.de] acme: Waiting for DNS record propagation.
2022/04/27 14:38:36 [INFO] [patch.hrz.uni-bielefeld.de] acme: Waiting for DNS record propagation.
2022/04/27 14:38:41 [INFO] [patch.hrz.uni-bielefeld.de] acme: Waiting for DNS record propagation.
2022/04/27 14:38:47 [INFO] [patch.hrz.uni-bielefeld.de] acme: Waiting for DNS record propagation.
2022/04/27 14:38:52 [INFO] [patch.hrz.uni-bielefeld.de] acme: Waiting for DNS record propagation.
2022/04/27 14:38:57 [INFO] [patch.hrz.uni-bielefeld.de] acme: Waiting for DNS record propagation.
2022/04/27 14:39:02 [INFO] [patch.hrz.uni-bielefeld.de] acme: Waiting for DNS record propagation.
2022/04/27 14:39:07 [INFO] [patch.hrz.uni-bielefeld.de] acme: Waiting for DNS record propagation.
2022/04/27 14:39:12 [INFO] [patch.hrz.uni-bielefeld.de] acme: Waiting for DNS record propagation.
2022/04/27 14:39:17 [INFO] [patch.hrz.uni-bielefeld.de] acme: Waiting for DNS record propagation.
2022/04/27 14:39:22 [INFO] [patch.hrz.uni-bielefeld.de] acme: Waiting for DNS record propagation.
2022/04/27 14:39:27 [INFO] [patch.hrz.uni-bielefeld.de] acme: Waiting for DNS record propagation.
2022/04/27 14:39:32 [INFO] [patch.hrz.uni-bielefeld.de] acme: Waiting for DNS record propagation.
2022/04/27 14:39:37 [INFO] [patch.hrz.uni-bielefeld.de] acme: Waiting for DNS record propagation.
2022/04/27 14:39:42 [INFO] [patch.hrz.uni-bielefeld.de] acme: Waiting for DNS record propagation.
2022/04/27 14:39:47 [INFO] [patch.hrz.uni-bielefeld.de] acme: Waiting for DNS record propagation.
2022/04/27 14:39:52 [INFO] [patch.hrz.uni-bielefeld.de] acme: Waiting for DNS record propagation.
2022/04/27 14:39:57 [INFO] [patch.hrz.uni-bielefeld.de] acme: Waiting for DNS record propagation.
2022/04/27 14:40:02 [INFO] [patch.hrz.uni-bielefeld.de] acme: Waiting for DNS record propagation.
2022/04/27 14:40:07 [INFO] [patch.hrz.uni-bielefeld.de] acme: Waiting for DNS record propagation.
2022/04/27 14:40:12 [INFO] [patch.hrz.uni-bielefeld.de] acme: Waiting for DNS record propagation.
2022/04/27 14:40:17 [INFO] [patch.hrz.uni-bielefeld.de] acme: Waiting for DNS record propagation.
2022/04/27 14:40:22 [INFO] [patch.hrz.uni-bielefeld.de] acme: Waiting for DNS record propagation.
2022/04/27 14:40:28 [INFO] [patch.hrz.uni-bielefeld.de] acme: Waiting for DNS record propagation.
2022/04/27 14:40:33 [INFO] [patch.hrz.uni-bielefeld.de] acme: Waiting for DNS record propagation.
2022/04/27 14:40:38 [INFO] [patch.hrz.uni-bielefeld.de] acme: Waiting for DNS record propagation.
2022/04/27 14:40:43 [INFO] [patch.hrz.uni-bielefeld.de] acme: Waiting for DNS record propagation.
2022/04/27 14:40:48 [INFO] [patch.hrz.uni-bielefeld.de] acme: Waiting for DNS record propagation.
2022/04/27 14:40:53 [INFO] [patch.hrz.uni-bielefeld.de] acme: Waiting for DNS record propagation.
2022/04/27 14:40:58 [INFO] [patch.hrz.uni-bielefeld.de] acme: Waiting for DNS record propagation.
2022/04/27 14:41:03 [INFO] [patch.hrz.uni-bielefeld.de] acme: Waiting for DNS record propagation.
2022/04/27 14:41:08 [INFO] [patch.hrz.uni-bielefeld.de] acme: Waiting for DNS record propagation.
2022/04/27 14:41:13 [INFO] [patch.hrz.uni-bielefeld.de] acme: Waiting for DNS record propagation.
2022/04/27 14:41:18 [INFO] [patch.hrz.uni-bielefeld.de] acme: Waiting for DNS record propagation.
2022/04/27 14:41:23 [INFO] [patch.hrz.uni-bielefeld.de] acme: Waiting for DNS record propagation.
2022/04/27 14:41:28 [INFO] [patch.hrz.uni-bielefeld.de] acme: Waiting for DNS record propagation.
2022/04/27 14:41:33 [INFO] [patch.hrz.uni-bielefeld.de] acme: Waiting for DNS record propagation.
2022/04/27 14:41:38 [INFO] [patch.hrz.uni-bielefeld.de] acme: Waiting for DNS record propagation.
2022/04/27 14:41:43 [INFO] [patch.hrz.uni-bielefeld.de] acme: Waiting for DNS record propagation.
2022/04/27 14:41:48 [INFO] [patch.hrz.uni-bielefeld.de] acme: Waiting for DNS record propagation.
2022/04/27 14:41:53 [INFO] [patch.hrz.uni-bielefeld.de] acme: Waiting for DNS record propagation.
2022/04/27 14:41:59 [INFO] [patch.hrz.uni-bielefeld.de] acme: Waiting for DNS record propagation.
2022/04/27 14:42:04 [INFO] [patch.hrz.uni-bielefeld.de] acme: Waiting for DNS record propagation.
2022/04/27 14:42:09 [INFO] [patch.hrz.uni-bielefeld.de] acme: Waiting for DNS record propagation.
2022/04/27 14:42:14 [INFO] [patch.hrz.uni-bielefeld.de] acme: Waiting for DNS record propagation.
2022/04/27 14:42:19 [INFO] [patch.hrz.uni-bielefeld.de] acme: Waiting for DNS record propagation.
2022/04/27 14:42:24 [INFO] [patch.hrz.uni-bielefeld.de] acme: Waiting for DNS record propagation.
2022/04/27 14:42:29 [INFO] [patch.hrz.uni-bielefeld.de] acme: Waiting for DNS record propagation.
2022/04/27 14:42:34 [INFO] [patch.hrz.uni-bielefeld.de] acme: Waiting for DNS record propagation.
2022/04/27 14:42:39 [INFO] [patch.hrz.uni-bielefeld.de] acme: Waiting for DNS record propagation.
2022/04/27 14:42:44 [INFO] [patch.hrz.uni-bielefeld.de] acme: Waiting for DNS record propagation.
2022/04/27 14:42:49 [INFO] [patch.hrz.uni-bielefeld.de] acme: Waiting for DNS record propagation.
2022/04/27 14:42:54 [INFO] [patch.hrz.uni-bielefeld.de] acme: Waiting for DNS record propagation.
2022/04/27 14:42:59 [INFO] [patch.hrz.uni-bielefeld.de] acme: Waiting for DNS record propagation.
2022/04/27 14:43:04 [INFO] [patch.hrz.uni-bielefeld.de] acme: Waiting for DNS record propagation.
2022/04/27 14:43:09 [INFO] [patch.hrz.uni-bielefeld.de] acme: Waiting for DNS record propagation.
2022/04/27 14:43:14 [INFO] [patch.hrz.uni-bielefeld.de] acme: Waiting for DNS record propagation.
2022/04/27 14:43:19 [INFO] [patch.hrz.uni-bielefeld.de] acme: Waiting for DNS record propagation.
2022/04/27 14:43:24 [INFO] [patch.hrz.uni-bielefeld.de] acme: Cleaning DNS-01 challenge
2022/04/27 14:43:25 [INFO] retry due to: acme: error: 400 :: POST :: https://acme-v02.api.letsencrypt.org/acme/authz-v3/102636982507 :: urn:ietf:params:acme:error:badNonce :: JWS has an invalid anti-replay nonce: "01028HiWMftUbX7Rw2KjsGyhdbaIlJ5GkkBPAZ6RwxALZpo"
2022/04/27 14:43:25 [INFO] Deactivating auth: https://acme-v02.api.letsencrypt.org/acme/authz-v3/102636982507
2022/04/27 14:43:25 Could not obtain certificates:
        error: one or more domains had a problem:
[patch.hrz.uni-bielefeld.de] time limit exceeded: last error: NS dns-2.dfn.de. did not return the expected TXT record [fqdn: _acme-challenge.acme.hrz.uni-bielefeld.de., value: 5P-2JVp32Rv_1UiPsL3AevvV1D58jKVk5NKi-n-sJnI]:
c:\zertifikate\lego>

4 replies

ldez Apr 27, 2022
Maintainer

so now for me, it's working, you have a propagation issue, you can:

increase the timeout RFC2136_PROPAGATION_TIMEOUT
or set --dns.resolvers (ex: --dns.resolvers=8.8.8.8)
or disable the propagation check --dns.disable-cp (not recommended)

collimas Apr 27, 2022
Author

Thanks for your fast help! Today I had to use the --dns.disable-cp switch, but I will try it with longer timeout values.

Will you make a new release for this?

ldez Apr 27, 2022
Maintainer

Will you make a new release for this?

I will not create a release only for that, but I think I will create a release soon.

For now, I think you can use my binary (I'm the core maintainer of lego) if it's possible.

collimas Apr 28, 2022
Author

Thats ok for me, thanks!

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Key name case sensitivity in RFC2136 challenge #1632

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Replies: 2 comments 10 replies

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{title}}

Select a reply

Key name case sensitivity in RFC2136 challenge #1632

collimas Apr 27, 2022

Replies: 2 comments · 10 replies

ldez Apr 27, 2022 Maintainer

collimas Apr 27, 2022 Author

ldez Apr 27, 2022 Maintainer

collimas Apr 27, 2022 Author

ldez Apr 27, 2022 Maintainer

collimas Apr 27, 2022 Author

collimas Apr 27, 2022 Author

ldez Apr 27, 2022 Maintainer

collimas Apr 27, 2022 Author

ldez Apr 27, 2022 Maintainer

collimas Apr 28, 2022 Author

collimas
Apr 27, 2022

Replies: 2 comments 10 replies

ldez
Apr 27, 2022
Maintainer

collimas Apr 27, 2022
Author

ldez Apr 27, 2022
Maintainer

collimas Apr 27, 2022
Author

ldez Apr 27, 2022
Maintainer

collimas Apr 27, 2022
Author

collimas
Apr 27, 2022
Author

ldez Apr 27, 2022
Maintainer

collimas Apr 27, 2022
Author

ldez Apr 27, 2022
Maintainer

collimas Apr 28, 2022
Author