You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
I am using a Chinese IDN domain name for my website, and using acme.sh build-in dns_ali to verify my domain for issuing certificate. Of course, I am using the latest version of acme.sh docker.
I got "Specified signature is not matched with our calculation." error in my Aliyun console all the time, thus, nothing changes in my IDN domain. Domain Verifying failed. But I tried my another total ascii domain name, it worked fine.
I noticed acme.sh had already supported readable domain name input for IDN domain, and also, I knew IDN domain name could be transformed to punycode. I am not so good at encryption technology. I reviewed Aliyun's documentation and I found its dns api using punycode to generate signature, using original encoding as one of its field instead. So, I think that this is why it doesn't work. Aliyun Document
And, forgive my poor English. This is my first issue.
Debug log
/ # acme.sh --issue -d '[MY_CHINESE_DOMAIN]' --dns dns_ali --server https://acme-staging-v02.api.letsencrypt.org/directory
[Sat Aug 12 14:29:34 UTC 2023] Using CA: https://acme-staging-v02.api.letsencrypt.org/directory
[Sat Aug 12 14:29:34 UTC 2023] Single domain='[MY_CHINESE_DOMAIN]'
[Sat Aug 12 14:29:34 UTC 2023] Getting domain auth token for each domain
[Sat Aug 12 14:29:37 UTC 2023] Getting webroot for domain='[MY_CHINESE_DOMAIN]'
[Sat Aug 12 14:29:38 UTC 2023] Adding txt value: DbixukzZAJZY1snz9OQwsdFjlm4uSH_vEBARyWxxsbk for domain: _acme-challenge.[MY_CHINESE_DOMAIN]
[Sat Aug 12 14:29:39 UTC 2023] Error add txt for domain:_acme-challenge.[MY_CHINESE_DOMAIN]
[Sat Aug 12 14:29:39 UTC 2023] Please add '--debug' or '--log' to check more details.
[Sat Aug 12 14:29:39 UTC 2023] See: https://github.com/acmesh-official/acme.sh/wiki/How-to-debug-acme.sh
/ # acme.sh --issue -d '[MY_ASCII_DOMAIN]' --dns dns_ali --server https://acme-staging-v02.api.letsencrypt.org/directory
[Sat Aug 12 14:29:56 UTC 2023] Using CA: https://acme-staging-v02.api.letsencrypt.org/directory
[Sat Aug 12 14:29:56 UTC 2023] Single domain='[MY_ASCII_DOMAIN]'
[Sat Aug 12 14:29:56 UTC 2023] Getting domain auth token for each domain
[Sat Aug 12 14:30:00 UTC 2023] Getting webroot for domain='[MY_ASCII_DOMAIN]'
[Sat Aug 12 14:30:00 UTC 2023] Adding txt value: kGlW6CVFYmRE9gSM2DteiD0e1iyZWZeRSeCFR6cLwqw for domain: _acme-challenge.[MY_ASCII_DOMAIN]
[Sat Aug 12 14:30:01 UTC 2023] The txt record is added: Success.
[Sat Aug 12 14:30:01 UTC 2023] Let's check each DNS record now. Sleep 20 seconds first.
[Sat Aug 12 14:30:23 UTC 2023] You can use '--dnssleep' to disable public dns checks.
[Sat Aug 12 14:30:23 UTC 2023] See: https://github.com/acmesh-official/acme.sh/wiki/dnscheck
[Sat Aug 12 14:30:23 UTC 2023] Checking [MY_ASCII_DOMAIN] for _acme-challenge.[MY_ASCII_DOMAIN]
[Sat Aug 12 14:30:23 UTC 2023] Please refer to https://curl.haxx.se/libcurl/c/libcurl-errors.html for error code: 35
[Sat Aug 12 14:30:33 UTC 2023] Please refer to https://curl.haxx.se/libcurl/c/libcurl-errors.html for error code: 28
[Sat Aug 12 14:30:33 UTC 2023] Domain [MY_ASCII_DOMAIN] '_acme-challenge.[MY_ASCII_DOMAIN]' success.
[Sat Aug 12 14:30:33 UTC 2023] All success, let's return
The text was updated successfully, but these errors were encountered:
Please upgrade to the latest code and try again first. Maybe it's already fixed. acme.sh --upgrade If it's still not working, please provide the log with --debug 2, otherwise, nobody can help you.
If I use Punycode input, Aliyun's console tells that I don't have this domain, but If I use original input, Aliyun's console tells that signature is not matched with calculation. It's a fatal bug for IDN domain.
Steps to reproduce
I am using a Chinese IDN domain name for my website, and using acme.sh build-in dns_ali to verify my domain for issuing certificate. Of course, I am using the latest version of acme.sh docker.
I got "Specified signature is not matched with our calculation." error in my Aliyun console all the time, thus, nothing changes in my IDN domain. Domain Verifying failed. But I tried my another total ascii domain name, it worked fine.
I noticed acme.sh had already supported readable domain name input for IDN domain, and also, I knew IDN domain name could be transformed to punycode. I am not so good at encryption technology. I reviewed Aliyun's documentation and I found its dns api using punycode to generate signature, using original encoding as one of its field instead. So, I think that this is why it doesn't work.
Aliyun Document
And, forgive my poor English. This is my first issue.
Debug log
The text was updated successfully, but these errors were encountered: