Help needed over setting up DNS-01 challenge with self hosted BIND9 server and Step CA ACME sever using RFC2136 #2159
-
|
I have a test environment with Docker, where I wanted to test wildcard cert genration using self hosted Bind9 DNS server and a step CA ACME server. I'm facing issues with DNS challenge While I am able to obtain certificates for all individual *.silverdev.fun internal domains using the HTTP-01 challenge using certbot, my goal was to secure a wildcard certificate using the DNS challenge. The most relevant solution I found in the documentation was the RCF2136 provider. Consequently, I set up a BIND9 server and correctly configured all the records as follows: named.conf cl home {
192.168.1.0/24;
172.18.0.0/24;
};
options {
version "not currently available";
forwarders {
1.1.1.1;
1.0.0.1;
};
allow-query { home; };
};
key "keyname." {
algorithm hmac-sha512;
secret "key as generated by tsig-keygen -a hmac-sha512 keyname.";
};
zone "silverdev.fun." IN {
type master;
file "/etc/bind/silver-dev.zone";
update-policy {
grant keyname. zonesub any;
};
};and /etc/bind/silver-dev.zone With this configuration, I can successfully obtain a wildcard certificate when I employ certbot in the following manner: docker run -it --rm --name certbot -e REQUESTS_CA_BUNDLE=/home/root.crt -p 80:80 --network="proxy" \
-v "./data/etc:/etc/letsencrypt" \
-v "./data/var:/var/lib/letsencrypt" \
-v "./data/secrets:/home" \
-v "./data/certs/root_ca.crt:/home/root.crt" \
certbot/dns-rfc2136 certonly --dns-rfc2136 --dns-rfc2136-credentials /home/dns.ini \
--agree-tos --email [email protected] \
--server https://step-ca:9000/acme/acme/directory -d "silverdev.fun" -d "*.silverdev.fun"However, when I execute the lego container, I observe in the bind9 logs that lego is generating _acme challenge CNAME records. It doesn't succeed in obtaining the wildcard certificate. I need help regarding this Steps I followed RFC2136_TSIG_KEY=keyname. \
RFC2136_TSIG_SECRET=<key> \
RFC2136_TSIG_ALGORITHM=hmac-sha512. \
RFC2136_NAMESERVER=64.227.153.101 \
lego --server https://step-ca:9000/acme/acme/directory --accept-tos --email [email protected] --dns rfc2136 --dns.resolvers 64.227.153.101 --domains silverdev.fun runI have to create a separate lego container where I trusted my self hosted step-ca's root.crt The container docker file
# Start from a base image
FROM ubuntu:jammy
# Install necessary packages
RUN apt-get update && \
apt-get install -y ca-certificates wget
# Copy certificates
COPY ./certs/ /usr/local/share/ca-certificates/
# Update certificates
RUN update-ca-certificates
# Change working directory
WORKDIR /home
# Download lego
RUN wget https://github.com/go-acme/lego/releases/download/v4.16.1/lego_v4.16.1_linux_amd64.tar.gz
# Extract lego
RUN tar -xzvf lego_v4.16.1_linux_amd64.tar.gz
# Move lego to bin
RUN mv /home/lego /usr/bin
# Clean up
RUN rm -rf /home/*go-acme logs I'm stuck here, I don't know what else I can do, I have also raised a discussion in traefik forum since that was my first try traefik discussion |
Beta Was this translation helpful? Give feedback.
Replies: 1 comment 7 replies
-
|
Hello,
Lego doesn't create CNAME, it just follows CNAME by default. The problem is related to the CNAME wildcard record. Can you set the env var |
Beta Was this translation helpful? Give feedback.
-
|
Hi, after a long time, I revisited this issue, this time with a fully local setup. LEGO successfully obtains certificates using the HTTP-01 challenge, but DNS-01 is still giving me trouble. I’ve struggled with it extensively, but Certbot works flawlessly. Could this be an issue with LEGO's RFC2136 implementation? Any help would be appreciated! |
Beta Was this translation helpful? Give feedback.
-
There is no problem with the implementation of the RFC. What is your current problem? |
Beta Was this translation helpful? Give feedback.
-
Environment
Problem StatementSuccessful Manual DNS UpdateUpdating DNS manually with nsupdate -k kubedevkey.key
> server 192.168.1.77
> zone internal.com
> update add _acme-challenge.internal.com. 300 TXT "test-dns-01"
> send
> quitVerification using dig @192.168.1.77 _acme-challenge.internal.com TXTANSWER SECTION:
_acme-challenge.internal.com. 120 IN TXT "test-dns-01"PS also checked dig output in step-ca env LEGO Fails to Validate DNS-01 ChallengeRunning LEGO inside a Docker container results in a failure: docker run --name lego --rm --dns 192.168.1.77 -v ./root_ca.pem:/root_ca.pem \
-e LEGO_CA_CERTIFICATES=/root_ca.pem \
-e RFC2136_TSIG_KEY=kubedev_key \
-e RFC2136_TSIG_SECRET=<kubedevkey> \
-e RFC2136_TSIG_ALGORITHM=hmac-sha256 \
-e RFC2136_NAMESERVER=192.168.1.77 \
-e LEGO_DISABLE_CNAME_SUPPORT=true \
goacme/lego --server https://ca.home.com:9000/acme/acme/directory \
--accept-tos --email [email protected] --dns rfc2136 \
--dns.resolvers 192.168.1.77 --domains="*.internal.com" runError OutputLEGO works fine with HTTP-01 ChallengeRunning LEGO for docker run --name lego --rm -v ./root_ca.pem:/root_ca.pem \
-e LEGO_CA_CERTIFICATES=/root_ca.pem \
-p 80:80 goacme/lego \
--server https://ca.home.com:9000/acme/acme/directory \
--accept-tos --email="[email protected]" \
--dns.resolvers 192.168.1.77 --domains="ngx.internal.com" --http runCertbot Works SuccessfullyHowever, docker run -it --rm --name certbot -e REQUESTS_CA_BUNDLE=/root_ca.pem --dns 192.168.1.77 \
-v ./root_ca.pem:/root_ca.pem \
-v ./dns.ini:/dns.ini \
certbot/dns-rfc2136 certonly --dns-rfc2136 --dns-rfc2136-credentials /dns.ini \
--agree-tos --email [email protected] \
--server https://ca.home.com:9000/acme/acme/directory -d "internal.com" -d "*.internal.com"Possible issues based on my understanding.
Questions
I appreciate the response to my previous post so quickly, but I still couldn't get it to work. Any suggestions would be greatly helpful. |
Beta Was this translation helpful? Give feedback.
-
|
can you try this option: docker run --name lego --rm -v ./root_ca.pem:/root_ca.pem \
-e LEGO_CA_CERTIFICATES=/root_ca.pem \
-p 80:80 goacme/lego \
--server https://ca.home.com:9000/acme/acme/directory \
--accept-tos --email="[email protected]" \
--dns.propagation-disable-ans \
--dns.resolvers 192.168.1.77 --domains="ngx.internal.com" --http run |
Beta Was this translation helpful? Give feedback.
-
|
|
Beta Was this translation helpful? Give feedback.
-
|
lego checks authoritative and recursing nameservers but inside your network, the authoritative nameservers don't respond. |
Beta Was this translation helpful? Give feedback.
can you try this option:
--dns.propagation-disable-ans?