Addons: DuckDNS Addon cannot create wildcard certificate

[move[bot]]

@JAAlperin commented on Jun 19, 2018, 5:25 PM UTC:

{
"lets_encrypt": {
"accept_terms": true,
"certfile": "fullchain.pem",
"keyfile": "privkey.pem"
},
"token": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
"domains": [
"xxx.duckdns.org",
"*.xxx.duckdns.org"
],
"seconds": 1800
}

results in this:

OKOKOKOK + Responding to challenge for xxx.duckdns.org authorization...

• Cleaning challenge tokens...
  OKOKOKOK + Challenge validation has failed :(
  ERROR: Challenge is invalid! (returned: invalid) (result: {
  "type": "dns-01",
  "status": "invalid",
  "error": {
  "type": "urn:ietf:params:acme:error:unauthorized",
  "detail": "Incorrect TXT record "gYvyuKSEz-Sa58khnK9KUc0MUu3C5WDf_7qRDwlDAcM" found at _acme-challenge.xxx.duckdns.org",
  "status": 403
  },
  "url": "https://acme-v02.api.letsencrypt.org/acme/challenge/szX3vuPHMvfMYF-heQcbgmGA4sYZzSVXMMLbjhDm3_Q/5197664255",
  "token": "MxeILOKZ8GYrxuHkWPQYTu3_ZXjbexpDp_miok76grY"
  })

If I understand the many internet posts regarding this issue, it has to do with HOOK_CHAIN=yes, the tokens in the single TXT record, and has been fixed already in certbot via a changed script.

This issue was moved by frenck from home-assistant/home-assistant.github.io/issues/5574.

[move[bot]]

@metbril commented on Jun 20, 2018, 5:34 AM UTC:

This issue is not related to the documentation website, so it should be moved to the appropriate one or closed and be re-issued there.

[move[bot]]

@JAAlperin commented on Jun 20, 2018, 4:15 PM UTC:

Sorry, Robert. Please be kind enough to point me to the correct place.

Robert ***@***.***> June 20, 2018 at 1:34 AM This issue is not related to the documentation website, so it should be moved to the appropriate one or closed and be re-issued there. — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <[#5574 (comment)](https://github.com/home-assistant/home-assistant.github.io/issues/5574#issuecomment-398629447)>, or mute the thread <[https://github.com/notifications/unsubscribe-auth/AZEOGmFCGa_eLeNNPkKjvyiTevLeTVZ2ks5t-d7ngaJpZM4Ut7LP](https://github.com/notifications/unsubscribe-auth/AZEOGmFCGa_eLeNNPkKjvyiTevLeTVZ2ks5t-d7ngaJpZM4Ut7LP)>.

Regards, Jeff Alperin H: 561-666-7789 C: 561-797-9876 "It's not rocket surgery!" - Oscar Leroy "You know my rule about circus music!" - Lacey Burroughs

[metbril]

@JAAlperin it has been moved for you.

[KillianDS]

I tried to solve this, but this is not trivial. For dehydrated (used by this addon) there is an open issue, but there is no plan to actually solve this. The root cause is that you need two TXT tokens for the same domain (xxx.duckdns.org) but duckdns only allows one. So the only thing an ACME script could do is do one challenge, wait until the DNS cache has timed out and only then deploy the second challenge. That would take a while and is not foolproof as DNS cache timeouts are unpredictable depending on which recursive servers are in between. The correct solution would be for DuckDNS to allow at least two TXT records to exists simultaneously, I made a suggestion on their google+ community but didn't receive any feedback.

Another way to get around that would be to use the HTTP challenge, but that conflicts with the nginx plugin, which is the same issue the generic letsencrypt plugin has. For my usecase I'm currently thinking of writing a custom addon that combines nginx and duckdns, but I'd rather solve it in the official plugin if possible.

[spali]

I just wanted to start with this after I finished setup my pfsense firewall to also use duckdns with let's encrypt.
PFsense package for this is using this client https://github.com/Neilpang/acme.sh which supports almost all features including wildcard. But I think there is a wrapper script around it for managing the TXT record for duckdns.
It also supports my use-case with an CNAME entry for my own domain that points to duckdns, which I assume is currently also not supported in this addon.

In my opinion it makes more sense to split this two functionalities. One for updating the IP itself which is in my case anyway done by the firewall. And one with the above script and just updating the TXT records.

PS: I think it's a bit more than a small change, because there is also some kind of account key used for the ACME v2 script which I still didn't check in detail whats the point in this.

[liads]

There's a quick workaround if you only need to use subdomains of "xxx.duckdns.org".
Configure the addon with:

"domains": [
  "*.xxx.duckdns.org > xxx.duckdns.org"
]

This will create a wildcard certificate for "*.xxx.duckdns.org" with "xxx.duckdns.org" as an alias (required by dehydrated). The certificate will not be valid for "xxx.duckdns.org", but only for its subdomains.

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.