Boulder: DNS-Caching issue with DNS-01 validation of wildcard domain and upper level domain

[lukas2511]

Hi there,

I'm currently rewriting the challenge validation in dehydrated and I ran into an problem that seems to be a server-side DNS-caching issue.
Not really sure if this is a boulder issue or just an issue with the staging environment... sorry if this is the wrong place for reporting this.

When requesting certificates for test.dehydrated.de and *.test.dehydrated.de the validation fails on the second domain with an error message containing the token for the first domain.
It doesn't matter if the domains are in one order or in separate orders that are done quickly after another.

I'm 100% certain that at the time the second domain should have been validated all authoritative DNS servers for my zone were already delivering the new record. I have full control over my DNS setup, my script is waiting for the old token to be removed and the new token to be added before giving control back to dehydrated, and I also verified the records by hand.

Normally this wouldn't be a problem as boulder would return an already valid authorization when querying the same identifier again, but in case of wildcard domains the identifier and with that the dns record gets ambigious and DNS-caching results in this issue...

[lukas2511]

I just recognized that it kinda does exactly what it should do, if I set the TTL to 1 and add a 1-second-sleep it works fine.

I read that you are caching for 5 minutes in production... so as a client developer I guess my only chance of making sure it works for everybody is to wait 5+ minutes between duplicate identifiers... that seems a bit wrong...

[lukas2511]

Nevermind, I didn't know there could be multiple tokens deployed at the same time, I changed the behaviour of dehydrated and it's working perfectly now, sorry for the confusion.

[steffenweber]

I ran into the very same issue yesterday. Like you, I solved the problem with multiple loops over the challenges: (1) add DNS records for all challenges (2) trigger verification of all challenges.

It would be nice if there was only a single challenge for example.com and *.example.com (because both check _acme-challenge.example.com anyway).