Lego: Add support for Joker.com SVC (non-DMAPI)

[hcc23]

The currently supported [DMAPI interface] (related [PR] #870) to Joker.com is only available to "reseller accounts" (from [1]):

To be able to use the entire API, you must have a reseller account with Joker.com
(and use this account to log in).

However, there is an alternative especially for for automating Let's Encrypt SSL Certificates available via a simple curl POST (from [2]):

curl -X POST https://svc.joker.com/nic/replace -d \
'username=your-username&password=your-password&zone=your-domain.com&label=_acme-challenge&type=TXT&value=the-TXT-content-to-insert'

The benefit of using this method is that every customer of Joker.com can use this interface, DMAPI is only available to reseller accounts.

[ldez]

Hello,

Seems related to #926

Have you try to use JOKER_USERNAME and JOKER_PASSWORD instead of JOKER_API_KEY ?

[hcc23]

Hi @ldez ,

i rechecked and tried different entries for JOKER_USERNAME and JOKER_PASSWORD ->
No, I couldn't get them to work (as I don't have a _reseller_ account).

Here is what I did:

Test 1: Using the Dynamic DNS credentials

1. Enabling Dynamic DNS for my domain, noting down the given user and password for Dynamic DNS Authentication
2. Created a DYNA entry for *.dadac0.de with a (manually set) value of 127.0.0.1
3. Ran this command:
   ```bash:
   docker run -it \
   -e JOKER_USERNAME= \
   -e JOKER_PASSWORD= \
   goacme/lego --accept-tos --dns joker --domains *.dadac0.de --email [email protected] run

**Output 1:**

2020/06/07 12:26:41 No key found for account [email protected]. Generating a P384 key.
2020/06/07 12:26:41 Saved key to /.lego/accounts/acme-v02.api.letsencrypt.org/[email protected]/keys/[email protected]
2020/06/07 12:26:42 [INFO] acme: Registering account for [email protected]
!!!! HEADS UP !!!!

Your account credentials have been saved in your Let's Encrypt
configuration directory at "/.lego/accounts".

You should make a secure backup of this folder now. This
configuration directory will also contain certificates and
private keys obtained from Let's Encrypt so making regular
backups of this folder is ideal.
2020/06/07 12:26:42 [INFO] [.dadac0.de] acme: Obtaining bundled SAN certificate
2020/06/07 12:26:43 [INFO] [.dadac0.de] AuthURL: https://acme-v02.api.letsencrypt.org/acme/authz-v3/5078366918
2020/06/07 12:26:43 [INFO] [.dadac0.de] acme: use dns-01 solver
2020/06/07 12:26:43 [INFO] [.dadac0.de] acme: Preparing to solve DNS-01
2020/06/07 12:26:43 [INFO] [.dadac0.de] acme: Cleaning DNS-01 challenge
2020/06/07 12:26:43 [WARN] [.dadac0.de] acme: cleaning up failed: joker: DMAPI error: login did not return valid Auth-Sid Response: map[Error:[Parameter username: expected: valid username] Status-Code:[2400] Status-Text:[Command failed] SvTrId:[01d63cc6e77e573a8f2d046773582d26] Timing:[0.001131/0.003830 29.517%] Tracking-Id:[01d63cc6e77e573a8f2d046773582d26]]
2020/06/07 12:26:44 [INFO] Deactivating auth: https://acme-v02.api.letsencrypt.org/acme/authz-v3/5078366918
2020/06/07 12:26:44 Could not obtain certificates:
error: one or more domains had a problem:
[.dadac0.de] [.dadac0.de] acme: error presenting token: joker: DMAPI error: login did not return valid Auth-Sid Response: map[Error:[Parameter username: expected: valid username] Status-Code:[2400] Status-Text:[Command failed] SvTrId:[01d63cc6e77ab03a8f2cd357763d0baa] Timing:[0.000902/0.003276 27.538%] Tracking-Id:[01d63cc6e77ab03a8f2cd357763d0baa]]

So this didn't work. Hence I tried another approach:

**Test 2:** Using my _actual_ credentials for Joker.com
_Note:_ I have 2FA enabled on my Joker account.

1. Created a DYNA entry for ```*.dadac0.de``` with a (manually set) value of ```127.0.0.1```
3.  Ran this command:
```bash:
docker run -it \
-e JOKER_USERNAME=<my actual Joker.com user> \
-e JOKER_PASSWORD=<my actual Joker.com pwd> \
goacme/lego --accept-tos --dns joker --domains *.dadac0.de --email [email protected] run

Output 2:

2020/06/07 12:29:05 No key found for account [email protected]. Generating a P384 key.
2020/06/07 12:29:05 Saved key to /.lego/accounts/acme-v02.api.letsencrypt.org/[email protected]/keys/[email protected]
2020/06/07 12:29:06 [INFO] acme: Registering account for [email protected]
!!!! HEADS UP !!!!

Your account credentials have been saved in your Let's Encrypt
configuration directory at "/.lego/accounts".

You should make a secure backup of this folder now. This
configuration directory will also contain certificates and
private keys obtained from Let's Encrypt so making regular
backups of this folder is ideal.
2020/06/07 12:29:07 [INFO] [*.dadac0.de] acme: Obtaining bundled SAN certificate
2020/06/07 12:29:07 [INFO] [*.dadac0.de] AuthURL: https://acme-v02.api.letsencrypt.org/acme/authz-v3/5078400943
2020/06/07 12:29:07 [INFO] [*.dadac0.de] acme: use dns-01 solver
2020/06/07 12:29:07 [INFO] [*.dadac0.de] acme: Preparing to solve DNS-01
2020/06/07 12:29:08 [INFO] [*.dadac0.de] acme: Cleaning DNS-01 challenge
2020/06/07 12:29:08 [WARN] [*.dadac0.de] acme: cleaning up failed: joker: DMAPI error: login did not return valid Auth-Sid Response: map[Error:[Invalid account type (you have to have a reseller account)] Status-Code:[2201] Status-Text:[Authorization error] SvTrId:[01d63cc73db24472813fd00b65f639d8] Timing:[0.001360/0.003383 40.187%] Tracking-Id:[01d63cc73db24472813fd00b65f639d8]] 
2020/06/07 12:29:08 [INFO] Deactivating auth: https://acme-v02.api.letsencrypt.org/acme/authz-v3/5078400943
2020/06/07 12:29:08 Could not obtain certificates:
        error: one or more domains had a problem:
[*.dadac0.de] [*.dadac0.de] acme: error presenting token: joker: DMAPI error: login did not return valid Auth-Sid Response: map[Error:[Invalid account type (you have to have a reseller account)] Status-Code:[2201] Status-Text:[Authorization error] SvTrId:[01d63cc73d8c49de813c71b40f2b6a80] Timing:[0.006177/0.226343 2.729%] Tracking-Id:[01d63cc73d8c49de813c71b40f2b6a80]]

Note the error message: Error:[Invalid account type (you have to have a reseller account)]

So unfortunately this seems to indicate that #926 should be reopened, shouldn't it?

[ldez]

@hcc23 if I create a PR, are you able to test it?

[hcc23]

;) depends....

If "testing" involves checking out the PR branch, firing up a container based on the `dockerfile, and attempting to generate the certs as outlined in the docs - then yes.

For more I fear that I do not have enough background knowledge on what _actually_ happens under the hood ... sorry.

[rsiv]

Hey @ldez
I just hit the same issue while setting up Traefik on my domain managed by Joker.com
Did you get to create that PR? I can test it.

[ldez]

Hey @rsiv,

As you are able to test it, I will work on it (I already work on it but it's a draft), I will try to open a PR quickly. Thank you.

[ldez]

@rsiv I created the PR: #1267

Could you give me the output of:

$ rm -rf .lego

$ JOKER_API_MODE=SVC \
JOKER_USERNAME=<your email> \
JOKER_PASSWORD=<your password> \
lego --dns joker --domains *.example.com --domains example.com --email [email protected] run

You have to replace example.com, [email protected], and the authentication information.

I'm waiting for your feedback :wink:.

[rsiv]

@ldez I had to remove the trailing dot in the zone with dns01.UnFqdn() in Present() and Cleanup().
TXT record is now created and removed correctly and certificate validated.

The default 1 minute timeout seems too short, it took 1m30s to propagate in my test. Fixed that by setting JOKER_PROPAGATION_TIMEOUT.

[rsiv]

@ldez it fails if two domains are requested - it keeps waiting for the wrong TXT entry until it times out:

JOKER_API_MODE=SVC JOKER_USERNAME=xxx JOKER_PASSWORD=xxx dist/lego --dns joker --domains mydomain.com --domains \*.mydomain.com --email [email protected] --server https://acme-staging-v02.api.letsencrypt.org/directory --dns.resolvers x.ns.joker.com -a run
2020/10/08 00:52:26 No key found for account [email protected]. Generating a P256 key.
2020/10/08 00:52:26 Saved key to xxx
2020/10/08 00:52:26 [INFO] acme: Registering account for [email protected]
!!!! HEADS UP !!!!

Your account credentials have been saved in your Let's Encrypt
configuration directory at "xxx".

You should make a secure backup of this folder now. This
configuration directory will also contain certificates and
private keys obtained from Let's Encrypt so making regular
backups of this folder is ideal.
2020/10/08 00:52:27 [INFO] [mydomain.com, *.mydomain.com] acme: Obtaining bundled SAN certificate
2020/10/08 00:52:27 [INFO] [*.mydomain.com] AuthURL: https://acme-staging-v02.api.letsencrypt.org/acme/authz-v3/xxx
2020/10/08 00:52:27 [INFO] [mydomain.com] AuthURL: https://acme-staging-v02.api.letsencrypt.org/acme/authz-v3/yyy
2020/10/08 00:52:27 [INFO] [*.mydomain.com] acme: use dns-01 solver
2020/10/08 00:52:27 [INFO] [mydomain.com] acme: Could not find solver for: tls-alpn-01
2020/10/08 00:52:27 [INFO] [mydomain.com] acme: Could not find solver for: http-01
2020/10/08 00:52:27 [INFO] [mydomain.com] acme: use dns-01 solver
2020/10/08 00:52:27 [INFO] [*.mydomain.com] acme: Preparing to solve DNS-01
2020/10/08 00:52:28 [INFO] [mydomain.com] acme: Preparing to solve DNS-01
2020/10/08 00:52:28 [INFO] [*.mydomain.com] acme: Trying to solve DNS-01
2020/10/08 00:52:28 [INFO] [*.mydomain.com] acme: Checking DNS record propagation using [x.ns.joker.com:53]
2020/10/08 00:52:30 [INFO] Wait for propagation [timeout: 1m0s, interval: 2s]
2020/10/08 00:52:31 [INFO] [*.mydomain.com] acme: Waiting for DNS record propagation.
2020/10/08 00:52:33 [INFO] [*.mydomain.com] acme: Waiting for DNS record propagation.
2020/10/08 00:52:35 [INFO] [*.mydomain.com] acme: Waiting for DNS record propagation.
...
2020/10/08 00:53:25 [INFO] [*.mydomain.com] acme: Waiting for DNS record propagation.
2020/10/08 00:53:28 [INFO] [*.mydomain.com] acme: Waiting for DNS record propagation.
2020/10/08 00:53:30 [INFO] [*.mydomain.com] acme: Waiting for DNS record propagation.
2020/10/08 00:53:32 [INFO] [mydomain.com] acme: Trying to solve DNS-01
2020/10/08 00:53:32 [INFO] [mydomain.com] acme: Checking DNS record propagation using [x.ns.joker.com:53]
2020/10/08 00:53:34 [INFO] Wait for propagation [timeout: 1m0s, interval: 2s]
2020/10/08 00:53:34 [INFO] [mydomain.com] acme: Waiting for DNS record propagation.
2020/10/08 00:53:37 [INFO] [mydomain.com] acme: Waiting for DNS record propagation.
2020/10/08 00:53:43 [INFO] [mydomain.com] The server validated our request
2020/10/08 00:53:43 [INFO] [*.mydomain.com] acme: Cleaning DNS-01 challenge
2020/10/08 00:53:44 [INFO] [mydomain.com] acme: Cleaning DNS-01 challenge
2020/10/08 00:53:44 [INFO] Deactivating auth: https://acme-staging-v02.api.letsencrypt.org/acme/authz-v3/xxx
2020/10/08 00:53:44 [INFO] Skipping deactivating of valid auth: https://acme-staging-v02.api.letsencrypt.org/acme/authz-v3/yyy
2020/10/08 00:53:44 Could not obtain certificates:
    error: one or more domains had a problem:
[*.mydomain.com] time limit exceeded: last error: NS x.ns.joker.com. did not return the expected TXT record [fqdn: _acme-challenge.mydomain.com., value: th1mz4bygobKCc_PG29JBW9-U9K_3C5rKflYg_k6Dm4]: FnIsr_oaFvnR5ut358GUIxOUQ2sXXZqi0jma7ENJAPk

It works if I run with a single domain:

JOKER_PROPAGATION_TIMEOUT=300 JOKER_API_MODE=SVC JOKER_USERNAME=xxx JOKER_PASSWORD=xxx dist/lego --dns joker --domains \*.mydomain.com --email [email protected] --server https://acme-staging-v02.api.letsencrypt.org/directory --dns.resolvers x.ns.joker.com -a run
2020/10/08 00:56:00 No key found for account [email protected]. Generating a P256 key.
2020/10/08 00:56:00 Saved key to xxx
2020/10/08 00:56:01 [INFO] acme: Registering account for [email protected]
!!!! HEADS UP !!!!

Your account credentials have been saved in your Let's Encrypt
configuration directory at "xxx".

You should make a secure backup of this folder now. This
configuration directory will also contain certificates and
private keys obtained from Let's Encrypt so making regular
backups of this folder is ideal.
2020/10/08 00:56:01 [INFO] [*.mydomain.com] acme: Obtaining bundled SAN certificate
2020/10/08 00:56:01 [INFO] [*.mydomain.com] AuthURL: https://acme-staging-v02.api.letsencrypt.org/acme/authz-v3/zzz
2020/10/08 00:56:01 [INFO] [*.mydomain.com] acme: use dns-01 solver
2020/10/08 00:56:01 [INFO] [*.mydomain.com] acme: Preparing to solve DNS-01
2020/10/08 00:56:02 [INFO] [*.mydomain.com] acme: Trying to solve DNS-01
2020/10/08 00:56:02 [INFO] [*.mydomain.com] acme: Checking DNS record propagation using [x.ns.joker.com:53]
2020/10/08 00:56:04 [INFO] Wait for propagation [timeout: 5m0s, interval: 2s]
2020/10/08 00:56:04 [INFO] [*.mydomain.com] acme: Waiting for DNS record propagation.
2020/10/08 00:56:06 [INFO] [*.mydomain.com] acme: Waiting for DNS record propagation.
2020/10/08 00:56:09 [INFO] [*.mydomain.com] acme: Waiting for DNS record propagation.
...
2020/10/08 00:56:59 [INFO] [*.mydomain.com] acme: Waiting for DNS record propagation.
2020/10/08 00:57:01 [INFO] [*.mydomain.com] acme: Waiting for DNS record propagation.
2020/10/08 00:57:03 [INFO] [*.mydomain.com] acme: Waiting for DNS record propagation.
2020/10/08 00:57:12 [INFO] [*.mydomain.com] The server validated our request
2020/10/08 00:57:12 [INFO] [*.mydomain.com] acme: Cleaning DNS-01 challenge
2020/10/08 00:57:13 [INFO] [*.mydomain.com] acme: Validations succeeded; requesting certificates
2020/10/08 00:57:13 [INFO] [*.mydomain.com] Server responded with a certificate.

[ldez]

@rsiv Thank you!

I updated the PR, could you retry with the wildcard (2 domains).

[rsiv]

@ldez Seems perfect now! Thank you!
I still had the 5m timeout set, but the default 2m should be enough.

JOKER_PROPAGATION_TIMEOUT=300 JOKER_API_MODE=SVC JOKER_USERNAME=xxx JOKER_PASSWORD=xxx dist/lego --dns joker --domains \*.mydomain.com --domains mydomain.com --email [email protected] --server https://acme-staging-v02.api.letsencrypt.org/directory --dns.resolvers x.ns.joker.com -a run
2020/10/08 10:12:47 No key found for account [email protected]. Generating a P256 key.
2020/10/08 10:12:47 Saved key to xxx
2020/10/08 10:12:47 [INFO] acme: Registering account for [email protected]
!!!! HEADS UP !!!!

Your account credentials have been saved in your Let's Encrypt
configuration directory at "xxx".

You should make a secure backup of this folder now. This
configuration directory will also contain certificates and
private keys obtained from Let's Encrypt so making regular
backups of this folder is ideal.
2020/10/08 10:12:48 [INFO] [*.mydomain.com, mydomain.com] acme: Obtaining bundled SAN certificate
2020/10/08 10:12:48 [INFO] [*.mydomain.com] AuthURL: https://acme-staging-v02.api.letsencrypt.org/acme/authz-v3/xxx
2020/10/08 10:12:48 [INFO] [mydomain.com] AuthURL: https://acme-staging-v02.api.letsencrypt.org/acme/authz-v3/yyy
2020/10/08 10:12:48 [INFO] [*.mydomain.com] acme: use dns-01 solver
2020/10/08 10:12:48 [INFO] [mydomain.com] acme: Could not find solver for: tls-alpn-01
2020/10/08 10:12:48 [INFO] [mydomain.com] acme: Could not find solver for: http-01
2020/10/08 10:12:48 [INFO] [mydomain.com] acme: use dns-01 solver
2020/10/08 10:12:48 [INFO] [*.mydomain.com] acme: Preparing to solve DNS-01
2020/10/08 10:12:50 [INFO] [*.mydomain.com] acme: Trying to solve DNS-01
2020/10/08 10:12:50 [INFO] [*.mydomain.com] acme: Checking DNS record propagation using [x.ns.joker.com:53]
2020/10/08 10:12:52 [INFO] Wait for propagation [timeout: 5m0s, interval: 2s]
2020/10/08 10:12:52 [INFO] [*.mydomain.com] acme: Waiting for DNS record propagation.
2020/10/08 10:12:55 [INFO] [*.mydomain.com] acme: Waiting for DNS record propagation.
2020/10/08 10:12:58 [INFO] [*.mydomain.com] acme: Waiting for DNS record propagation.
2020/10/08 10:13:02 [INFO] [*.mydomain.com] acme: Waiting for DNS record propagation.
2020/10/08 10:13:04 [INFO] [*.mydomain.com] acme: Waiting for DNS record propagation.
2020/10/08 10:13:08 [INFO] [*.mydomain.com] acme: Waiting for DNS record propagation.
2020/10/08 10:13:10 [INFO] [*.mydomain.com] acme: Waiting for DNS record propagation.
2020/10/08 10:13:13 [INFO] [*.mydomain.com] acme: Waiting for DNS record propagation.
2020/10/08 10:13:16 [INFO] [*.mydomain.com] acme: Waiting for DNS record propagation.
2020/10/08 10:13:19 [INFO] [*.mydomain.com] acme: Waiting for DNS record propagation.
2020/10/08 10:13:22 [INFO] [*.mydomain.com] acme: Waiting for DNS record propagation.
2020/10/08 10:13:24 [INFO] [*.mydomain.com] acme: Waiting for DNS record propagation.
2020/10/08 10:13:27 [INFO] [*.mydomain.com] acme: Waiting for DNS record propagation.
2020/10/08 10:13:30 [INFO] [*.mydomain.com] acme: Waiting for DNS record propagation.
2020/10/08 10:13:33 [INFO] [*.mydomain.com] acme: Waiting for DNS record propagation.
2020/10/08 10:13:36 [INFO] [*.mydomain.com] acme: Waiting for DNS record propagation.
2020/10/08 10:13:39 [INFO] [*.mydomain.com] acme: Waiting for DNS record propagation.
2020/10/08 10:13:42 [INFO] [*.mydomain.com] acme: Waiting for DNS record propagation.
2020/10/08 10:13:45 [INFO] [*.mydomain.com] acme: Waiting for DNS record propagation.
2020/10/08 10:13:48 [INFO] [*.mydomain.com] acme: Waiting for DNS record propagation.
2020/10/08 10:13:51 [INFO] [*.mydomain.com] acme: Waiting for DNS record propagation.
2020/10/08 10:13:54 [INFO] [*.mydomain.com] acme: Waiting for DNS record propagation.
2020/10/08 10:13:57 [INFO] [*.mydomain.com] acme: Waiting for DNS record propagation.
2020/10/08 10:14:00 [INFO] [*.mydomain.com] acme: Waiting for DNS record propagation.
2020/10/08 10:14:03 [INFO] [*.mydomain.com] acme: Waiting for DNS record propagation.
2020/10/08 10:14:10 [INFO] [*.mydomain.com] The server validated our request
2020/10/08 10:14:10 [INFO] [*.mydomain.com] acme: Cleaning DNS-01 challenge
2020/10/08 10:14:11 [INFO] sequence: wait for 1m0s
2020/10/08 10:15:11 [INFO] [mydomain.com] acme: Preparing to solve DNS-01
2020/10/08 10:15:12 [INFO] [mydomain.com] acme: Trying to solve DNS-01
2020/10/08 10:15:12 [INFO] [mydomain.com] acme: Checking DNS record propagation using [x.ns.joker.com:53]
2020/10/08 10:15:14 [INFO] Wait for propagation [timeout: 5m0s, interval: 2s]
2020/10/08 10:15:15 [INFO] [mydomain.com] acme: Waiting for DNS record propagation.
2020/10/08 10:15:18 [INFO] [mydomain.com] acme: Waiting for DNS record propagation.
2020/10/08 10:15:21 [INFO] [mydomain.com] acme: Waiting for DNS record propagation.
2020/10/08 10:15:24 [INFO] [mydomain.com] acme: Waiting for DNS record propagation.
2020/10/08 10:15:26 [INFO] [mydomain.com] acme: Waiting for DNS record propagation.
2020/10/08 10:15:29 [INFO] [mydomain.com] acme: Waiting for DNS record propagation.
2020/10/08 10:15:32 [INFO] [mydomain.com] acme: Waiting for DNS record propagation.
2020/10/08 10:15:35 [INFO] [mydomain.com] acme: Waiting for DNS record propagation.
2020/10/08 10:15:38 [INFO] [mydomain.com] acme: Waiting for DNS record propagation.
2020/10/08 10:15:41 [INFO] [mydomain.com] acme: Waiting for DNS record propagation.
2020/10/08 10:15:44 [INFO] [mydomain.com] acme: Waiting for DNS record propagation.
2020/10/08 10:15:47 [INFO] [mydomain.com] acme: Waiting for DNS record propagation.
2020/10/08 10:15:50 [INFO] [mydomain.com] acme: Waiting for DNS record propagation.
2020/10/08 10:15:53 [INFO] [mydomain.com] acme: Waiting for DNS record propagation.
2020/10/08 10:15:55 [INFO] [mydomain.com] acme: Waiting for DNS record propagation.
2020/10/08 10:15:58 [INFO] [mydomain.com] acme: Waiting for DNS record propagation.
2020/10/08 10:16:01 [INFO] [mydomain.com] acme: Waiting for DNS record propagation.
2020/10/08 10:16:04 [INFO] [mydomain.com] acme: Waiting for DNS record propagation.
2020/10/08 10:16:07 [INFO] [mydomain.com] acme: Waiting for DNS record propagation.
2020/10/08 10:16:10 [INFO] [mydomain.com] acme: Waiting for DNS record propagation.
2020/10/08 10:16:13 [INFO] [mydomain.com] acme: Waiting for DNS record propagation.
2020/10/08 10:16:21 [INFO] [mydomain.com] The server validated our request
2020/10/08 10:16:21 [INFO] [mydomain.com] acme: Cleaning DNS-01 challenge
2020/10/08 10:16:22 [INFO] [*.mydomain.com, mydomain.com] acme: Validations succeeded; requesting certificates
2020/10/08 10:16:22 [INFO] [*.mydomain.com] Server responded with a certificate.

[rsiv]

@ldez one comment regarding documentation - username and passsword are not my email and account passwords, but those displayed in Joker.com domain dashboard when enabling Dynamic DNS.

Reference: https://joker.com/faq/content/6/496/en/let_s-encrypt-support.html

Setting a TXT record is fairly straightforward:
1. please login at Joker.com, visit 'My Domains', find the domain you want to add  Let's Encrypt
 certificate for, and chose "DNS" in the menu

2. on the top right, you will find the setting for 'Dynamic DNS'. If not already active, please activate it. 
It will not affect any other already existing DNS records of this domain.

3. please take a note of the credentials which are now shown as 'Dynamic DNS Authentication',
 consisting of a 'username' and a 'password'.

4. this is all you have to do here - and only once per domain.

[ldez]

As those elements are shared, in code, with the 2 implementations, I have to think about a way to document that.