Plugins: security/acme-client: DNS-Alias won't be used

[superwinni2]

Describe the bug
A clear and concise description of what the bug is, including last known working version (if any).

I try to create a certificate for domain "domain.de" which havn't got an API. I'm using DNS "Challenge alias mode" with "aliasdomain.de".
It's possible on a debian machine with this command:
/root/.acme.sh/acme.sh --issue --dns dns_gd --staging --domain 'domain.de' --challenge-alias aliasdomain.de --domain '*.domain.de' --dnssleep '10'
On OPNsense it will not work. If I take a look in syslog, I see that the parameter "--challenge-alias aliasdomain.de" is missing.

To Reproduce
Steps to reproduce the behavior:

• Create CNAME _acme-challenge.domain.de -> _acme-challenge.aliasdomain.de
• Create LE Account
• Create Challenge Type for your aliasdomain.de (in my case its GoDaddy)
• Create Certificate:
  Common Name: domain.de
  Alt Names: *.domain.de
  LE Account: Account
  Challenge Type: GoDaddy
  DNS Alias Mode: Challenge alias mode
  Challenge Alias: aliasdomain.de

Expected behavior
The Certificate should be created.

Screenshots

Relevant log files
system.log:

Dec  3 08:55:28 fw1 opnsense[61765]: AcmeClient: account is registered: Account
Dec  3 08:55:28 fw1 opnsense[61765]: AcmeClient: using challenge type: DNS-01 aliasdomain.de Godaddy
Dec  3 08:55:28 fw1 opnsense[61765]: AcmeClient: running acme.sh command: /usr/local/sbin/acme.sh --issue --debug 3 --staging --dns 'dns_gd' --dnssleep '120' --home '/var/etc/acme-client/home' --certpath '/var/etc/acme-client/certs/5fc65db306f9d3.45777265/cert.pem' --keypath '/var/etc/acme-client/keys/5fc65db306f9d3.45777265/private.key' --capath '/var/etc/acme-client/certs/5fc65db306f9d3.45777265/chain.pem' --fullchainpath '/var/etc/acme-client/certs/5fc65db306f9d3.45777265/fullchain.pem' --domain 'domain.de' --domain '*.domain.de' --days '1'  --keylength '4096' --accountconf '/var/etc/acme-client/accounts/5fc629cac18ab2.12754882_stg/account.conf'
Dec  3 08:55:50 fw1 opnsense[61765]: AcmeClient: domain validation failed (dns01)
Dec  3 08:55:50 fw1 opnsense[61765]: AcmeClient: validation for certificate failed: domain.de

Additional context
As already mentioned: It's working on debian with acme script. But I think the parameter "--challenge-alias aliasdomain.de" is missing.

Environment
Software version used and hardware type if relevant.
OPNsense 20.7.5
acme version: 2.0

[pcbugwang]

hi,

this code should be corrected:
https://github.com/opnsense/plugins/blob/19c74251e03cd3eeabb403baac41987e4a8616b8/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeCertificate.php#L640

(in opnsense system is /usr/local/opnsense/mvc/app/library/OPNsense/AcmeClient/LeCertificate.php)

line 640 (in opnsense system is 638)
$val->setNames($this->config->name, $this->config->altNames);
should be
$val->setNames($this->config->name, $this->config->altNames, $this->config->aliasmode, $this->config->domainalias, $this->config->challengealias);

[fraenki]

Can anyone confirm that this actually fixes the issue?

opnsense-patch -c plugins a3ce3c356c72e6392ad235e171b16899b7bb9a84

[definitio]

@fraenki It works for me.

[superwinni2]

I've fixed it by hand. It worked.

Also tried your command on a second machine. It's going to be updated.