ACME/LetEnc Timeout für Validation zieht nicht

[Dunstkreis]

Hi zusammen,

im ACME-Menü unter den Challange Plugins habe ich eins für inwx konfiguriert. DNS-API: inwx, API-Data passt
Verzögerung der Validierung: 90 <<-- das müssten doch Sekunden sein, oder nicht? Und default wenn leer steht ne ausgegraute 30 da ...

Auf meinem Node im Menü Zertifikate unter ACME habe ich meine Domains eingetragen, und wenn ich ein neues Zertifikat anfordere bekomme ich:

Loading ACME account details
Placing ACME order
Order URL: https://acme-v02.api.letsencrypt.org/acme/order/whoopWhoop

Getting authorization details from 'https://acme-v02.api.letsencrypt.org/acme/authz-v3/whoopWhoop'
The validation for whoopWhoop.de is pending!
[Fri Sep  4 12:31:01 CEST 2020] Adding record
Add TXT record: _acme-challenge.whoopWhoop.de
Sleeping 30 seconds to wait for TXT record propagation
Triggering validation
Sleeping for 5 seconds
[Fri Sep  4 12:31:45 CEST 2020] Deleting record
Remove TXT record: _acme-challenge.whoopWhoop.de
TASK ERROR: validating challenge 'https://acme-v02.api.letsencrypt.org/acme/authz-v3/whoopWhoop' failed - status: invalid

Wenn ich während dessen bei meinem Registrar reinschaue, sehe ich den _acme TXT Record.
Wenn ich die zweite/letzte URL öffne, sehe ich ein anderes Token, als dort eingetragen wurde. Und da drin steht die Meldung
"No TXT record found at _acme-challenge.whoopWhoop.de" was ja nicht so ganz korrekt ist, weil ich den Eintrag ja sehe.

Wartet das Ding nicht lang genug auf die Propagation? Und warum wird die 90 da nicht angezogen?

Weiß jemand weiter?

PVE 6.2-11 / community subscr

Besten Dank
Grüße Andreas

 

[fabian]

this is actually already fixed in git - we should probably bump + release that

https://git.proxmox.com/?p=proxmox-acme.git;a=commit;h=1192b595869adcf12eda5dc0cf7db950625a22b6

 

[Dunstkreis]

That would be awesome cos my certs are going to be outdated soon .... :-D

 

[Dunstkreis]

Is there any way that I could fix this on my own? Just change that line of code somewhere somehow? (Until my changes get overwritten by next update...)

 

[fabian]

yes, you can change that line in /usr/share/perl5/PVE/ACME/DNSChallenge.pm and restart pveproxy and pvedaemon

 

[Dunstkreis]

Its waiting 90 secs now. Thank you. And yes, you should release that.
Although my validation is still not working... Hmmm. Guess I gonna bump it up to like 5 minutes or something the like ...

Another thing. I got 4 Domains configured. It stopped after the first failing. I dont know if it would have continued to try the other three domains if I'd had another ACME plugin configured, and in this case its unlikely that the others validate if the first doesnt but anyway, why not give it a try? So why not continue with the other domains!?

 

[fabian]

Its waiting 90 secs now. Thank you. And yes, you should release that.
Although my validation is still not working... Hmmm. Guess I gonna bump it up to like 5 minutes or something the like ...

Another thing. I got 4 Domains configured. It stopped after the first failing. I dont know if it would have continued to try the other three domains if I'd had another ACME plugin configured, and in this case its unlikely that the others validate if the first doesnt but anyway, why not give it a try? So why not continue with the other domains!?

you need to validate all 4, since all 4 go into the certificate.

 

[Dunstkreis]

Hmm, thats right, all four in one order. Didnt think about that. sorry