ACME Plugin OVH not delete TXT in DNS

P

PIxELsi

New Member
Dec 7, 2025
4
0
1
Hi,

I'm a new Proxmox user. I searched Bugzilla and the forum for a similar problem, but I couldn't find anything. I have a domain in OVH. When ACME issues a certificate as DNS01, the certificate is created correctly, but it doesn't delete the OVH DNS TXT record. I have to manually delete this entry from the OVH web console. Has anyone encountered a similar problem?

And the delete action is probably misspelled as add because the teardown command is being executed.



Code: 
Loading ACME account details
Placing ACME order
Order URL: https://acme.zerossl.com/v2/DV90/order/<token>

Getting authorization details from 'https://acme.zerossl.com/v2/DV90/authz/<token_v2>'
The validation for server1.<domain>.xyz is pending!
[Sun Dec  7 17:23:36 CET 2025] Using OVH endpoint: ovh-eu
[Sun Dec  7 17:23:36 CET 2025] Checking authentication
[Sun Dec  7 17:23:37 CET 2025] Consumer key is ok.
[Sun Dec  7 17:23:38 CET 2025] Adding record
[Sun Dec  7 17:23:38 CET 2025] Added, sleep 10 seconds.
Add TXT record: _acme-challenge.server1.<domain>.xyz
Sleeping 30 seconds to wait for TXT record propagation
Triggering validation
Sleeping for 5 seconds
Status is 'valid', domain 'server1.<domain>.xyz' OK!
[Sun Dec  7 17:24:25 CET 2025] Using OVH endpoint: ovh-eu
[Sun Dec  7 17:24:25 CET 2025] Checking authentication
[Sun Dec  7 17:24:25 CET 2025] Consumer key is ok.
[Sun Dec  7 17:24:26 CET 2025] Error add txt for domain:_acme-challenge.server1.<domain>.xyz
command 'setpriv --reuid nobody --regid nogroup --clear-groups --reset-env -- /bin/bash /usr/share/proxmox-acme/proxmox-acme teardown ovh server1.<domain>.xyz' failed: exit code 1


All domains validated!

Creating CSR
Checking order status
Order is ready, finalizing order
still processing, trying again in 30 seconds
valid!

Downloading certificate
Setting pveproxy certificate and key
Restarting pveproxy
TASK OK

Code: 
root@pve:~# pveversion -v
proxmox-ve: 9.1.0 (running kernel: 6.14.8-2-pve)
pve-manager: 9.0.3 (running version: 9.0.3/025864202ebb6109)
proxmox-kernel-helper: 9.0.4
proxmox-kernel-6.14.8-2-pve-signed: 6.14.8-2
proxmox-kernel-6.14: 6.14.8-2
amd64-microcode: 3.20250311.1
ceph: 19.2.3-pve2
ceph-fuse: 19.2.3-pve2
corosync: 3.1.9-pve2
criu: 4.1.1-1
frr-pythontools: 10.3.1-1+pve4
ifupdown2: 3.3.0-1+pmx11
ksm-control-daemon: 1.5-1
libjs-extjs: 7.0.0-5
libproxmox-acme-perl: 1.7.0
libproxmox-backup-qemu0: 2.0.1
libproxmox-rs-perl: 0.4.1
libpve-access-control: 9.0.4
libpve-apiclient-perl: 3.4.2
libpve-cluster-api-perl: 9.0.7
libpve-cluster-perl: 9.0.7
libpve-common-perl: 9.0.15
libpve-guest-common-perl: 6.0.2
libpve-http-server-perl: 6.0.5
libpve-network-perl: 1.2.3
libpve-rs-perl: 0.11.3
libpve-storage-perl: 9.0.13
libspice-server1: 0.15.2-1+b1
lvm2: 2.03.31-2+pmx1
lxc-pve: 6.0.5-3
lxcfs: 6.0.4-pve1
novnc-pve: 1.6.0-3
proxmox-backup-client: 4.1.0-1
proxmox-backup-file-restore: 4.1.0-1
proxmox-backup-restore-image: 1.0.0
proxmox-firewall: 1.2.1
proxmox-kernel-helper: 9.0.4
proxmox-mail-forward: 1.0.2
proxmox-mini-journalreader: 1.6
proxmox-offline-mirror-helper: 0.7.3
proxmox-widget-toolkit: 5.1.2
pve-cluster: 9.0.7
pve-container: 6.0.9
pve-docs: 9.1.1
pve-edk2-firmware: 4.2025.05-2
pve-esxi-import-tools: 1.0.1
pve-firewall: 6.0.4
pve-firmware: 3.17-2
pve-ha-manager: 5.0.8
pve-i18n: 3.6.4
pve-qemu-kvm: 10.1.2-4
pve-xtermjs: 5.5.0-3
qemu-server: 9.0.16
smartmontools: 7.4-pve1
spiceterm: 3.4.1
swtpm: 0.8.0+pve3
vncterm: 1.9.1
zfsutils-linux: 2.3.4-pve1
 
I found the problem and came up with a solution. You need to add the deletion " to the dns_ovh_rm() function.

In file: /usr/share/proxmox-acme/dnsapi/dns_ovh.sh

Before:

Code: 
dns_ovh_rm() {

  (...)

  for rid in $(echo "$response" | tr '][,' '   '); do
    _debug rid "$rid"
    if ! _ovh_rest GET "domain/zone/$_domain/record/$rid"; then
      return 1
    fi
    if _contains "$response" "\"target\":\"$txtvalue\""; then
      _debug "Found txt id:$rid"
      if ! _ovh_rest DELETE "domain/zone/$_domain/record/$rid"; then
        return 1
      fi
      _ovh_rest POST "domain/zone/$_domain/refresh"
      _debug "Refresh:$response"
      return 0
    fi
  done

  return 1
}

After:

Code: 
dns_ovh_rm() {
 
  (...)
 
  for rid in $(echo "$response" | tr '][,' '   '); do
    _debug rid "$rid"
    if ! _ovh_rest GET "domain/zone/$_domain/record/$rid"; then
      return 1
    fi
    clean_response=$(echo "$response" | sed 's/\\\"//g')
    if _contains "$clean_response" "\"target\":\"$txtvalue\""; then
      _debug "Found txt id:$rid"
      if ! _ovh_rest DELETE "domain/zone/$_domain/record/$rid"; then
        return 1
      fi
      _ovh_rest POST "domain/zone/$_domain/refresh"
      _debug "Refresh:$response"
      return 0
    fi
  done

  return 1
}

Now it works that:

Code: 
Loading ACME account details
Placing ACME order
Order URL: https://acme.zerossl.com/v2/DV90/order/<token>

Getting authorization details from 'https://acme.zerossl.com/v2/DV90/authz/<token>'
The validation for server1.<domain>.xyz is pending!
[Sun Dec  7 23:29:32 CET 2025] Using OVH endpoint: ovh-eu
[Sun Dec  7 23:29:32 CET 2025] Checking authentication
[Sun Dec  7 23:29:33 CET 2025] Consumer key is ok.
[Sun Dec  7 23:29:34 CET 2025] Adding record
[Sun Dec  7 23:29:34 CET 2025] Added, sleep 10 seconds.
Add TXT record: _acme-challenge.server1.<domain>.xyz
Sleeping 30 seconds to wait for TXT record propagation
Triggering validation
Sleeping for 5 seconds
Status is 'valid', domain 'server1.<domain>.xyz' OK!
[Sun Dec  7 23:30:20 CET 2025] Using OVH endpoint: ovh-eu
[Sun Dec  7 23:30:20 CET 2025] Checking authentication
[Sun Dec  7 23:30:20 CET 2025] Consumer key is ok.
Remove TXT record: _acme-challenge.server1.<domain>.xyz

All domains validated!

Creating CSR
Checking order status
Order is ready, finalizing order
still processing, trying again in 30 seconds
valid!

Downloading certificate
Setting pveproxy certificate and key
Restarting pveproxy
TASK OK
 
and fixed description

In file /usr/share/proxmox-acme/proxmox-acme

Before:

Code: 
teardown() {
  (...)

  if ! $rmcommand "$fqdn" "$txtvalue"; then
    _err "Error add txt for domain:$fulldomain"
    return 1
  fi
}

After:

Code: 
teardown() {
  (...)

  if ! $rmcommand "$fqdn" "$txtvalue"; then
    _err "Error deleting txt for domain:$fulldomain"
    return 1
  fi
}
 
You must log in or register to reply here.
Top Bottom