LetsEncrypt certificate with dns alias challenge using nsupdate

macleod

Well-Known Member
Aug 3, 2017
66
8
48
46
Hello

By digging in the code I saw that is possible (but only from console) to use dns challenge with alias. The problem is that nsupdate runs as nobody/nogroup, and if you want to keep the dns key in a single place somewhere in /etc/pve/ it will be root:www-data, and no 0644 is possible (even it could be, surely it will be not recommended).

Did I missed some settings ? How can I use nsupdate securely and put the dns key in a single place ?

[Sat Jul 11 18:53:05 EEST 2020] key "/etc/pve/xxxxxx.key" is unreadable
command 'setpriv --reuid nobody --regid nogroup --clear-groups --reset-env -- /bin/bash /usr/share/proxmox-acme/proxmox-acme setup nsupdate $alias_domain' failed: exit code 1
 

About

The Proxmox community has been around for many years and offers help and support for Proxmox VE, Proxmox Backup Server, and Proxmox Mail Gateway.
We think our community is one of the best thanks to people like you!

Get your subscription!

The Proxmox team works very hard to make sure you are running the best software and getting stable updates and security enhancements, as well as quick enterprise support. Tens of thousands of happy customers have a Proxmox subscription. Get yours easily in our online shop.

Buy now!