this post was submitted on 10 Mar 2024
12 points (92.9% liked)

Selfhosted

40266 readers
504 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

  1. Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.

  2. No spam posting.

  3. Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.

  4. Don't duplicate the full text of your blog or github here. Just post the link for folks to click.

  5. Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).

  6. No trolling.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 1 year ago
MODERATORS
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
12
Local DNS-01 wildcard certificate not renewed? (lemmy.dbzer0.com)
submitted 8 months ago by [email protected] to c/[email protected]
7 comments fedilink hide all child comments
 

I followed this tutorial to create local certificates for my home server, but now it failed to renew automatically and I have no clue waht to do. Can anybody assist me in debugging, please? https://notthebe.ee/blog/easy-ssl-in-homelab-dns01/

I'm using duckdns.org, added mydomain.duckdns.org and the local IP of my home server. In Nginx-Proxy-Manager I have created the respective wildcard certificate. The log of my NPM container reports the following:

[3/10/2024] [1:55:50 PM] [SSL      ] › ℹ  info      Renewing Let'sEncrypt certificates via DuckDNS for Cert #6: *.mydomain.duckdns.org, mydomain.duckdns.org
[3/10/2024] [1:55:50 PM] [SSL      ] › ℹ  info      Command: certbot renew --force-renewal --config "/etc/letsencrypt.ini" --work-dir "/tmp/letsencrypt-lib" --logs-dir "/tmp/letsencrypt-log" --cert-name "npm-6" --disable-hook-validation --no-random-sleep-on-renew 
[3/10/2024] [1:55:50 PM] [Global   ] › ⬤  debug     CMD: certbot renew --force-renewal --config "/etc/letsencrypt.ini" --work-dir "/tmp/letsencrypt-lib" --logs-dir "/tmp/letsencrypt-log" --cert-name "npm-6" --disable-hook-validation --no-random-sleep-on-renew 
[3/10/2024] [1:55:53 PM] [Express  ] › ⚠  warning   Saving debug log to /tmp/letsencrypt-log/letsencrypt.log
Failed to renew certificate npm-6 with error: The DNS response does not contain an answer to the question: mydomain.duckdns.org. IN TXT
All renewals failed. The following certificates could not be renewed:
  /etc/letsencrypt/live/npm-6/fullchain.pem (failure)
1 renew failure(s), 0 parse failure(s)
top 7 comments
sorted by: hot top controversial new old
[–] [email protected] 1 points 8 months ago

I had issues with DNS checks and traced it to my pihole. I changed that container's resolv.conf to use cloudflare DNS and it has been working fine since. It was with Caddy so needed to change over to use IPs.

[–] [email protected] 0 points 8 months ago (1 children)

Have you looked at the debug log? Or even what you pasted? It tells you what it's missing (though this part doesn't go into the whys).

[–] [email protected] 3 points 8 months ago (1 children)

Of course, but I don't know what it means or what to do with it otherwise I obviously wouldn't have create this post!?

[–] [email protected] 0 points 8 months ago (1 children)

Does the debug log not have more info?

[–] [email protected] 2 points 8 months ago (1 children)

Here's the full log from /tmp/letsencrypt-log/letsencrypt.log. https://notebin.de/?4859b67f1b29f0e2#8G6vSon5PUGUHoZvMYD3zKwx8hkJeCV9xQM4TWFSvudM

[–] [email protected] 2 points 8 months ago (1 children)

Did you replace your domain with mydomain.duckdns.org in the logs, or did you just not configure the client with your domain? I'm not sure how it would have ever worked if that was the case, though. Either way, it tells you the DNS challenge record is missing.

[–] [email protected] 1 points 8 months ago

I replaced my actual domain with "mydomain".