Unable to validate sub-domains on prod server, only on test.
Hi
I'm using DNS validation via a domain-alias. Client is acme.sh. I can validate just fine with the test server, https://api.test4.buypass.no/acme/directory. With the prod server https://api.buypass.com/acme/directory I can only validate the root domain, not any sub domains like www.
Error message is:
[Tue Apr 27 14:07:47 CEST 2021] test.****.com:Challenge error: {"type":"urn:ietf:params:acme:error:incorrectResponse","detail":"Response received didn't match
the challenge's requirements","code":400,"message":"MALFORMED_BAD_REQUEST","details":"HTTP 400 Bad Request"}or
[Tue Apr 27 14:06:41 CEST 2021] Error, can not get domain uri. "type":"dns-01","token":"29B55C4016DB632CD0BDD8ABE8D76CE634C6B126","status":"pending","validated"
:"2021-04-26T13:01:49Z","error":{"type":"urn:ietf:params:acme:error:incorrectResponse","detail":"Response received didn't match the challenge's requirements","c
ode":0-
Hi lars
Could you provide us with more details, like “MDC-correlationId” response header value, which is sent as a response header from our server and also the date/time for the failed challenge validation request.
Regards,
Andriy
-
Andriy Mahats
Hi. Thanks for responding.There are time stamps on both error messages I've posted. I can't find MDC-correlationId in the acme.sh.log. Attaching the full debug output. I've only replaced the domain name with ***.
-
Hi lars
There were challenge validation attempts on 3 domains - one base domain and two subdomains. The challenge on base domain was validated successfully. Whereas the challenge validation attempts on 2 subdomains failed, since after querying the TXT records no records were found.
This might be due to DNS slow propagation issue.
Regards,
Andriy
-
-
Hm. I've tried several times. It works as it should on test. I use the same command, just switch out "--server" between test and prod.
-
Hi lars
Our implementation will not verify the challenge again until we get explicit request from client.
As we see there were no further requests in production for challenge verification from ACME-client after 26th of April.
So these authorizations and challenges are left in pending state.
Regards,
Andriy
-
