pfSense - Dynamic DuckDNS - ACME - Let’s Encrypt Certificate - Question

rjjaramillo · November 22, 2020, 6:40pm

pfSense - Dynamic DuckDNS - ACME - Let’s Encrypt Certificate - Question:

In pfSense I’m trying to add my first ACME certificate using my Dynamic DuckDNS domain. I am getting the following error. Please let me know what I need to do to fix this, and I appreciate the help?

Thanks,
Jeremy

[Sat Nov 21 16:02:46 CST 2020] Using CA: https://acme-v02.api.letsencrypt.org/directory
[Sat Nov 21 16:02:46 CST 2020] Single domain=‘homecert.duckdns.org’
[Sat Nov 21 16:02:46 CST 2020] Getting domain auth token for each domain
[Sat Nov 21 16:02:48 CST 2020] Getting webroot for domain=‘homecert.duckdns.org’
[Sat Nov 21 16:02:48 CST 2020] Adding txt value:

for domain: _acme-challenge.homecert.duckdns.org
[Sat Nov 21 16:02:48 CST 2020] Trying to add TXT record
[: : bad number
[: : bad number
[Sat Nov 21 16:02:48 CST 2020] Errors happened during adding the TXT record, response=KO
[Sat Nov 21 16:02:48 CST 2020] Error add txt for domain:_acme-challenge.homecert.duckdns.org
[Sat Nov 21 16:02:48 CST 2020] Please check log file for more details: /tmp/acme/HomeCert/acme_issuecert.log

LTS_Tom · November 22, 2020, 7:23pm

Based on the logs it is not able to create the DNS txt records entries at Duck DNS. I have never used their system so not sure if they have DNS calls with Let’s Encrypt implemented properly.

rjjaramillo · November 22, 2020, 7:49pm

Thank’s for the quick reply, I appreciate it. I will try my luck with another DDNS service. Also, thanks for the great instructional videos, keep them comming.

jvinette · November 23, 2020, 10:59pm

This resolved my issue (same as your output)

use Domain Alias in the configuration
– services → acme_certificates-> edit → Domain SAN list-> expand →
Enable DNS domain alias mode: check the box
Enable DNS alias mode: add <yourdomain>.duckdns.org were <yourdomain> is your DuckDNS name
Save
Renew cert

github.com/opnsense/plugins

security/acme-client: DNS Validation with DuckDNS

opened 09:52PM - 12 Oct 20 UTC

closed 04:50PM - 15 Oct 20 UTC

chiwou

upstream

DuckDNS doesn't allow subdomains, looked through the acmesh-official hub, and co…uld find the info in the matching script. [https://github.com/acmesh-official/acme.sh/blob/master/dnsapi/dns_duckdns.sh](https://github.com/acmesh-official/acme.sh/blob/master/dnsapi/dns_duckdns.sh) ``` fulldomain may be 'domain.duckdns.org' (if using --domain-alias) or '_acme-challenge.domain.duckdns.org' either way, return 'domain'. (**duckdns does not allow further subdomains** and restricts domains to [a-z0-9-].) ``` The OPNSENSE plugin tries to update the subdomain _acme-challenge.domain.duckdns.org If I try the update manually the TXT record I get an "KO", but if I remove the subdomain "_acme-challenge" from the request I get an "OK" os-acme-client (installed) | 1.36 | 392KiB | Let's Encrypt client LOG - from bottom to top (removed token and txt record) - _on_issue_err - Error add txt for domain:**_acme-challenge**.domain.duckdns.org - Errors happened during adding the TXT record, response=**KO** - ret='0' - _CURL='curl -L --silent --dump-header /var/etc/acme-client/home/http.header -g ' - timeout= - url='https://www.duckdns.org/update?domains=**_acme-challenge**.domain.duckdns.org&token={token}&txt={txt}' - GET - url='https://www.duckdns.org/update?domains=**_acme-challenge**.domain.duckdns.org&token={token}&txt={txt}' - param='domains=_acme-challenge.domain.duckdns.org&token={token}&txt={txt}' - Trying to add TXT record - Adding txt value: {txt} for domain: **_acme-challenge**.domain.duckdns.org

Common Name: yourdomain.duckdns.org I think you can even use a wildcard
DNS Alias Mode: Domain Alias Mode
Domain Alias: yourdomain.duckdns.org

war59312 · January 11, 2021, 3:13pm

Same issue here. Looks like a new version of Acme on Pfsense is to blame.

Sadly, @jvinette fix is not woking for me. Same exact errors.

roadkill247 · March 13, 2021, 6:04pm

The fix that @jvinette proposed isn’t working for me either, does anyone else have any other ideas?

zelise · March 28, 2021, 3:41pm

Worked for me, thank you @ jvinette

roadkill247 · May 11, 2021, 3:53pm

This solved the issue for me - DNS-DuckDNS does not renew | Netgate Forum

jgrantham · August 4, 2021, 1:27pm

@jvinette has the fix that works. Here’s a screenshot for reference of what he’s talking about under the Domain SAN list. Hopefully, this will help someone else.