Renewing LetsEncrypt cert via Dynu DDNS failing

[Amc-101]

I have been using acme.sh to renew a LetsEncrypt SSL cert using Dynu DDNS validation since early 2025. Automatic cert renewals stopped worked in June 2026 but I've only just noticed it now.

June is around the time I added more DNS records in Dynu for email handling and I thought maybe it was a quota issue with their free plan. I paid for a Dynu membership yesterday but the issue still occurs.

I've attached the console log from a manual review attempt but in summary:
. acme.sh is v3.1.5 (was working previously with 3.1 but I updated after it failed).
. Running on a Raspberry Pi (Jessie) running nginx web server.
. The initial LetsEncrypt query seems to work.
. The Dynu TXT add does not work (curl error 7 getting 'https://api.dynu.com/v2/dns/getroot/ahm101.freeddns.org').
. The Dynu OAUTH2 credentials appear correct in acme.sh config.

I can add a debug log as well but I don't know if it contains any 'secrets' that should be stripped first.

Any assistance appreciated. Thanks
sslcert_renew_console_260903a.txt

[Junaid-PK]

The key clue is curl error 7 together with no entry in the Dynu API log. Error 7 means that curl could not establish the connection; it occurs before Dynu can evaluate the account, quota, domain, or credentials.

Invalid domain is misleading here. The Dynu hook prints it whenever _get_root fails (caller), and _get_root also fails when the underlying GET has a transport error (implementation). So the extra email records and free/paid plan are not the cause of this particular failure.

Because the token request succeeded two seconds earlier against the same hostname, I would first test for an intermittent address or IPv4/IPv6 route problem on the Pi:

getent ahosts api.dynu.com
curl -sv --connect-timeout 10 -o /dev/null https://api.dynu.com/v2/dns/getroot/ahm101.freeddns.org
curl -4sv --connect-timeout 10 -o /dev/null https://api.dynu.com/v2/dns/getroot/ahm101.freeddns.org
curl -6sv --connect-timeout 10 -o /dev/null https://api.dynu.com/v2/dns/getroot/ahm101.freeddns.org

Run the working/default form a few times because api.dynu.com has multiple addresses. These commands deliberately omit authentication. Any HTTP response, commonly 401, proves that DNS, TCP, and TLS reached Dynu; the distinction to watch for is whether one form still ends in error 7.

If curl -4 works while the default or curl -6 fails, retry the renewal with:

./acme.sh --renew --domain ahm101.freeddns.org --request-v4

The option sets the shared HTTP client to curl --ipv4 (HTTP setup), so it also covers the Dynu hook calls, and acme.sh saves the setting in the account configuration (persistence).

If curl -4 also fails, the next place to inspect is the Pi network path: DNS results, default route, outbound firewall/proxy, and reachability of each returned Dynu address. Jessie is long out of support, so after restoring renewal I would also move this service to a supported OS; however, error 7 is a connection failure rather than a certificate-validation failure.

One security note: do not post a raw --debug 2 log. At that level acme.sh enables a curl trace that can contain the Authorization header, and the Dynu hook also logs the OAuth response. A credential-free curl -v result as above is enough for the first diagnostic pass. If more acme.sh logging is needed, use --debug 1 and still redact Dynu_ClientId, Dynu_Secret, Dynu_Token, Authorization, and any access token before posting.

[Amc-101]

Thanks Junaid, that was very helpful (and a very well written response).
It was an IPv6 issue - the DNS resolved but it wouldn't connect. Forcing it to IPv4 has completed the renewal and I can see the persistent setting in account.conf.
The notes about redacting the debug log is also appreciated.