Cert renewal via Gandi DNS plugin fails

[erkston]

---

Expected Behavior

Certbot should renew certificates automatically when using VALIDATION=dns and DNSPLUGIN=gandi

Current Behavior

Certbot fails: Renewal configuration file /etc/letsencrypt/renewal/DOMAIN.conf (cert: DOMAIN) produced an unexpected error: 'Namespace' object has no attribute 'certbot_plugin_gandi:dns_credentials'. Skipping.

Further background: the Gandi DNS plugin was recently updated (#277) which comes with some configuration changes (https://github.com/obynio/certbot-plugin-gandi#faq). Any renewal configuration file created with the old plugin nomenclature will not renew and throw the error above.

Replacing

authenticator = certbot-plugin-gandi:dns
certbot_plugin_gandi:dns_credentials = /config/dns-conf/gandi.ini

with

authenticator = dns-gandi
dns_gandi_credentials = /config/dns-conf/gandi.ini

in /etc/letsencrypt/renewal/DOMAIN.conf will allow certbot to renew without issue.

[github-actions]

Thanks for opening your first issue here! Be sure to follow the bug or feature issue templates!

[nemchik]

As far as I can tell, we have never shipped authenticator as a line in gandi.ini based on the history https://github.com/linuxserver/docker-swag/commits/master/root/defaults/dns-conf/gandi.ini and in the previous repo https://github.com/linuxserver/docker-letsencrypt/commits/master/root/defaults/dns-conf/gandi.ini

We used to ship

certbot_plugin_gandi:dns_api_key=APIKEY

but that has changed to

dns_gandi_api_key=APIKEY

and should be automatically replaced in your gandi.ini when the container starts. The replacement happens with this line in the init:

docker-swag/root/etc/cont-init.d/50-certbot

Line 41 in 47cb0bf

sed -i 's|^certbot_plugin_gandi:dns_|dns_gandi_|g' /config/dns-conf/gandi.ini

I would advise you to only use dns_gandi_api_key in your gandi.ini file (all other lines we ship are comments and not required in the file).

p.s. for reference, python or certbot seem to treat dashes (-) and underscores (_) the same when reading these ini files, so dns_gandi_api_key and dns-gandi-api-key would both be read, however we have opted to stick with underscores.

[erkston]

dns-conf/gandi.ini is automatically replaced appropriately, but the older names were still present in my renewal conf file in /etc/letsencrypt/renewal/DOMAIN.conf

[nemchik]

That's a very important piece of information that I overlooked in your original post. Let me have a look at the best way to handle that.

[erkston]

p.s. for reference, python or certbot seem to treat dashes (-) and underscores (_) the same when reading these ini files, so dns_gandi_api_key and dns-gandi-api-key would both be read, however we have opted to stick with underscores.

Note about this: I was actually still having trouble with renewal until I changed dns-gandi-credentials (dashes) to dns_gandi_credentials (underscores) in /etc/letsencrypt/renewal/DOMAIN.conf.

The original issue post had dashes but I have updated it to show underscores. Certbot will complain (Input the path to your Gandi credentials INI file) if dashes are used.

[github-actions]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[nemchik]

This is fixed in #306 just waiting for review so it can merge.