security/acme-client: DNS Validation with DuckDNS

[chiwou]

DuckDNS doesn't allow subdomains, looked through the acmesh-official hub, and could find the info in the matching script.

https://github.com/acmesh-official/acme.sh/blob/master/dnsapi/dns_duckdns.sh

fulldomain may be 'domain.duckdns.org' (if using --domain-alias) or '_acme-challenge.domain.duckdns.org'
either way, return 'domain'. (**duckdns does not allow further subdomains** and restricts domains to [a-z0-9-].)

The OPNSENSE plugin tries to update the subdomain _acme-challenge.domain.duckdns.org

If I try the update manually the TXT record I get an "KO", but if I remove the subdomain "_acme-challenge" from the request I get an "OK"

os-acme-client (installed) | 1.36 | 392KiB | Let's Encrypt client

LOG - from bottom to top (removed token and txt record)

• _on_issue_err
• Error add txt for domain:_acme-challenge.domain.duckdns.org
• Errors happened during adding the TXT record, response=KO
• ret='0'
• _CURL='curl -L --silent --dump-header /var/etc/acme-client/home/http.header -g '
• timeout=
• url='https://www.duckdns.org/update?domains=**_acme-challenge**.domain.duckdns.org&token={token}&txt={txt}'
• GET
• url='https://www.duckdns.org/update?domains=**_acme-challenge**.domain.duckdns.org&token={token}&txt={txt}'
• param='domains=_acme-challenge.domain.duckdns.org&token={token}&txt={txt}'
• Trying to add TXT record
• Adding txt value: {txt} for domain: _acme-challenge.domain.duckdns.org

[fraenki]

DuckDNS doesn't allow subdomains, looked through the acmesh-official hub, and could find the info in the matching script.

This seems to be correct. But the dns_duckdns.sh dnsapi file already implements a workaround for this:

https://github.com/acmesh-official/acme.sh/blob/f2d350002e7c387fad9777a42cf9befe34996c35/dnsapi/dns_duckdns.sh#L94-L107

However, it does not seem to work for all users, there is an upstream report for this issue: acmesh-official/acme.sh#2933.

[chiwou]

ahh ok, thanks, now I know what the DNS Alias Mode is for.
Now the certificate gets issued without an error

[RafhaanShah]

Hey @chiwou could you give me a pointer as to which settings you used for the DNS Alias Mode, I'm having the same issue you did. Thanks!

[chiwou]

@RafhaanShah yeah sure, I assume you've your API token

Common Name: yourdomain.duckdns.org I think you can even use a wildcard
DNS Alias Mode: Domain Alias Mode
Domain Alias: yourdomain.duckdns.org

[x56g]

i still run into this issue after setting domain alias. The logs still show "_acme-challenge." as domain prefix. maybe its related to #2128?