acme-client: DNS-01/nsupdate: doesn't allow FQDN in the name

[lrosenman]

when you put a FQDN in a certificate name request, you get: Should be a string between 1 and 255 characters.

if you remove all the special characters (INCLUDING PERIODS(!!)), it sends the unqualified name as the CN= to LE, and gets a 400 error:

[Sun Feb 5 00:00:07 CST 2017] new-authz error: {"type":"urn:acme:error:malformed","detail":"DNS name does not have enough labels","status": 400}
[Sun Feb 5 00:00:07 CST 2017] The new-authz request is ok.

This makes it IMPOSSIBLE to generate a certiificate.

Also, it is unclear what is supposed to go in the secret field of the validation request. The whole key file, or just the secret or what.

[snetAT]

Same problem, it is not possible to use a name like srv-1.example.com

[nemesix29]

Same issue when my FQDN contain a hyphen.

It's possible to modify fields validation ?

[fraenki]

Thanks for the report, I'm preparing a fix.

[fraenki]

A fix is included in PR #71.

[lrosenman]

Can you clarify the nsupdate secret key field?

[fraenki]

@lrosenman: You need to put in the whole key file, see the example in my initial PR #66. I'll fix the help text, though.

[lrosenman]

@fraenki Thanks!

[nemesix29]

Thanks !

[fraenki]

FYI, the fix will be available on thursday with OPNsense 17.1.1 :)