I have some trouble by using the acme-dns plugin but cannot find the issue. The (hopefully correct) challenge will be stored in the acme-dns server and can be verified by nslookup. The CNAME record at the main dns server is also configured correctly.
PS C:\acme-clients\win-acme.v2.1.5.742.x64.pluggable> nslookup -type=CNAME _acme-challenge.win.company.test
Server: UnKnown
Address: 10.9.6.44
_acme-challenge.win.company.test canonical name = 92a1c626-cef9-4141-8aa5-d45068a836ce.acme-dns.test
company.test nameserver = ns1.company.test
ns1.company.test internet address = 10.9.6.44
PS C:\acme-clients\win-acme.v2.1.5.742.x64.pluggable> nslookup -type=TXT 92a1c626-cef9-4141-8aa5-d45068a836ce.acme-dns.test 10.9.6.42
Server: UnKnown
Address: 10.9.6.42
92a1c626-cef9-4141-8aa5-d45068a836ce.acme-dns.test text =
"hkmg9Q6YvDeL-vnKD3qtLKQWub5_ti0ZBYUKRHbMh8E"
PS C:\acme-clients\win-acme.v2.1.5.742.x64.pluggable>
If I test my environment with a debian and certbot, the certificate can be issued correctly. But in this case with win-acme and Windows 2016 it does not work because the challenge cannot be verified correctly.
Is it possible to check the received value? In the verbose output the challenge is not written. Or do you have any other idea how to find the issue?
PS C:\acme-clients\win-acme.v2.1.5.742.x64.pluggable> .\wacs.exe --verbose
[VERB] Verbose mode logging enabled
[VERB] Looking for settings.json in C:\acme-clients\win-acme.v2.1.5.742.x64.pluggable
[DBUG] Config folder: C:\ProgramData\win\pgwy.company.testacmedirectory
[DBUG] Log path: ./logs\pgwy.company.testacmedirectory
[DBUG] Cache path: C:\ProgramData\win\pgwy.company.testacmedirectory\Certificates
[VERB] Arguments: --verbose
[DBUG] Renewal period: 55 days
[INFO] A simple Windows ACMEv2 client (WACS)
[INFO] Software version 2.1.5.742 (RELEASE, PLUGGABLE)
[INFO] ACME server https://pgwy.company.test/acme/directory
[VERB] SecurityProtocol setting: SystemDefault
[DBUG] Connection OK!
[INFO] IIS version 10.0
[INFO] Running with administrator credentials
[WARN] Scheduled task not configured yet
[INFO] Please report issues at https://github.com/win-acme/win-acme
[VERB] Test for international support: 語言 язык لغة
N: Create new certificate (simple for IIS)
M: Create new certificate (full options)
R: Run scheduled renewals (0 currently due)
A: Manage renewals (0 total)
O: More options...
Q: Quit
Please choose from the menu: M
[INFO] Running in mode: Interactive, Advanced
Please specify how the list of domain names that will be included in the
certificate should be determined. If you choose for one of the "all bindings"
options, the list will automatically be updated for future renewals to
reflect the bindings at that time.
1: IIS
2: Manual input
3: CSR created by another program
C: Abort
How shall we determine the domain(s) to include in the certificate?: <Enter>
[DBUG] Scanning IIS sites
[DBUG] Scanning IIS site bindings for hosts
Please select which website(s) should be scanned for host names. You may
input one or more site identifiers (comma separated) to filter by those
sites, or alternatively leave the input empty to scan *all* websites.
1: win.company.test (1 binding)
Site identifier(s) or <ENTER> to choose all: <Enter>
[VERB] 1 named bindings found in IIS
[VERB] No site filter applied
[VERB] No host filter applied
[VERB] 1 matching binding found
1: win.company.test (Site 1)
You may either choose to include all listed bindings as host names in your
certificate, or apply an additional filter. Different types of filters are
available.
1: Pick specific bindings from the list
2: Pick bindings based on a search pattern
3: Pick bindings based on a regular expression
4: Pick *all* bindings
How do you want to pick the bindings?: <Enter>
[VERB] 1 named bindings found in IIS
[VERB] No site filter applied
[VERB] No host filter applied
[VERB] 1 matching binding found
[VERB] 1 named bindings found in IIS
[VERB] No site filter applied
[VERB] No host filter applied
[VERB] 1 matching binding found
1: win.company.test (Site 1)
Continue with this selection? (y*/n) - <Enter>
[DBUG] Scanning IIS site bindings for hosts
[VERB] 1 named bindings found in IIS
[VERB] No site filter applied
[VERB] No host filter applied
[VERB] 1 matching binding found
[INFO] Target generated using plugin IIS: win.company.test
Suggested friendly name '[IIS] (any site), (any host)', press <ENTER> to accept or type an alternative: <Enter>
The ACME server will need to verify that you are the owner of the domain
names that you are requesting the certificate for. This happens both during
initial setup *and* for every future renewal. There are two main methods of
doing so: answering specific http requests (http-01) or create specific dns
records (dns-01). For wildcard domains the latter is the only option. Various
additional plugins are available from https://github.com/win-acme/win-acme/.
[VERB] Adding 10.9.6.44 as DNS server
1: [http-01] Save verification files on (network) path
2: [http-01] Serve verification files from memory
3: [http-01] Upload verification files via FTP(S)
4: [http-01] Upload verification files via SSH-FTP
5: [http-01] Upload verification files via WebDav
6: [dns-01] Create verification records manually (auto-renew not possible)
7: [dns-01] Create verification records with acme-dns (https://github.com/joohoi/acme-dns)
8: [dns-01] Create verification records with your own script
9: [tls-alpn-01] Answer TLS verification request from win-acme
C: Abort
How would you like prove ownership for the domain(s) in the certificate?: 7
URL of the acme-dns server: https://acme-dns.test
[DBUG] Using C:\ProgramData\win\acme-dns\acme-dns.test for acme-dns configuration
[INFO] Creating new acme-dns registration for domain win.company.test
Domain: win.company.test
Record: _acme-challenge.win.company.test
Type: CNAME
Content: 92a1c626-cef9-4141-8aa5-d45068a836ce.acme-dns.test.
Note: Some DNS control panels add the final dot automatically.
Only one is required.
Please press <Enter> after you've created and verified the record
[VERB] Querying server 10.9.6.44 about test
[DBUG] Querying name servers for test
[VERB] Querying server 10.9.6.44 about company.test
[DBUG] Querying name servers for company.test
[VERB] Querying IP for name server
[VERB] Name server IP 10.9.6.44 identified
[VERB] Querying server 10.9.6.44 about win.company.test
[DBUG] Querying name servers for win.company.test
[DBUG] Configuration will now be checked at name servers: 10.9.6.44
[VERB] Verification of CNAME record successful at server 10.9.6.44
[INFO] Verification of acme-dns configuration succesful.
After ownership of the domain(s) has been proven, we will create a
Certificate Signing Request (CSR) to obtain the actual certificate. The CSR
determines properties of the certificate like which (type of) key to use. If
you are not sure what to pick here, RSA is the safe default.
1: Elliptic Curve key
2: RSA key
What kind of private key should be used for the certificate?: <Enter>
When we have the certificate, you can store in one or more ways to make it
accessible to your applications. The Windows Certificate Store is the default
location for IIS (unless you are managing a cluster of them).
1: IIS Central Certificate Store (.pfx per domain)
2: PEM encoded files (Apache, nginx, etc.)
3: Windows Certificate Store
4: No (additional) store steps
C: Abort
How would you like to store the certificate?: <Enter>
1: IIS Central Certificate Store (.pfx per domain)
2: PEM encoded files (Apache, nginx, etc.)
3: No (additional) store steps
C: Abort
Would you like to store it in another way too?: <Enter>
With the certificate saved to the store(s) of your choice, you may choose one
or more steps to update your applications, e.g. to configure the new
thumbprint, or to update bindings.
1: Create or update https bindings in IIS
2: Create or update ftps bindings in IIS
3: Start external script or program
4: No (additional) installation steps
Which installation step should run first?: <Enter>
Use different site for installation? (y/n*) - <Enter>
1: Create or update ftps bindings in IIS
2: Start external script or program
3: No (additional) installation steps
Add another installation step?: <Enter>
[DBUG] Scanning IIS site bindings for hosts
[VERB] 1 named bindings found in IIS
[VERB] No site filter applied
[VERB] No host filter applied
[VERB] 1 matching binding found
[VERB] Checking [IIS] (any site), (any host)
[VERB] Creating certificate order for hosts: ["win.company.test"]
[VERB] Loading ACME account signer...
[VERB] Constructing ACME protocol client...
[DBUG] Send GET request to https://pgwy.company.test/acme/directory
[VERB] Request completed with status OK
[DBUG] Send HEAD request to https://pgwy.company.test/acme/directory/new-nonce
[VERB] Request completed with status OK
Enter email(s) for notifications about problems and abuse (comma seperated): win-acme@company.test
[DBUG] Send POST request to https://pgwy.company.test/acme/directory/new-account
[VERB] Request completed with status Created
[DBUG] Saving registration
[DBUG] Saving signer to C:\ProgramData\win\pgwy.company.testacmedirectory\Signer_v2
[DBUG] Send POST request to https://pgwy.company.test/acme/directory/new-order
[VERB] Request completed with status Created
[VERB] Order https://pgwy.company.test/acme/directory/orders/bk2KWvfEn57DdMm5b31Dzw created
[VERB] Handle authorization 1/2
[DBUG] Send POST request to https://pgwy.company.test/acme/directory/orders/bk2KWvfEn57DdMm5b31Dzw/authz/6Fb7L0Oh-nJQrxdhCJVRqg
[VERB] Request completed with status OK
[INFO] Authorize identifier: win.company.test
[VERB] Challenge types available: ["http-01", "dns-01"]
[INFO] Authorizing win.company.test using dns-01 validation (acme-dns)
[DBUG] Using C:\ProgramData\win\acme-dns\acme-dns.test for acme-dns configuration
[DBUG] Configuration will now be checked at name servers: 10.9.6.44
[VERB] Verification of CNAME record successful at server 10.9.6.44
[INFO] Verification of acme-dns configuration succesful.
[DBUG] Sending update request to acme-dns server at https://acme-dns.test/ for domain win.company.test
[INFO] Answer should now be available at _acme-challenge.win.company.test
[VERB] Querying server 10.9.6.44 about _acme-challenge.win.company.test
[DBUG] Querying name servers for _acme-challenge.win.company.test
[DBUG] Preliminary validation will now check name server 10.9.6.44
[VERB] Querying server 10.9.6.44 about acme-dns.test
[DBUG] Querying name servers for acme-dns.test
[VERB] Querying IP for name server
[VERB] Name server IP 10.9.6.42 identified
[VERB] Querying server 10.9.6.42 about 92a1c626-cef9-4141-8aa5-d45068a836ce.acme-dns.test
[DBUG] Querying name servers for 92a1c626-cef9-4141-8aa5-d45068a836ce.acme-dns.test
[DBUG] Name server 10.9.6.42 selected
[DBUG] Preliminary validation at 10.9.6.44 looks good!
[INFO] Preliminary validation succeeded
[DBUG] Submitting challenge answer
[DBUG] Send POST request to https://pgwy.company.test/acme/directory/orders/bk2KWvfEn57DdMm5b31Dzw/authz/6Fb7L0Oh-nJQrxdhCJVRqg/dns-01
[VERB] Request completed with status OK
[EROR] {
"type": "urn:ietf:params:acme:error:incorrectResponse",
"detail": "Could not validate dns-01 challenge"
}
[EROR] Authorization result: invalid
[VERB] Starting post-validation cleanup
[VERB] Post-validation cleanup was succesful
Create certificate failed, retry? (y/n*)
I have some trouble by using the acme-dns plugin but cannot find the issue. The (hopefully correct) challenge will be stored in the acme-dns server and can be verified by nslookup. The CNAME record at the main dns server is also configured correctly.
If I test my environment with a debian and certbot, the certificate can be issued correctly. But in this case with win-acme and Windows 2016 it does not work because the challenge cannot be verified correctly.
Is it possible to check the received value? In the verbose output the challenge is not written. Or do you have any other idea how to find the issue?