mirror of
https://github.com/acme-dns/acme-dns.git
synced 2026-04-27 21:05:49 +03:00
[GH-ISSUE #324] ACME-DNS-API not pulling a certificate for itself #177
Labels
No labels
Documentation
Documentation
bug
enhancement
feature request
feature request
help wanted
pull-request
question
security
security
testing
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
starred/acme-dns#177
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @protogenxl on GitHub (Dec 22, 2022).
Original GitHub issue: https://github.com/acme-dns/acme-dns/issues/324
Hi
I have been working on setting up a acme-dns and have ran into an issue where the web API is not pulling it's own let's encrypt cert. I feel like I am missing something simple but I am to far in to see what is behind me.
Any help would be appreciated
halibut.juggedfish.com will be playing the part of my public dns record
and 8.8.8.8 will be playing the part of my public ip address
ERROR
CONFIG
PUBLIC DNS
@webprofusion-chrisc commented on GitHub (Dec 23, 2022):
Are port 53 DNS queries against your instance working? You are listening on 1053 but will need to port forward this externally from 53 for normal DNS queries to work (you may already be doing that). I'd imagine if that doesn't work then it also won't be able to use itself to complete a DNS challenge for it's own cert. There was/used to be an http-01 challenge mode but I don't know the config to use that instead of DNS validation.
@novakele commented on GitHub (Dec 23, 2022):
Hi @protogenxl, I ran into a similar issue.
In my case, I was running the acme-dns.service as a non-root user, and the user did not have write permission in his home directory. By default, the service uses
WorkingDirectory=~.Are you running the service as root?
EDIT
Does the user runner the service has write permissions in
/etc/acme-dns/api-certs?@protogenxl commented on GitHub (Dec 27, 2022):
@webprofusion-chrisc yes the DNS forward on my firewall seems to working correctly
@novakele I am running the service as acme-dns and permissions appear to be correct
@novakele commented on GitHub (Dec 27, 2022):
It is strange that the owner uid (992) does not resolve to the user acme-dns.
Could you provide the output of
id acme-dns? Should the uid of acme-dns be anything else than 992, that is your problem.Here are the permissions for my instance:
Also, here is the output of the same commands you ran (I use
/var/lib/acme-dnsinstead of/etc/acme-dnsfor the home directory):@p3l1 commented on GitHub (Dec 31, 2022):
See #315, I encountered similar problems. I am using the Dockerfile to run acme-dns.
The v0.8 release works just fine. In my opinion this is not an environment problem, but a problem of the software itself.
On my profile I've got an improved Dockerfile based on the v0.8 release.
@jeffsf commented on GitHub (Feb 2, 2023):
I'm seeing similar behavior to what has been reported here and in #315 on a new installation in FreeBSD 13.1-RELEASE-p5 and the current upstream compiled and packaged
acme-dns-1.0_3,1(installed today).On a subsequent restart, I additionally get
@jeffsf commented on GitHub (Dec 24, 2023):
Confirmed still an issue in FreeBSD 13.2 and package acme-dns-1.0_12,1
No changes in behavior identified
@tigeli commented on GitHub (Feb 9, 2024):
Might be related to this https://github.com/joohoi/acme-dns/issues/339#issuecomment-1935928848
@jeffsf commented on GitHub (Feb 12, 2024):
I did try adding the CAA record as described on #339 with no change in behavior
Removing the entire
/var/db/acme-dns/api-certsdirectory and allowing it to be recreated also did not change the behavior.It appears that the query is coming in for the TXT record. The following appears to repeat periodically.
The requests for the TXT record come in from a variety of IP addresses, including one that reverse-resolves to outbound1g.letsencrypt.org and another to outbound2e.letsencrypt.org
There is no certificate present anywhere under /var/db/acme-dns/api-certs and
openssl s_clientconfirms that there is no certificate available.Edit: For clarity, the instance works through the API to have other clients renew certificates. It just isn't able to take care of its own.
@strobelm commented on GitHub (Apr 17, 2025):
I am observing the same behavior like @jeffsf. Certificates for other domains work well, but acme-dns cannot pull a cert for itself. I am now using certbot to get a certificate, which is at least a workaround. Anyone got a proper solution?
I am running docker compose. My configuration is
@jeffsf commented on GitHub (Sep 8, 2025):
Still looking for a clean solution to this.
Having to hack in the server's own IP address to be able to pull certificates for its own use is annoying, especially in environments where that address changes regularly. Failure to make the proper adjustment doesn't show up until renewals start failing.
@jeffsf commented on GitHub (Feb 2, 2026):
Still broken, as its expired certificate has caused a cascade of problems
@joohoi commented on GitHub (Feb 3, 2026):
The need to configure the actual ip address of the external interface comes
from systemd-resolved hogging the port 53 on a loopback interface, making
it impossible to bind to 0.0.0.0 unfortunately.
On Tue, Feb 3, 2026 at 1.54 Jeff Kletsky @.***> wrote: