[GH-ISSUE #575] [Bug] Cloudflare DNS无法申请证书 #379

New issue

Closed

opened 2026-03-03 01:02:53 +03:00 by kerem · 10 comments

kerem commented 2026-03-03 01:02:53 +03:00

Owner

Copy link

Originally created by @devnakx on GitHub (Mar 31, 2025).
Original GitHub issue: https://github.com/certimate-go/certimate/issues/575

软件版本 / Release Version

v0.3.6

缺陷描述 / Description

一直提示acme: error presenting token: cloudflare: failed to find zone win.: zone could not be found

API令牌权限：

尝试打开了关闭 CNAME 跟随开关也无用：

复现步骤 / Steps to reproduce

1. 申请证书
2. DNS 提供商授权使用Cloudflare

日志 / Logs

2025/03/31 14:47:04 INFO [CERTIMATE] Visit the website: http://0.0.0.0:8090
2025/03/31 14:47:28 [INFO] [devnak.win, *.devnak.win] acme: Obtaining bundled SAN certificate
2025/03/31 14:47:30 [INFO] [*.devnak.win] AuthURL: https://acme-v02.api.letsencrypt.org/acme/authz/***/***
2025/03/31 14:47:30 [INFO] [devnak.win] AuthURL: https://acme-v02.api.letsencrypt.org/acme/authz/***/***
2025/03/31 14:47:30 [INFO] [*.devnak.win] acme: use dns-01 solver
2025/03/31 14:47:30 [INFO] [devnak.win] acme: Could not find solver for: tls-alpn-01
2025/03/31 14:47:30 [INFO] [devnak.win] acme: Could not find solver for: http-01
2025/03/31 14:47:30 [INFO] [devnak.win] acme: use dns-01 solver
2025/03/31 14:47:30 [INFO] [*.devnak.win] acme: Preparing to solve DNS-01
2025/03/31 14:47:30 [INFO] [devnak.win] acme: Preparing to solve DNS-01
2025/03/31 14:47:31 [INFO] [*.devnak.win] acme: Cleaning DNS-01 challenge
2025/03/31 14:47:31 [WARN] [*.devnak.win] acme: cleaning up failed: cloudflare: failed to find zone win.: zone could not be found 
2025/03/31 14:47:31 [INFO] [devnak.win] acme: Cleaning DNS-01 challenge
2025/03/31 14:47:31 [WARN] [devnak.win] acme: cleaning up failed: cloudflare: failed to find zone win.: zone could not be found 
2025/03/31 14:47:32 [INFO] Deactivating auth: https://acme-v02.api.letsencrypt.org/acme/authz/***/***
2025/03/31 14:47:32 [INFO] Deactivating auth: https://acme-v02.api.letsencrypt.org/acme/authz/***/***

其他 / Miscellaneous

No response

Originally created by @devnakx on GitHub (Mar 31, 2025). Original GitHub issue: https://github.com/certimate-go/certimate/issues/575 ### 软件版本 / Release Version v0.3.6 ### 缺陷描述 / Description 一直提示`acme: error presenting token: cloudflare: failed to find zone win.: zone could not be found`  API令牌权限：  尝试打开了`关闭 CNAME 跟随`开关也无用：  ### 复现步骤 / Steps to reproduce 1. 申请证书 2. DNS 提供商授权使用`Cloudflare` ### 日志 / Logs <details> ```console 2025/03/31 14:47:04 INFO [CERTIMATE] Visit the website: http://0.0.0.0:8090 2025/03/31 14:47:28 [INFO] [devnak.win, *.devnak.win] acme: Obtaining bundled SAN certificate 2025/03/31 14:47:30 [INFO] [*.devnak.win] AuthURL: https://acme-v02.api.letsencrypt.org/acme/authz/***/*** 2025/03/31 14:47:30 [INFO] [devnak.win] AuthURL: https://acme-v02.api.letsencrypt.org/acme/authz/***/*** 2025/03/31 14:47:30 [INFO] [*.devnak.win] acme: use dns-01 solver 2025/03/31 14:47:30 [INFO] [devnak.win] acme: Could not find solver for: tls-alpn-01 2025/03/31 14:47:30 [INFO] [devnak.win] acme: Could not find solver for: http-01 2025/03/31 14:47:30 [INFO] [devnak.win] acme: use dns-01 solver 2025/03/31 14:47:30 [INFO] [*.devnak.win] acme: Preparing to solve DNS-01 2025/03/31 14:47:30 [INFO] [devnak.win] acme: Preparing to solve DNS-01 2025/03/31 14:47:31 [INFO] [*.devnak.win] acme: Cleaning DNS-01 challenge 2025/03/31 14:47:31 [WARN] [*.devnak.win] acme: cleaning up failed: cloudflare: failed to find zone win.: zone could not be found 2025/03/31 14:47:31 [INFO] [devnak.win] acme: Cleaning DNS-01 challenge 2025/03/31 14:47:31 [WARN] [devnak.win] acme: cleaning up failed: cloudflare: failed to find zone win.: zone could not be found 2025/03/31 14:47:32 [INFO] Deactivating auth: https://acme-v02.api.letsencrypt.org/acme/authz/***/*** 2025/03/31 14:47:32 [INFO] Deactivating auth: https://acme-v02.api.letsencrypt.org/acme/authz/***/*** ``` </details> ### 其他 / Miscellaneous _No response_

kerem 2026-03-03 01:02:53 +03:00

• closed this issue
• added the
  bug
  good first issue
  labels

kerem commented 2026-03-03 01:02:54 +03:00

Author

Owner

Copy link

@fudiwei commented on GitHub (Mar 31, 2025):

试试 DNS 递归服务器加个 8.8.8.8

<!-- gh-comment-id:2765362039 --> @fudiwei commented on GitHub (Mar 31, 2025): 试试 DNS 递归服务器加个 `8.8.8.8`

kerem commented 2026-03-03 01:02:54 +03:00

Author

Owner

Copy link

@devnakx commented on GitHub (Mar 31, 2025):

试试 DNS 递归服务器加个 8.8.8.8

尝试了，也没用，还是同样的错误日志

<!-- gh-comment-id:2765376391 --> @devnakx commented on GitHub (Mar 31, 2025): > 试试 DNS 递归服务器加个 `8.8.8.8` 尝试了，也没用，还是同样的错误日志

kerem commented 2026-03-03 01:02:54 +03:00

Author

Owner

Copy link

@devnakx commented on GitHub (Mar 31, 2025):

应该和DNS递归服务器无关，感觉是 Certimate 对 Cloudflare DNS 提供商的处理代码有问题，因为报错提示failed to find zone win.实际上应该找devnak.win的 zone 而非顶级域win.

<!-- gh-comment-id:2765397415 --> @devnakx commented on GitHub (Mar 31, 2025): 应该和`DNS递归服务器`无关，感觉是 Certimate 对 Cloudflare DNS 提供商的处理代码有问题，因为报错提示`failed to find zone win.`实际上应该找`devnak.win`的 zone 而非顶级域`win.`

kerem commented 2026-03-03 01:02:54 +03:00

Author

Owner

Copy link

@hzgotb commented on GitHub (Mar 31, 2025):

我也是cf，token的权限是账号级的DNS编辑。但是是出现这样的问题。用docker部署的。

<!-- gh-comment-id:2765406756 --> @hzgotb commented on GitHub (Mar 31, 2025):  我也是cf，token的权限是账号级的DNS编辑。但是是出现这样的问题。用docker部署的。

kerem commented 2026-03-03 01:02:54 +03:00

Author

Owner

Copy link

@devnakx commented on GitHub (Mar 31, 2025):

@hzgotb 你这个报错和我的不一样，建议新开一个 Issue 方便开发者跟进
不建议不同的问题在一个 Issue 里反馈

<!-- gh-comment-id:2765413826 --> @devnakx commented on GitHub (Mar 31, 2025): @hzgotb 你这个报错和我的不一样，建议新开一个 Issue 方便开发者跟进 不建议不同的问题在一个 Issue 里反馈

kerem commented 2026-03-03 01:02:54 +03:00

Author

Owner

Copy link

@fudiwei commented on GitHub (Mar 31, 2025):

根据上游依赖 go-acme/lego 的要求，目前你需要分配权限为所有域而非指定域。

后续会支持更细粒度的权限。

<!-- gh-comment-id:2765586420 --> @fudiwei commented on GitHub (Mar 31, 2025): >  根据上游依赖 [go-acme/lego](https://go-acme.github.io/lego/dns/cloudflare/#api-tokens) 的要求，目前你需要分配权限为所有域而非指定域。 后续会支持更细粒度的权限。

kerem commented 2026-03-03 01:02:54 +03:00

Author

Owner

Copy link

@devnakx commented on GitHub (Mar 31, 2025):

根据上游依赖 go-acme/lego 的要求，目前你需要分配权限为所有域而非指定域。

后续会支持更细粒度的权限。

我一直设置的就是All zones，只是一开始就这样报错，所以后来我尝试添加Zone.Zone.Read权限并改为指定域了

改回All zones刚重新执行了一下也是相同结果：

<!-- gh-comment-id:2765610330 --> @devnakx commented on GitHub (Mar 31, 2025): > >  > > 根据上游依赖 [go-acme/lego](https://go-acme.github.io/lego/dns/cloudflare/#api-tokens) 的要求，目前你需要分配权限为所有域而非指定域。 > > 后续会支持更细粒度的权限。 我一直设置的就是`All zones`，只是一开始就这样报错，所以后来我尝试添加`Zone.Zone.Read`权限并改为指定域了  改回`All zones`刚重新执行了一下也是相同结果： 

kerem commented 2026-03-03 01:02:54 +03:00

Author

Owner

Copy link

@fudiwei commented on GitHub (Mar 31, 2025):

应该和DNS递归服务器无关，感觉是 Certimate 对 Cloudflare DNS 提供商的处理代码有问题，因为报错提示failed to find zone win.实际上应该找devnak.win的 zone 而非顶级域win.

这部分逻辑由上游依赖 go-acme/lego 实现，Certimate 只是调用它。日志里出现顶级域而非你的二级域名的原因在于 DNS 解析错误，lego 在试图查询 SOA 记录时得到了错误的结果，而指定一个靠谱的递归服务器是规避此问题的一个常见措施。

设置 8.8.8.8 后有重启过 Certimate 吗？如果没有可以试试重启（目的是清除 DNS 缓存）。

<!-- gh-comment-id:2766064370 --> @fudiwei commented on GitHub (Mar 31, 2025): > 应该和`DNS递归服务器`无关，感觉是 Certimate 对 Cloudflare DNS 提供商的处理代码有问题，因为报错提示`failed to find zone win.`实际上应该找`devnak.win`的 zone 而非顶级域`win.` 这部分逻辑由上游依赖 [go-acme/lego](https://github.com/go-acme/lego) 实现，Certimate 只是调用它。日志里出现顶级域而非你的二级域名的原因在于 DNS 解析错误，lego 在试图查询 SOA 记录时得到了错误的结果，而指定一个靠谱的递归服务器是规避此问题的一个常见措施。 设置 `8.8.8.8` 后有重启过 Certimate 吗？如果没有可以试试重启（目的是清除 DNS 缓存）。

kerem commented 2026-03-03 01:02:54 +03:00

Author

Owner

Copy link

@devnakx commented on GitHub (Mar 31, 2025):

这部分逻辑由上游依赖 go-acme/lego 实现，Certimate 只是调用它。日志里出现顶级域而非你的二级域名的原因在于 DNS 解析错误，lego 在试图查询 SOA 记录时得到了错误的结果，而指定一个靠谱的递归服务器是规避此问题的一个常见措施。

有关于这方面的详细指南吗？比如查询了哪些 SOA 记录？因为我是在 OpenWrt 网关上运行smartdns程序自建的本地 dns 服务器，并在nftables中添加了重定向规则将下级设备的 dns 请求全都劫持到smartdns处理，而我在smartdns中配置的上游 dns 就有8.8.8.8
↑↑↑ 这个我找到原因了，是因为我在smartdns的下游adguardhome中对devnak.win主域名重写了A记录（用于局域网设备解析到内网服务）但没有限定重写A记录，导致 SOA/TXT 等记录全部被重写后丢弃了（表现为查询 SOA 或 TXT 等记录返回响应码NOERROR但是为空值）

设置 8.8.8.8 后有重启过 Certimate 吗？如果没有可以试试重启（目的是清除 DNS 缓存）。

我把上级网关的重定向规则删除后，出现新的报错：（为方便可读，已手动换行）

error: one or more domains had a problem: 

[*.devnak.win] invalid authorization: 
acme: error: 400 :: urn:ietf:params:acme:error:dns :: 
DNS problem: NXDOMAIN looking up TXT for _acme-challenge.devnak.win - check that a DNS record exists for this domain 

[devnak.win] invalid authorization: 
acme: error: 400 :: urn:ietf:params:acme:error:dns :: 
DNS problem: NXDOMAIN looking up TXT for _acme-challenge.devnak.win - check that a DNS record exists for this domain

Certimate 日志：

2025/03/31 21:17:46 INFO [CERTIMATE] Visit the website: http://0.0.0.0:8090
2025/03/31 21:17:51 [INFO] [devnak.win, *.devnak.win] acme: Obtaining bundled SAN certificate
2025/03/31 21:17:52 [INFO] [*.devnak.win] AuthURL: https://acme-v02.api.letsencrypt.org/acme/authz/*/*
2025/03/31 21:17:52 [INFO] [devnak.win] AuthURL: https://acme-v02.api.letsencrypt.org/acme/authz/*/*
2025/03/31 21:17:52 [INFO] [*.devnak.win] acme: use dns-01 solver
2025/03/31 21:17:52 [INFO] [devnak.win] acme: Could not find solver for: tls-alpn-01
2025/03/31 21:17:52 [INFO] [devnak.win] acme: Could not find solver for: http-01
2025/03/31 21:17:52 [INFO] [devnak.win] acme: use dns-01 solver
2025/03/31 21:17:52 [INFO] [*.devnak.win] acme: Preparing to solve DNS-01
2025/03/31 21:17:53 [INFO] cloudflare: new record for devnak.win, ID 2157513f500006d503c874ea01241d31
2025/03/31 21:17:53 [INFO] [devnak.win] acme: Preparing to solve DNS-01
2025/03/31 21:17:54 [INFO] cloudflare: new record for devnak.win, ID f7728c68c33f1851e36aa3c2ed951ba1
2025/03/31 21:17:54 [INFO] [*.devnak.win] acme: Trying to solve DNS-01
2025/03/31 21:17:54 [INFO] [*.devnak.win] acme: Checking DNS record propagation. [nameservers=8.8.8.8:53]
2025/03/31 21:17:56 [INFO] Wait for propagation [timeout: 2m0s, interval: 2s]
2025/03/31 21:17:56 [INFO] [devnak.win] acme: Trying to solve DNS-01
2025/03/31 21:17:56 [INFO] [devnak.win] acme: Checking DNS record propagation. [nameservers=8.8.8.8:53]
2025/03/31 21:17:58 [INFO] Wait for propagation [timeout: 2m0s, interval: 2s]
2025/03/31 21:17:59 [INFO] [*.devnak.win] acme: Cleaning DNS-01 challenge
2025/03/31 21:17:59 [INFO] [devnak.win] acme: Cleaning DNS-01 challenge
2025/03/31 21:18:00 [INFO] Deactivating auth: https://acme-v02.api.letsencrypt.org/acme/authz/*/*
2025/03/31 21:18:01 [INFO] Deactivating auth: https://acme-v02.api.letsencrypt.org/acme/authz/*/*

观察到其中两行日志：

2025/03/31 21:17:54 [INFO] [*.devnak.win] acme: Checking DNS record propagation. [nameservers=8.8.8.8:53]
2025/03/31 21:17:56 [INFO] Wait for propagation [timeout: 2m0s, interval: 2s]

和

2025/03/31 21:17:56 [INFO] [devnak.win] acme: Checking DNS record propagation. [nameservers=8.8.8.8:53]
2025/03/31 21:17:58 [INFO] Wait for propagation [timeout: 2m0s, interval: 2s]

似乎这个Checking DNS record propagation只 check 了一次？
我之前在Let's Encrypt 测试环境反复尝试了许多次才验证成功了
后面想要重新在生产环境中申请又这样了，如果像测试环境那样反复尝试的话估计试不了几次就会触发限制了。

<!-- gh-comment-id:2766234096 --> @devnakx commented on GitHub (Mar 31, 2025): > 这部分逻辑由上游依赖 [go-acme/lego](https://github.com/go-acme/lego) 实现，Certimate 只是调用它。日志里出现顶级域而非你的二级域名的原因在于 DNS 解析错误，lego 在试图查询 SOA 记录时得到了错误的结果，而指定一个靠谱的递归服务器是规避此问题的一个常见措施。 ~有关于这方面的详细指南吗？比如查询了哪些 SOA 记录？因为我是在 OpenWrt 网关上运行[smartdns](https://pymumu.github.io/smartdns/)程序自建的本地 dns 服务器，并在`nftables`中添加了重定向规则将下级设备的 dns 请求全都劫持到`smartdns`处理，而我在`smartdns`中配置的上游 dns 就有`8.8.8.8`~ ↑↑↑ 这个我找到原因了，是因为我在`smartdns`的下游[adguardhome](https://github.com/AdguardTeam/AdGuardHome)中对`devnak.win`主域名重写了`A`记录（用于局域网设备解析到内网服务）但没有限定重写`A`记录，导致 SOA/TXT 等记录全部被重写后丢弃了（表现为查询 SOA 或 TXT 等记录返回响应码`NOERROR`但是为空值） > 设置 `8.8.8.8` 后有重启过 Certimate 吗？如果没有可以试试重启（目的是清除 DNS 缓存）。 我把上级网关的重定向规则删除后，出现新的报错：（为方便可读，已手动换行） ``` error: one or more domains had a problem: [*.devnak.win] invalid authorization: acme: error: 400 :: urn:ietf:params:acme:error:dns :: DNS problem: NXDOMAIN looking up TXT for _acme-challenge.devnak.win - check that a DNS record exists for this domain [devnak.win] invalid authorization: acme: error: 400 :: urn:ietf:params:acme:error:dns :: DNS problem: NXDOMAIN looking up TXT for _acme-challenge.devnak.win - check that a DNS record exists for this domain ``` Certimate 日志： ```console 2025/03/31 21:17:46 INFO [CERTIMATE] Visit the website: http://0.0.0.0:8090 2025/03/31 21:17:51 [INFO] [devnak.win, *.devnak.win] acme: Obtaining bundled SAN certificate 2025/03/31 21:17:52 [INFO] [*.devnak.win] AuthURL: https://acme-v02.api.letsencrypt.org/acme/authz/*/* 2025/03/31 21:17:52 [INFO] [devnak.win] AuthURL: https://acme-v02.api.letsencrypt.org/acme/authz/*/* 2025/03/31 21:17:52 [INFO] [*.devnak.win] acme: use dns-01 solver 2025/03/31 21:17:52 [INFO] [devnak.win] acme: Could not find solver for: tls-alpn-01 2025/03/31 21:17:52 [INFO] [devnak.win] acme: Could not find solver for: http-01 2025/03/31 21:17:52 [INFO] [devnak.win] acme: use dns-01 solver 2025/03/31 21:17:52 [INFO] [*.devnak.win] acme: Preparing to solve DNS-01 2025/03/31 21:17:53 [INFO] cloudflare: new record for devnak.win, ID 2157513f500006d503c874ea01241d31 2025/03/31 21:17:53 [INFO] [devnak.win] acme: Preparing to solve DNS-01 2025/03/31 21:17:54 [INFO] cloudflare: new record for devnak.win, ID f7728c68c33f1851e36aa3c2ed951ba1 2025/03/31 21:17:54 [INFO] [*.devnak.win] acme: Trying to solve DNS-01 2025/03/31 21:17:54 [INFO] [*.devnak.win] acme: Checking DNS record propagation. [nameservers=8.8.8.8:53] 2025/03/31 21:17:56 [INFO] Wait for propagation [timeout: 2m0s, interval: 2s] 2025/03/31 21:17:56 [INFO] [devnak.win] acme: Trying to solve DNS-01 2025/03/31 21:17:56 [INFO] [devnak.win] acme: Checking DNS record propagation. [nameservers=8.8.8.8:53] 2025/03/31 21:17:58 [INFO] Wait for propagation [timeout: 2m0s, interval: 2s] 2025/03/31 21:17:59 [INFO] [*.devnak.win] acme: Cleaning DNS-01 challenge 2025/03/31 21:17:59 [INFO] [devnak.win] acme: Cleaning DNS-01 challenge 2025/03/31 21:18:00 [INFO] Deactivating auth: https://acme-v02.api.letsencrypt.org/acme/authz/*/* 2025/03/31 21:18:01 [INFO] Deactivating auth: https://acme-v02.api.letsencrypt.org/acme/authz/*/* ``` 观察到其中两行日志： ```console 2025/03/31 21:17:54 [INFO] [*.devnak.win] acme: Checking DNS record propagation. [nameservers=8.8.8.8:53] 2025/03/31 21:17:56 [INFO] Wait for propagation [timeout: 2m0s, interval: 2s] ``` 和 ```console 2025/03/31 21:17:56 [INFO] [devnak.win] acme: Checking DNS record propagation. [nameservers=8.8.8.8:53] 2025/03/31 21:17:58 [INFO] Wait for propagation [timeout: 2m0s, interval: 2s] ``` 似乎这个`Checking DNS record propagation`只 check 了一次？ 我之前在`Let's Encrypt 测试环境`反复尝试了许多次才验证成功了 后面想要重新在生产环境中申请又这样了，如果像测试环境那样反复尝试的话估计试不了几次就会触发限制了。

kerem commented 2026-03-03 01:02:54 +03:00

Author

Owner

Copy link

@devnakx commented on GitHub (Mar 31, 2025):

目前已成功申请到证书，我先把这个 issue 关闭了
等后面续期的时候看看acme: error: 400 :: urn:ietf:params:acme:error:dns ::这个问题会不会复现

<!-- gh-comment-id:2766562312 --> @devnakx commented on GitHub (Mar 31, 2025): 目前已成功申请到证书，我先把这个 issue 关闭了 等后面续期的时候看看`acme: error: 400 :: urn:ietf:params:acme:error:dns ::`这个问题会不会复现

kerem referenced this issue 2026-03-03 01:06:54 +03:00

[PR #375] [MERGED] feat: new UI #932

Sign in to join this conversation.

No Branch/Tag specified

Branches Tags

main

next

archive/v0.3

archive/v0.2

v0.4.21

v0.4.20

v0.4.19

v0.4.18

v0.4.17

v0.4.16

v0.4.15

v0.4.14

v0.4.13

v0.4.12

v0.4.11

v0.4.10

v0.4.9

v0.4.8

v0.4.7

v0.4.6

v0.4.5

v0.4.4

v0.4.3

v0.4.2

v0.4.1

v0.4.0

v0.3.27

v0.3.26

v0.3.25

v0.3.24

v0.3.23

v0.3.22

v0.3.21

v0.3.20

v0.3.19

v0.3.18

v0.3.17

v0.3.16

v0.3.15

v0.3.14

v0.3.13

v0.3.12

v0.3.11

v0.3.10

v0.3.9

v0.3.8

v0.3.7

v0.3.6

v0.3.5

v0.3.4

v0.3.3

v0.3.2

v0.3.1

v0.3.0

v0.2.24-beta

v0.2.23-beta

v0.2.21

v0.2.20

v0.2.19

v0.2.18

v0.2.17

v0.2.16

v0.2.15

v0.2.14

v0.2.13

v0.2.12

v0.2.11

v0.2.10

v0.2.9

v0.2.8

v0.2.7

v0.2.6

v0.2.5

v0.2.4

v0.2.3

v0.2.2

v0.2.1

v0.2.0

v0.1.19

v0.1.18

v0.1.17

v0.1.16

v0.1.15

v0.1.14

v0.1.13

v0.1.12

v0.1.11

v0.1.10

v0.1.9

v0.1.8

v0.1.7

v0.1.6

v0.1.5

v0.1.4

v0.1.3

v0.1.2

v0.1.1

v0.1.0

v0.0.1

Labels

Clear labels   

announcement

  

backlog

  

bug

  

declined

  

documentation

  

duplicate

  

enhancement

  

good first issue

  

good first issue

  

help wanted

  

invalid

  

pull-request

Mirrored from GitHub Pull Request

  

question

  

stale

No labels

announcement

backlog

bug

declined

documentation

duplicate

enhancement

good first issue

good first issue

help wanted

invalid

pull-request

question

stale

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/certimate#379

No description provided.