[GH-ISSUE #1198] [Bug] The workflow stated "Failed" but actually succeeded when using deSEC #813

New issue

Open

opened 2026-03-03 01:06:11 +03:00 by kerem · 1 comment

kerem commented

2026-03-03 01:06:11 +03:00

Owner

Originally created by @FarrelF on GitHub (Feb 19, 2026).
Original GitHub issue: https://github.com/certimate-go/certimate/issues/1198

Release Version / 软件版本

v0.4.17

Description / 缺陷描述

I have encountered a rather peculiar bug when using deSEC as a DNS provider to complete the ACME challenge when issuing certificates. You can see the screenshot below for error message:

The certificate has been successfully issued, but the workflow is stated as "Failed", even though it was successful to the extent that it immediately proceeded to another node after issuing the certificate instead of sending a notification.

I suspect that the debug message in the log is being treated as an error message, which is why the workflow is stated as "Failed", and the debug text in the log itself is coloured red. The screenshot is shown below: (Some information has been redacted by overlaying it with red rectangles)

Steps to reproduce / 复现步骤

Create a empty workflow
Add "Request certificate" node in the workflow
Use staging CA for testing, recommend to using Let's Encrypt Staging Environment
Use deSEC as a DNS Provider
Apply changes, save and publish the workflow
Execute the workflow

Logs / 日志

The contents of the log file are as follows: (Some information has been redacted, for example the Account ID has been redacted by changing it's Account ID to random number)

Log file content

#QkiS-ZEghWCbpdJICUPfF Start
[2026-02-20T01:32:59.469+07:00] [INFO] the workflow is starting

#FXK4gAdsWBPSVXA_f2Obd Issue a Staging Certificate
[2026-02-20T01:32:59.480+07:00] [INFO] ready to request certificate ... {"config":{"domains":["tls-staging.farrelf.blog","*.tls-staging.farrelf.blog"],"ipaddrs":[],"contactEmail":"mail@example.com","challengeType":"dns-01","provider":"desec","providerAccessId":"kqfwnznc8pj83iw","caProvider":"letsencryptstaging","keySource":"auto","keyAlgorithm":"RSA4096","dnsPropagationWait":120,"dnsPropagationTimeout":300,"skipBeforeExpiryDays":30}}
[2026-02-20T01:32:59.497+07:00] [INFO] no found last requested certificate, begin to apply
[2026-02-20T01:32:59.510+07:00] [INFO] acme config initialized {"acmeDirUrl":"https://acme-staging-v02.api.letsencrypt.org/directory"}
[2026-02-20T01:32:59.521+07:00] [INFO] acme account initialized {"acmeAcctUrl":"https://acme-staging-v02.api.letsencrypt.org/acme/acct/205145895"}
[2026-02-20T01:33:07.183+07:00] [INFO] [tls-staging.farrelf.blog, *.tls-staging.farrelf.blog] acme: Obtaining bundled SAN certificate
[2026-02-20T01:33:08.714+07:00] [INFO] [*.tls-staging.farrelf.blog] AuthURL: https://acme-staging-v02.api.letsencrypt.org/acme/authz/205145895/21810933983
[2026-02-20T01:33:08.722+07:00] [INFO] [tls-staging.farrelf.blog] AuthURL: https://acme-staging-v02.api.letsencrypt.org/acme/authz/205145895/21810933993
[2026-02-20T01:33:08.729+07:00] [INFO] [*.tls-staging.farrelf.blog] acme: use dns-01 solver
[2026-02-20T01:33:08.734+07:00] [INFO] [tls-staging.farrelf.blog] acme: Could not find solver for: tls-alpn-01
[2026-02-20T01:33:08.739+07:00] [INFO] [tls-staging.farrelf.blog] acme: Could not find solver for: http-01
[2026-02-20T01:33:08.744+07:00] [INFO] [tls-staging.farrelf.blog] acme: use dns-01 solver
[2026-02-20T01:33:08.748+07:00] [INFO] [*.tls-staging.farrelf.blog] acme: Preparing to solve DNS-01
[2026-02-20T01:33:08.756+07:00] [INFO] Found CNAME entry for "_acme-challenge.tls-staging.farrelf.blog.": "tls-staging.farrelf.blog._acme-aliases.farrelf.dedyn.io."
[2026-02-20T01:33:09.148+07:00] [ERRO] 2026/02/19 18:33:09 [DEBUG] GET https://desec.io/api/v1/domains/farrelf.dedyn.io/rrsets/tls-staging.farrelf.blog._acme-aliases/TXT/
[2026-02-20T01:33:09.781+07:00] [ERRO] 2026/02/19 18:33:09 [DEBUG] POST https://desec.io/api/v1/domains/farrelf.dedyn.io/rrsets/
[2026-02-20T01:33:10.105+07:00] [INFO] [tls-staging.farrelf.blog] acme: Preparing to solve DNS-01
[2026-02-20T01:33:11.867+07:00] [ERRO] 2026/02/19 18:33:10 [DEBUG] GET https://desec.io/api/v1/domains/farrelf.dedyn.io/rrsets/tls-staging.farrelf.blog._acme-aliases/TXT/
[2026-02-20T01:33:11.883+07:00] [INFO] Found CNAME entry for "_acme-challenge.tls-staging.farrelf.blog.": "tls-staging.farrelf.blog._acme-aliases.farrelf.dedyn.io."
[2026-02-20T01:33:11.933+07:00] [ERRO] 2026/02/19 18:33:10 [DEBUG] PATCH https://desec.io/api/v1/domains/farrelf.dedyn.io/rrsets/tls-staging.farrelf.blog._acme-aliases/TXT/
[2026-02-20T01:33:11.937+07:00] [INFO] [*.tls-staging.farrelf.blog] acme: Trying to solve DNS-01
[2026-02-20T01:33:11.942+07:00] [INFO] Found CNAME entry for "_acme-challenge.tls-staging.farrelf.blog.": "tls-staging.farrelf.blog._acme-aliases.farrelf.dedyn.io."
[2026-02-20T01:33:11.949+07:00] [INFO] [*.tls-staging.farrelf.blog] acme: Checking DNS record propagation. [nameservers=8.8.8.8:53,8.8.4.4:53]
[2026-02-20T01:33:14.836+07:00] [INFO] Wait for propagation [timeout: 5m0s, interval: 4s]
[2026-02-20T01:35:19.274+07:00] [INFO] [*.tls-staging.farrelf.blog] The server validated our request
[2026-02-20T01:35:19.497+07:00] [INFO] [tls-staging.farrelf.blog] acme: Trying to solve DNS-01
[2026-02-20T01:35:19.533+07:00] [INFO] Found CNAME entry for "_acme-challenge.tls-staging.farrelf.blog.": "tls-staging.farrelf.blog._acme-aliases.farrelf.dedyn.io."
[2026-02-20T01:35:19.661+07:00] [INFO] [tls-staging.farrelf.blog] acme: Checking DNS record propagation. [nameservers=8.8.8.8:53,8.8.4.4:53]
[2026-02-20T01:35:23.373+07:00] [INFO] Wait for propagation [timeout: 5m0s, interval: 4s]
[2026-02-20T01:37:27.042+07:00] [INFO] [tls-staging.farrelf.blog] The server validated our request
[2026-02-20T01:37:27.080+07:00] [INFO] [*.tls-staging.farrelf.blog] acme: Cleaning DNS-01 challenge
[2026-02-20T01:37:27.089+07:00] [INFO] Found CNAME entry for "_acme-challenge.tls-staging.farrelf.blog.": "tls-staging.farrelf.blog._acme-aliases.farrelf.dedyn.io."
[2026-02-20T01:37:27.582+07:00] [ERRO] 2026/02/19 18:37:27 [DEBUG] GET https://desec.io/api/v1/domains/farrelf.dedyn.io/rrsets/tls-staging.farrelf.blog._acme-aliases/TXT/
[2026-02-20T01:37:28.275+07:00] [ERRO] 2026/02/19 18:37:28 [DEBUG] PATCH https://desec.io/api/v1/domains/farrelf.dedyn.io/rrsets/tls-staging.farrelf.blog._acme-aliases/TXT/
[2026-02-20T01:37:28.570+07:00] [INFO] [tls-staging.farrelf.blog] acme: Cleaning DNS-01 challenge
[2026-02-20T01:37:28.603+07:00] [INFO] Found CNAME entry for "_acme-challenge.tls-staging.farrelf.blog.": "tls-staging.farrelf.blog._acme-aliases.farrelf.dedyn.io."
[2026-02-20T01:37:28.675+07:00] [ERRO] 2026/02/19 18:37:28 [DEBUG] GET https://desec.io/api/v1/domains/farrelf.dedyn.io/rrsets/tls-staging.farrelf.blog._acme-aliases/TXT/
[2026-02-20T01:37:28.894+07:00] [ERRO] 2026/02/19 18:37:28 [DEBUG] PATCH https://desec.io/api/v1/domains/farrelf.dedyn.io/rrsets/tls-staging.farrelf.blog._acme-aliases/TXT/
[2026-02-20T01:37:29.265+07:00] [INFO] [tls-staging.farrelf.blog, *.tls-staging.farrelf.blog] acme: Validations succeeded; requesting certificates
[2026-02-20T01:37:31.450+07:00] [INFO] Wait for certificate [timeout: 20m0s, interval: 20s]
[2026-02-20T01:37:52.254+07:00] [INFO] [tls-staging.farrelf.blog] Server responded with a certificate.
[2026-02-20T01:37:52.307+07:00] [INFO] certificate saved {"recordId":"3e5ehjq1hjn4vlb"}
[2026-02-20T01:37:52.314+07:00] [INFO] application completed

#yeqYX6rQznD1SQGOmYPz6 End
[2026-02-20T01:37:52.330+07:00] [INFO] the workflow is ending

Miscellaneous / 其他

There is a workflow YAML code if you want to import my workflow to reproduce this issue easier:

nodes:
  - id: "QkiS-ZEghWCbpdJICUPfF"
    type: "start"
    name: "Start"
    config:
      trigger: "scheduled"
      triggerCron: "*/5 * * * *"
  - id: "FftlhpHNx9921nH0QJqve"
    type: "tryCatch"
    name: "Try to ..."
    blocks:
      - id: "jlJrZX2eM-BSQxyyQxfTv"
        type: "tryBlock"
        name: ""
        blocks:
          - id: "FXK4gAdsWBPSVXA_f2Obd"
            type: "bizApply"
            name: "Issue a Staging Certificate"
            config:
              caProvider: "letsencryptstaging"
              challengeType: "dns-01"
              contactEmail: "mail@example.com"
              dnsPropagationTimeout: "300"
              dnsPropagationWait: "120"
              domains: "tls-staging.farrelf.blog;*.tls-staging.farrelf.blog"
              identifier: "domain"
              keyAlgorithm: "RSA4096"
              keySource: "auto"
              provider: "desec"
              providerAccessId: "kqfwnznc8pj83iw"
              skipBeforeExpiryDays: 30
      - id: "XPQ2zn9VM5OCT6Fr8REw"
        type: "catchBlock"
        name: "On failed ..."
        blocks:
          - id: "mo2u3mlwWbhjLkDG2KdXq"
            type: "bizNotify"
            name: "Notification"
            config:
              message: "Your certificate issuance by Let's Encrypt at \"{{ $workflow.name }}\"
                workflow on node \"{{ $error.nodeName }}\" has been failed.
                Please check the details.


                Error Message: {{ $error.message }}

                Node ID: {{ $error.nodeId }}

                Workflow ID: {{ $workflow.id }}

                Workflow Run ID: {{ $run.id }}

                Time: {{ $now }}"
              provider: "telegrambot"
              providerAccessId: "r290x117o17v176"
              providerConfig: {}
              subject: "[Certimate] Certificate Issuance Failure Alert!"
          - id: "2Zqbq_odF0WIH6vuCOdmo"
            type: "end"
            name: "End"
  - id: "yeqYX6rQznD1SQGOmYPz6"
    type: "end"
    name: "End"

So far, I have only encountered this bug when using deSEC. I have not encountered this bug when using other DNS providers such as Bunny DNS, Duck DNS, acme-dns, Cloudflare, and dynv6.

Contribution / 贡献代码

I am interested in contributing a PR for this! / 我乐意为此提交代码并发起 PR！

Originally created by @FarrelF on GitHub (Feb 19, 2026). Original GitHub issue: https://github.com/certimate-go/certimate/issues/1198 ### Release Version / 软件版本 v0.4.17 ### Description / 缺陷描述 I have encountered a rather peculiar bug when using deSEC as a DNS provider to complete the ACME challenge when issuing certificates. You can see the screenshot below for error message: <img width="726" height="931" alt="Image" src="https://github.com/user-attachments/assets/9efccb23-e4ba-43cd-8fff-76f8644f3e93" /> The certificate has been successfully issued, but the workflow is stated as "Failed", even though it was successful to the extent that it immediately proceeded to another node after issuing the certificate instead of sending a notification. I suspect that the debug message in the log is being treated as an error message, which is why the workflow is stated as "Failed", and the debug text in the log itself is coloured red. The screenshot is shown below: (Some information has been redacted by overlaying it with red rectangles) <img width="678" height="831" alt="Image" src="https://github.com/user-attachments/assets/28a82858-e339-42ae-a545-85bb856a0b05" /> ### Steps to reproduce / 复现步骤 1. Create a empty workflow 2. Add "Request certificate" node in the workflow 3. Use staging CA for testing, recommend to using Let's Encrypt Staging Environment 4. Use deSEC as a DNS Provider 5. Apply changes, save and publish the workflow 6. Execute the workflow ### Logs / 日志 The contents of the log file are as follows: (Some information has been redacted, for example the Account ID has been redacted by changing it's Account ID to random number) <details> <summary>Log file content</summary> ```console #QkiS-ZEghWCbpdJICUPfF Start [2026-02-20T01:32:59.469+07:00] [INFO] the workflow is starting #FXK4gAdsWBPSVXA_f2Obd Issue a Staging Certificate [2026-02-20T01:32:59.480+07:00] [INFO] ready to request certificate ... {"config":{"domains":["tls-staging.farrelf.blog","*.tls-staging.farrelf.blog"],"ipaddrs":[],"contactEmail":"mail@example.com","challengeType":"dns-01","provider":"desec","providerAccessId":"kqfwnznc8pj83iw","caProvider":"letsencryptstaging","keySource":"auto","keyAlgorithm":"RSA4096","dnsPropagationWait":120,"dnsPropagationTimeout":300,"skipBeforeExpiryDays":30}} [2026-02-20T01:32:59.497+07:00] [INFO] no found last requested certificate, begin to apply [2026-02-20T01:32:59.510+07:00] [INFO] acme config initialized {"acmeDirUrl":"https://acme-staging-v02.api.letsencrypt.org/directory"} [2026-02-20T01:32:59.521+07:00] [INFO] acme account initialized {"acmeAcctUrl":"https://acme-staging-v02.api.letsencrypt.org/acme/acct/205145895"} [2026-02-20T01:33:07.183+07:00] [INFO] [tls-staging.farrelf.blog, *.tls-staging.farrelf.blog] acme: Obtaining bundled SAN certificate [2026-02-20T01:33:08.714+07:00] [INFO] [*.tls-staging.farrelf.blog] AuthURL: https://acme-staging-v02.api.letsencrypt.org/acme/authz/205145895/21810933983 [2026-02-20T01:33:08.722+07:00] [INFO] [tls-staging.farrelf.blog] AuthURL: https://acme-staging-v02.api.letsencrypt.org/acme/authz/205145895/21810933993 [2026-02-20T01:33:08.729+07:00] [INFO] [*.tls-staging.farrelf.blog] acme: use dns-01 solver [2026-02-20T01:33:08.734+07:00] [INFO] [tls-staging.farrelf.blog] acme: Could not find solver for: tls-alpn-01 [2026-02-20T01:33:08.739+07:00] [INFO] [tls-staging.farrelf.blog] acme: Could not find solver for: http-01 [2026-02-20T01:33:08.744+07:00] [INFO] [tls-staging.farrelf.blog] acme: use dns-01 solver [2026-02-20T01:33:08.748+07:00] [INFO] [*.tls-staging.farrelf.blog] acme: Preparing to solve DNS-01 [2026-02-20T01:33:08.756+07:00] [INFO] Found CNAME entry for "_acme-challenge.tls-staging.farrelf.blog.": "tls-staging.farrelf.blog._acme-aliases.farrelf.dedyn.io." [2026-02-20T01:33:09.148+07:00] [ERRO] 2026/02/19 18:33:09 [DEBUG] GET https://desec.io/api/v1/domains/farrelf.dedyn.io/rrsets/tls-staging.farrelf.blog._acme-aliases/TXT/ [2026-02-20T01:33:09.781+07:00] [ERRO] 2026/02/19 18:33:09 [DEBUG] POST https://desec.io/api/v1/domains/farrelf.dedyn.io/rrsets/ [2026-02-20T01:33:10.105+07:00] [INFO] [tls-staging.farrelf.blog] acme: Preparing to solve DNS-01 [2026-02-20T01:33:11.867+07:00] [ERRO] 2026/02/19 18:33:10 [DEBUG] GET https://desec.io/api/v1/domains/farrelf.dedyn.io/rrsets/tls-staging.farrelf.blog._acme-aliases/TXT/ [2026-02-20T01:33:11.883+07:00] [INFO] Found CNAME entry for "_acme-challenge.tls-staging.farrelf.blog.": "tls-staging.farrelf.blog._acme-aliases.farrelf.dedyn.io." [2026-02-20T01:33:11.933+07:00] [ERRO] 2026/02/19 18:33:10 [DEBUG] PATCH https://desec.io/api/v1/domains/farrelf.dedyn.io/rrsets/tls-staging.farrelf.blog._acme-aliases/TXT/ [2026-02-20T01:33:11.937+07:00] [INFO] [*.tls-staging.farrelf.blog] acme: Trying to solve DNS-01 [2026-02-20T01:33:11.942+07:00] [INFO] Found CNAME entry for "_acme-challenge.tls-staging.farrelf.blog.": "tls-staging.farrelf.blog._acme-aliases.farrelf.dedyn.io." [2026-02-20T01:33:11.949+07:00] [INFO] [*.tls-staging.farrelf.blog] acme: Checking DNS record propagation. [nameservers=8.8.8.8:53,8.8.4.4:53] [2026-02-20T01:33:14.836+07:00] [INFO] Wait for propagation [timeout: 5m0s, interval: 4s] [2026-02-20T01:35:19.274+07:00] [INFO] [*.tls-staging.farrelf.blog] The server validated our request [2026-02-20T01:35:19.497+07:00] [INFO] [tls-staging.farrelf.blog] acme: Trying to solve DNS-01 [2026-02-20T01:35:19.533+07:00] [INFO] Found CNAME entry for "_acme-challenge.tls-staging.farrelf.blog.": "tls-staging.farrelf.blog._acme-aliases.farrelf.dedyn.io." [2026-02-20T01:35:19.661+07:00] [INFO] [tls-staging.farrelf.blog] acme: Checking DNS record propagation. [nameservers=8.8.8.8:53,8.8.4.4:53] [2026-02-20T01:35:23.373+07:00] [INFO] Wait for propagation [timeout: 5m0s, interval: 4s] [2026-02-20T01:37:27.042+07:00] [INFO] [tls-staging.farrelf.blog] The server validated our request [2026-02-20T01:37:27.080+07:00] [INFO] [*.tls-staging.farrelf.blog] acme: Cleaning DNS-01 challenge [2026-02-20T01:37:27.089+07:00] [INFO] Found CNAME entry for "_acme-challenge.tls-staging.farrelf.blog.": "tls-staging.farrelf.blog._acme-aliases.farrelf.dedyn.io." [2026-02-20T01:37:27.582+07:00] [ERRO] 2026/02/19 18:37:27 [DEBUG] GET https://desec.io/api/v1/domains/farrelf.dedyn.io/rrsets/tls-staging.farrelf.blog._acme-aliases/TXT/ [2026-02-20T01:37:28.275+07:00] [ERRO] 2026/02/19 18:37:28 [DEBUG] PATCH https://desec.io/api/v1/domains/farrelf.dedyn.io/rrsets/tls-staging.farrelf.blog._acme-aliases/TXT/ [2026-02-20T01:37:28.570+07:00] [INFO] [tls-staging.farrelf.blog] acme: Cleaning DNS-01 challenge [2026-02-20T01:37:28.603+07:00] [INFO] Found CNAME entry for "_acme-challenge.tls-staging.farrelf.blog.": "tls-staging.farrelf.blog._acme-aliases.farrelf.dedyn.io." [2026-02-20T01:37:28.675+07:00] [ERRO] 2026/02/19 18:37:28 [DEBUG] GET https://desec.io/api/v1/domains/farrelf.dedyn.io/rrsets/tls-staging.farrelf.blog._acme-aliases/TXT/ [2026-02-20T01:37:28.894+07:00] [ERRO] 2026/02/19 18:37:28 [DEBUG] PATCH https://desec.io/api/v1/domains/farrelf.dedyn.io/rrsets/tls-staging.farrelf.blog._acme-aliases/TXT/ [2026-02-20T01:37:29.265+07:00] [INFO] [tls-staging.farrelf.blog, *.tls-staging.farrelf.blog] acme: Validations succeeded; requesting certificates [2026-02-20T01:37:31.450+07:00] [INFO] Wait for certificate [timeout: 20m0s, interval: 20s] [2026-02-20T01:37:52.254+07:00] [INFO] [tls-staging.farrelf.blog] Server responded with a certificate. [2026-02-20T01:37:52.307+07:00] [INFO] certificate saved {"recordId":"3e5ehjq1hjn4vlb"} [2026-02-20T01:37:52.314+07:00] [INFO] application completed #yeqYX6rQznD1SQGOmYPz6 End [2026-02-20T01:37:52.330+07:00] [INFO] the workflow is ending ``` </details> ### Miscellaneous / 其他 There is a workflow YAML code if you want to import my workflow to reproduce this issue easier: ```yaml nodes: - id: "QkiS-ZEghWCbpdJICUPfF" type: "start" name: "Start" config: trigger: "scheduled" triggerCron: "*/5 * * * *" - id: "FftlhpHNx9921nH0QJqve" type: "tryCatch" name: "Try to ..." blocks: - id: "jlJrZX2eM-BSQxyyQxfTv" type: "tryBlock" name: "" blocks: - id: "FXK4gAdsWBPSVXA_f2Obd" type: "bizApply" name: "Issue a Staging Certificate" config: caProvider: "letsencryptstaging" challengeType: "dns-01" contactEmail: "mail@example.com" dnsPropagationTimeout: "300" dnsPropagationWait: "120" domains: "tls-staging.farrelf.blog;*.tls-staging.farrelf.blog" identifier: "domain" keyAlgorithm: "RSA4096" keySource: "auto" provider: "desec" providerAccessId: "kqfwnznc8pj83iw" skipBeforeExpiryDays: 30 - id: "XPQ2zn9VM5OCT6Fr8REw" type: "catchBlock" name: "On failed ..." blocks: - id: "mo2u3mlwWbhjLkDG2KdXq" type: "bizNotify" name: "Notification" config: message: "Your certificate issuance by Let's Encrypt at \"{{ $workflow.name }}\" workflow on node \"{{ $error.nodeName }}\" has been failed. Please check the details. Error Message: {{ $error.message }} Node ID: {{ $error.nodeId }} Workflow ID: {{ $workflow.id }} Workflow Run ID: {{ $run.id }} Time: {{ $now }}" provider: "telegrambot" providerAccessId: "r290x117o17v176" providerConfig: {} subject: "[Certimate] Certificate Issuance Failure Alert!" - id: "2Zqbq_odF0WIH6vuCOdmo" type: "end" name: "End" - id: "yeqYX6rQznD1SQGOmYPz6" type: "end" name: "End" ``` So far, I have only encountered this bug when using deSEC. I have not encountered this bug when using other DNS providers such as Bunny DNS, Duck DNS, acme-dns, Cloudflare, and dynv6. ### Contribution / 贡献代码 - [ ] I am interested in contributing a PR for this! / 我乐意为此提交代码并发起 PR！

kerem added the

backlog

bug

labels

2026-03-03 01:06:11 +03:00

kerem commented

2026-03-03 01:06:12 +03:00

Author

Owner

@fudiwei commented on GitHub (Feb 26, 2026):

It seems the deSEC SDK writes all logs to stderr, so they're being treated as errors. I'll need to spend some time reading the deSEC source code to verify this issue.

@fudiwei commented on GitHub (Feb 26, 2026): It seems the deSEC SDK writes all logs to `stderr`, so they're being treated as errors. I'll need to spend some time reading the deSEC source code to verify this issue.