A bug about CNAME when i work with a domain hosted in name.com

[landall]

I want to add a cert for *.abcd.com

certbot certonly -a dns-multi --dns-multi-credentials=/etc/letsencrypt/dns-multi.ini -d '*.abcd.com' --agree-tos --email xxxx -v

There is a record in DNS:
CNAME *.abcd.com --> some.efgh.com

The script works wrong.

It said:
[INFO] Found CNAME entry for "_acme-challenge.abcd.com.": "some.efgh.com."
namedotcom: some.efgh.com. is not a subdomain of abcd.com.

Then it fails.

[alexzorin]

I need two things if you want help with your problem:

• Try the same thing using lego directly and report back whether it works or not. If it doesn't work, then you need to take it up with the lego project directly.
• Use your real domain names when reporting this issue. I don't have the time to try and guess what the problem is from redacted logs.

[landall]

Thanks.  It is an issue of lego. I will go to report it there.

…

------------------ 原始邮件 ------------------ 发件人: "alexzorin/certbot-dns-multi" ***@***.***>; 发送时间: 2025年1月4日(星期六) 下午4:30 ***@***.***>; ***@***.******@***.***>; 主题: Re: [alexzorin/certbot-dns-multi] A bug about CNAME when i work with a domain hosted in name.com (Issue #15) I need two things if you want help with your problem: Try the same thing using lego directly and report back whether it works or not. If it doesn't work, then you need to take it up with the lego project directly. Use your real domain names when reporting this issue. I don't have the time to try and guess what the problem is from redacted logs. — Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you authored the thread.Message ID: ***@***.***>

[landall]

Someone else started an issue 2 days ago in go-acme/lego#2386

[landall]

Someone else started an issue 2 days ago in go-acme/lego#2386

It seems a bit different but refers to the same thing, following the CNAME.

[ldez]

It seems a bit different but refers to the same thing, following the CNAME.

This is not "a bit different", this is another topic.

If you want to disable CNAME support: https://go-acme.github.io/lego/usage/cli/options/index.html#lego_disable_cname_support

[landall]

It seems a bit different but refers to the same thing, following the CNAME.

This is not "a bit different", this is another topic.

If you want to disable CNAME support: https://go-acme.github.io/lego/usage/cli/options/index.html#lego_disable_cname_support

I find a way to avoid disable CNAME support which cannot be used in some situations:

1. add DNS rules below

• CNAME *.abcd.com -> some.domain.com
• CNAME _acme-challenge.abcd.com -> some.abcd.com
• A some.abcd.com -> any IP

2. wait for some time so that the ACME server can sync the changes. (in my test, it is about one hour)
3. run acme command as usual.

[ldez]

1. This is still not related to the issue inside lego you commented on.
2. You should express your context clearly, and you are able to do it because you did it in your latest comment.
3. You can open a dedicated issue on lego, with a clear explanation of your situation (please avoid the word "wrong")

[ldez]

This is because the current implementation of the namedotcom provider doesn't follow CNAME.

https://github.com/go-acme/lego/blob/b83c1d5f648a4e01adf247908ab2b5818b938dfb/providers/dns/namedotcom/namedotcom.go#L145

So this is not related to a "wrong way" to follow CNAME.

I will open a PR but I will need you to test it.

---

FYI, I tested the CNAME behavior and it works as expected (when the provider implementation uses it).

I created 2 CNAMEs:

• CNAME *.a.com -> example.com
• CNAME _acme-challenge.a.com -> bar.example.com

If I call _acme-challenge.a.com the answer is bar.example.com.

2025/01/05 18:39:00 [INFO] Found CNAME entry for "_acme-challenge.a.com.": "bar.example.com."

I added some debug logs and forced the usage of foo.a.com instead of _acme-challenge.a.com.

As you can see foo.a.com redirects to example.com:

;; opcode: QUERY, status: NOERROR, id: 39082
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version 0; flags:; udp: 1280

;; QUESTION SECTION:
;foo.a.com.	IN	 CNAME

;; ANSWER SECTION:
foo.a.com.	300	IN	CNAME	example.com.

and _acme-challenge.a.com redirects to bar.example.com:

;; opcode: QUERY, status: NOERROR, id: 37280
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version 0; flags:; udp: 1280

;; QUESTION SECTION:
;_acme-challenge.a.com.	IN	 CNAME

;; ANSWER SECTION:
_acme-challenge.a.com.	300	IN	CNAME	bar.example.com.