2

I am trying to obtain a wildcard certificate from Let's Encrypt for my web server.

Since I am using a "local" hoster, certbot has no DNS authenticator plugin for it. So I have to use the manual method.

Doing this, certbot wants me to add two DNS TXT records. For this I log in to my managment console from my "local" hoster and add the TXT records.

enter image description here

When applying the changes, it says that it can take up to 48 hours for the changes to be known world wide.

My question now is, how can this work when it takes so long for the changes to propagate?

Second question: Am I doing this right? Can I have two DNS TXT entries with the same host? Or should I edit the first one when I am asked to add the second one? Then it would take even longer.

  • certbot gives you 2 TXT records at the same time to add? This is strange... you can have multiple records for the same name in the DNS, the problem is that for each type, it is a set, not a list, so the client querying for it can receive them in any order, so it has to be prepared for this case. Normally you have only one record to update. – Patrick Mevzek Sep 4 '18 at 21:43
  • @PatrickMevzek stulleman would have to create two TXT records if he/she is creating an X509 certificate that is valid for both example.com and *.example.com. – Anthony G - justice for Monica Sep 4 '18 at 21:47
  • Okay, I deployed my TXT records but certbot is failing with an error: Type: unauthorized Detail: No TXT record found at _acme-challenge.xxxxxxxxxxxx.xx Then I check if my record has been deployed with this site: whatsmydns.net I don't know how trustworthy the results are, but the result is, it wasn't. So maybe there is a longer waiting period. – stulleman Sep 5 '18 at 17:29
2

how can this work when it takes so long for the changes to propagate?

The propagation time (“up to 48 hours for the changes to be known world wide”) is a conservative estimate of the time that various DNS servers around the world may have records for your domain stored in their internal cache. However, when carrying out its DNS validation (as per the ACME protocol), Let’s Encrypt does not use recursive name servers. When it checks the TXT resource records for your domain, it queries the authoritative name server(s) directly – so there’s no delay.

Am I doing this right? Can I have two DNS TXT entries with the same host? Or should I edit the first one when I am asked to add the second one? Then it would take even longer.

Yes, you are doing this right. As per the DNS standards, it’s fine to have multiple TXT records for the same (sub)domain. Here’s an example of how the dig utility might return results for the _acme-challenge.example.com domain in order to validate an X.509 certificate for both example.com and *.example.com:

$ dig _acme-challenge.example.com TXT
...
;; ANSWER SECTION:
_acme-challenge.example.com. 3600 IN     TXT     "TXrF987Uc1aEl4TTm7LL76rrN3wba9q6kkTmcNJnjNk"
_acme-challenge.example.com. 3600 IN     TXT     "L3f2m9APvpIlamHHtZ2deRvDdhSPMcMmvPHsvSsln9o"
...
  • 1
    This 48 hours value anyway even for just recursive nameservers is just an example, nothing related to real life in each specific case. It depends on the TTL of the record, the negative TTL of the zone and previous patterns of query for the domain. So almost impossible to predict. You can give some kind of upper limit, after which you can begin to worry. But it may happen far before. – Patrick Mevzek Sep 4 '18 at 21:41
  • 1
    I agree, your answer is good. I am just jumping on occasions to try to explain to people that there are not hardcoded 24 or 48 hours value harcoded somewhere in the DNS and that even "propagation" is the wrong term to use, but of course explaining all of that is far more complicated than just saying "wait some time and start to act only if you have problems after it". This also often mixes up recursive and authoritative nameserver behaviors, so your answer is clear on that and how LE operates to check. – Patrick Mevzek Sep 4 '18 at 22:01
  • It all worked in the end. I used dns.google.com to verify my records are deployed, since this seems to be the DNS Let's Encrypt is using. For anybody having the same issue use the link at the bottom of the dns.google.com site so you don't get cached results. – stulleman Sep 5 '18 at 19:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.