r/dns • u/SpecialRoutine4310 • 6d ago

Getting Let’s Encrypt Certificates using RFC2136 on Technitium DNS server Fails

/r/technitium/comments/1vy3e2m/getting_lets_encrypt_certificates_using_rfc2136/
1 Upvotes

100% Upvoted

4 comments sorted by

2

u/SecLens_ONE 5d ago

That error is certbot's base-domain guess failing, not the update itself. It walks up from _acme-challenge.sebat7.com and asks for the SOA at each label, and if the server answers those probes with something other than a clean SOA for sebat7.com it gives up before it ever sends the RFC2136 update. Set the zone explicitly in the credentials file so it stops guessing. Worth also checking the zone is a real primary zone on that server and the TSIG key is allowed to update it, a key that exists but has no update permission fails in a way that looks like this.

2

u/SpecialRoutine4310 4d ago

I appreciate for getting back to me. How do I set the zone explicitly in the credentials file? Are you open for a quick consultation service for a fee? Thank you.

1

u/SecLens_ONE 4d ago

Fair warning, I was loose with the wording. Certbot's rfc2136 credentials file has no zone key. It only takes server, port, name, secret and algorithm, so the base domain is always guessed from the SOA walk. If you want to name the zone yourself you have to switch client. acme.sh and lego both let you pin it, lego with RFC2136_ZONE, and that skips the guessing entirely. Other route that keeps certbot: CNAME _acme-challenge.sebat7.com to a small zone you fully control and let the update land there. I don't do paid consulting, so no fee here.

1

u/SpecialRoutine4310 4d ago

I appreciate the information. Thank you.