Report Bugs to Schlundtech.de DNS API

[mod242]

This is the place to report bugs in the ddnss.de DNS API.

If you experience a bug, please report it in this issue.

[ArminXG]

Hello,
I try to use the dns_schlundtech api to create a wildcard certificate for my domain with
-d 'xxxxx.com' -d '*.xxxxx.com'.
It always fails with the message "invalid domain".
The debug log shows XML looks good with the first request for "xxxxx.com", but the
second request just has "com". Even with the response saying "success", the log shows

success
h
invalid domain

The issue #1261 seems to contain something similar.
Is it a bug, or am I doing something wrong.

Armin

[mod242]

Hi Armin,

so, you try the following command:
acme.sh --issue --dns dns_schlundtech -d domain.com -d *.domain.com

And this doesn't work? I just checked for myself (had an renewal for 20 Domains on May 1st) and they went through this way. Can you please send me the Full Log, because right now I can't comprehend what's going wrong here, since I can't reproduce.

Best,
Michael

[ArminXG]

Hi Michael,

that is the command I use.
Here is the log (sensitive data and domain altered).

acme.sh.log

regards
Armin

[mod242]

Hi Armin,

thanks for the log. While I still don't understand 100% what is going on, I can see some significant differences in the XML-Communication. The most notable would be that the result of your run within the setting of the TXT-Record comes with an Payload that says "

2

", which means, theree are 2 Messages (which should not be the case here).

Would you have the chance to send a full debug? Or do you have an idea where this might come from (do you have any Information in the user-panel or so?)

Regards
Michael

[ArminXG]

Hello Michael,

I used --debug (or --log). Is there another option to get even more debug?

I cannot tell where this is coming from. The user panel looks normal, but we do have
a lot of entries including other TXT records.

regards
Armin

[Neilpang]

https://github.com/acmesh-official/acme.sh/wiki/How-to-debug-acme.sh

[ArminXG]

Ah okay.
I tried --debug 2 , but there is no real difference.

The script is doing two xml requests. The first xml request contains
<value>domain.com</value>
The second, which return invalid, contains
<value>com</value>

Why is it just com ? This looks wrong to me.

[mod242]

Hi Armin,

yep, this is the point where the problem happens. Normally you should have the zone-information, ns-information and so on in it (at least in my logs it appears). Instead your host (h) is set to com which isn't a valid domain. I'd need more of the communication insight to find out why this happens, i think. I was hoping that debug 2 delivers more information. What drives me insane is that I can't seem to reproduce this, no matter what i try.

Do you have an txt-entry with acme_challenge in the domain?

Regards
Michael

[mod242]

One thing to try:
Could you change line 126 in the dns_schlundtech.sh script from
if _contains "$autodns_response" "<summary>1</summary>" >/dev/null; then
to
if _contains "$autodns_response" "<summary>2</summary>" >/dev/null; then

Just to check, whether the message would work for the further process (although, as i stated, this is not the way it should go per specification)

[ArminXG]

Hi Michael,

no, there is no TXT entry for _acme-challenge.
I tried your patch. The TXT entry could not be added, but the second POST
now is very different:
<task> <code>0202001</code> <default> <rr_add> <name>_acme-challenge</name> <ttl>600</ttl> <type>TXT</type> <value>VtzlpIKRdWtdpVWtfTFE3v8uCojqF5HA7e3qY</value> </rr_add> </default> <zone> <name>domain.com</name> <system_ns>ns10.schlundtech.de</system_ns> </zone> </task>
The response says the hostname of the nameserver could not be resolved for ns.domain.com. But we do not have a nameserver for our domain. Why is ns.domain.com searched for?

[mod242]

Could you again send me the log?

[ArminXG]

Yes:

debug2.log

[mod242]

Thank you very much. So the root cause for your problem seems to be that the zones somehow are at least unexpected. As I pointed out earlier the very strange thing is that when asking for the zones instead of getting one dedicated message the API sends two (therefore the strange

2</... in your response). And this seems not to be an cosmetic issue. Unfortunately I can't tell exactly what the reason for this is in your case, but I assume that it has to do with the Nameserver-Configuration on Schlundtech side.

Could it be that you have an extra Name-Server Entry in your Zone-File on Schlundtech that isn't valid?