urn:acme:error:unauthorized on dns-01 (lexicon) #133

New Issue

adam · 2025-12-29T00:25:35+01:00

adam commented

2025-12-29 00:25:35 +01:00

Originally created by @thomasf1 on GitHub (Aug 2, 2016).

When using the lexicon hook (https://github.com/AnalogJ/lexicon/blob/master/examples/letsencrypt.default.sh), the first in a line of domains always works, but then the 2nd or 3rd alias throws this error. It seems like some timeout issue...

Processing domain1.de with alternative names: www.domain1.de app.domain1.de beta.domain1.de domain2.de www.domain2.de app.domain2.de beta.domain2.de domain3.de www.domain3.de app.domain3.de beta.domain3.de
 + Signing domains...
 + Generating private key...
 + Generating signing request...
 + Requesting challenge for domain1.de...
 + Requesting challenge for www.domain1.de...
 + Requesting challenge for app.domain1.de...
 + Requesting challenge for beta.domain1.de...
 + Requesting challenge for domain2.de...
 + Requesting challenge for www.domain2.de...
 + Requesting challenge for app.domain2.de...
 + Requesting challenge for beta.domain2.de...
 + Requesting challenge for domain3.de...
 + Requesting challenge for www.domain3.de...
 + Requesting challenge for app.domain3.de...
 + Requesting challenge for beta.domain3.de...
deploy_challenge called: domain1.de, someKey, someKey2
lexicon cloudflare create domain1.de TXT --name='acme-challenge.domain1.de.' --content='someKey2'
Namespace(action='create', auth_token=None, auth_username=None, content='someKey2', domain='domain1.de', identifier=None, name='_acme-challenge.domain1.de.', priority=None, provider_name='cloudflare', ttl=None, type='TXT')
No handlers could be found for logger "tldextract"
create_record: True
 + Responding to challenge for domain1.de...
clean_challenge called: domain1.de, someKey, someKey2
Namespace(action='delete', auth_token=None, auth_username=None, content='someKey2', domain='domain1.de', identifier=None, name='_acme-challenge.domain1.de.', priority=None, provider_name='cloudflare', ttl=None, type='TXT')
No handlers could be found for logger "tldextract"
list_records: [{'content': u'someKey2', 'id': u'b86e0031d7eebee5d6af14e7f76123a0', 'type': u'TXT', 'name': u'_acme-challenge.domain1.de', 'ttl': 1}]
[{'content': u'someKey2', 'id': u'b86e0031d7eebee5d6af14e7f76123a0', 'type': u'TXT', 'name': u'_acme-challenge.domain1.de', 'ttl': 1}]
delete_record: True
 + Challenge is valid!
deploy_challenge called: www.domain1.de, someKey3, someKey4
lexicon cloudflare create www.domain1.de TXT --name='acme-challenge.www.domain1.de.' --content='someKey4'
Namespace(action='create', auth_token=None, auth_username=None, content='someKey4', domain='www.domain1.de', identifier=None, name='_acme-challenge.www.domain1.de.', priority=None, provider_name='cloudflare', ttl=None, type='TXT')
No handlers could be found for logger "tldextract"
create_record: True
 + Responding to challenge for www.domain1.de...
clean_challenge called: www.domain1.de, someKey3, someKey4
Namespace(action='delete', auth_token=None, auth_username=None, content='someKey4', domain='www.domain1.de', identifier=None, name='_acme-challenge.www.domain1.de.', priority=None, provider_name='cloudflare', ttl=None, type='TXT')
No handlers could be found for logger "tldextract"
list_records: [{'content': u'someKey4', 'id': u'someID', 'type': u'TXT', 'name': u'_acme-challenge.www.domain1.de', 'ttl': 1}]
[{'content': u'someKey4', 'id': u'someID', 'type': u'TXT', 'name': u'_acme-challenge.www.domain1.de', 'ttl': 1}]
delete_record: True
ERROR: Challenge is invalid! (returned: invalid) (result: {
  "type": "dns-01",
  "status": "invalid",
  "error": {
    "type": "urn:acme:error:unauthorized",
    "detail": "Correct value not found for DNS challenge",
    "status": 403
  },
  "uri": "https://acme-v01.api.letsencrypt.org/acme/challenge/qscr5vea-pExCauIAf3ZeW6GrzDFCfrqENJHluMoe0c/211202993",
  "token": "someKey3",
  "keyAuthorization": "someKey3.someKey5"
})

I´ve replaced keys sent with someKey / someID...

Originally created by @thomasf1 on GitHub (Aug 2, 2016). When using the lexicon hook (https://github.com/AnalogJ/lexicon/blob/master/examples/letsencrypt.default.sh), the first in a line of domains always works, but then the 2nd or 3rd alias throws this error. It seems like some timeout issue... ``` Processing domain1.de with alternative names: www.domain1.de app.domain1.de beta.domain1.de domain2.de www.domain2.de app.domain2.de beta.domain2.de domain3.de www.domain3.de app.domain3.de beta.domain3.de + Signing domains... + Generating private key... + Generating signing request... + Requesting challenge for domain1.de... + Requesting challenge for www.domain1.de... + Requesting challenge for app.domain1.de... + Requesting challenge for beta.domain1.de... + Requesting challenge for domain2.de... + Requesting challenge for www.domain2.de... + Requesting challenge for app.domain2.de... + Requesting challenge for beta.domain2.de... + Requesting challenge for domain3.de... + Requesting challenge for www.domain3.de... + Requesting challenge for app.domain3.de... + Requesting challenge for beta.domain3.de... deploy_challenge called: domain1.de, someKey, someKey2 lexicon cloudflare create domain1.de TXT --name='acme-challenge.domain1.de.' --content='someKey2' Namespace(action='create', auth_token=None, auth_username=None, content='someKey2', domain='domain1.de', identifier=None, name='_acme-challenge.domain1.de.', priority=None, provider_name='cloudflare', ttl=None, type='TXT') No handlers could be found for logger "tldextract" create_record: True + Responding to challenge for domain1.de... clean_challenge called: domain1.de, someKey, someKey2 Namespace(action='delete', auth_token=None, auth_username=None, content='someKey2', domain='domain1.de', identifier=None, name='_acme-challenge.domain1.de.', priority=None, provider_name='cloudflare', ttl=None, type='TXT') No handlers could be found for logger "tldextract" list_records: [{'content': u'someKey2', 'id': u'b86e0031d7eebee5d6af14e7f76123a0', 'type': u'TXT', 'name': u'_acme-challenge.domain1.de', 'ttl': 1}] [{'content': u'someKey2', 'id': u'b86e0031d7eebee5d6af14e7f76123a0', 'type': u'TXT', 'name': u'_acme-challenge.domain1.de', 'ttl': 1}] delete_record: True + Challenge is valid! deploy_challenge called: www.domain1.de, someKey3, someKey4 lexicon cloudflare create www.domain1.de TXT --name='acme-challenge.www.domain1.de.' --content='someKey4' Namespace(action='create', auth_token=None, auth_username=None, content='someKey4', domain='www.domain1.de', identifier=None, name='_acme-challenge.www.domain1.de.', priority=None, provider_name='cloudflare', ttl=None, type='TXT') No handlers could be found for logger "tldextract" create_record: True + Responding to challenge for www.domain1.de... clean_challenge called: www.domain1.de, someKey3, someKey4 Namespace(action='delete', auth_token=None, auth_username=None, content='someKey4', domain='www.domain1.de', identifier=None, name='_acme-challenge.www.domain1.de.', priority=None, provider_name='cloudflare', ttl=None, type='TXT') No handlers could be found for logger "tldextract" list_records: [{'content': u'someKey4', 'id': u'someID', 'type': u'TXT', 'name': u'_acme-challenge.www.domain1.de', 'ttl': 1}] [{'content': u'someKey4', 'id': u'someID', 'type': u'TXT', 'name': u'_acme-challenge.www.domain1.de', 'ttl': 1}] delete_record: True ERROR: Challenge is invalid! (returned: invalid) (result: { "type": "dns-01", "status": "invalid", "error": { "type": "urn:acme:error:unauthorized", "detail": "Correct value not found for DNS challenge", "status": 403 }, "uri": "https://acme-v01.api.letsencrypt.org/acme/challenge/qscr5vea-pExCauIAf3ZeW6GrzDFCfrqENJHluMoe0c/211202993", "token": "someKey3", "keyAuthorization": "someKey3.someKey5" }) ``` I´ve replaced keys sent with someKey / someID...

adam closed this issue

2025-12-29 00:25:36 +01:00

adam commented

2025-12-29 00:25:36 +01:00

@lukas2511 commented on GitHub (Aug 2, 2016):

Not a problem of this script... my guess: dns didn't have enough time to update.

@lukas2511 commented on GitHub (Aug 2, 2016): Not a problem of this script... my guess: dns didn't have enough time to update.

adam referenced this issue

2025-12-29 01:28:40 +01:00

[PR #133] [CLOSED] check if curl is able to reach letsencrypt via http and https. #724

Sign in to join this conversation.