Improvement: Retry logic #516

New Issue

adam · 2025-12-29T01:26:36+01:00

adam commented

2025-12-29 01:26:36 +01:00

Originally created by @lukas2511 on GitHub (Dec 10, 2020).

Dehydrated currently doesn't have retry logic and just aborts after a single failure (or just continues with the next certificate).

There have been several tickets about this issue, this one should consolidate those tickets and serve as a reference point for future quick-closes.

Originally created by @lukas2511 on GitHub (Dec 10, 2020). Dehydrated currently doesn't have retry logic and just aborts after a single failure (or just continues with the next certificate). There have been several tickets about this issue, this one should consolidate those tickets and serve as a reference point for future quick-closes.

adam commented

2025-12-29 01:26:36 +01:00

@Exagone313 commented on GitHub (Jun 11, 2021):

I've had an issue for a while (a few months) where dehydrated fails to renew the certificates due to issues with Let's Encrypt's own DNS resolver, that randomly fails to resolve CAA records (even for top-level domains sometimes).

The definitive fix is implementing a retry logic. This is not something I would write naively, it needs at the very least to be considerate with rate limits.

Here is a partial result output, so that this issue appears in searches.

{
  "type": "http-01",
  "status": "invalid",
  "error": {
    "type": "urn:ietf:params:acme:error:dns",
    "detail": "During secondary validation: DNS problem: query timed out looking up CAA for xyz",
    "status": 400
  }
}

The wordaround I have is to run dehydrated more often than before, hoping a next run will have more luck.

@Exagone313 commented on GitHub (Jun 11, 2021): I've had an issue for a while (a few months) where dehydrated fails to renew the certificates due to issues with Let's Encrypt's own DNS resolver, that randomly fails to resolve CAA records (even for top-level domains sometimes). The definitive fix is implementing a retry logic. This is not something I would write naively, it needs at the very least to be considerate with rate limits. Here is a partial result output, so that this issue appears in searches. ```json { "type": "http-01", "status": "invalid", "error": { "type": "urn:ietf:params:acme:error:dns", "detail": "During secondary validation: DNS problem: query timed out looking up CAA for xyz", "status": 400 } } ``` The wordaround I have is to run dehydrated more often than before, hoping a next run will have more luck.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/dehydrated#516