LetsEncrypt Wildcard DNS verification when not using cPanel's name servers
I want to create a wildcard certificate through the Lets Encrypt SSL page however I have to use DNS verification for this which is fine, yet cPanel does not display the TXT record it wants me to add it just blatantly assumes that we're using cPanel's DNS manager, how do I get the TXT record so I can actually add it to my domain?
This seems like a massive oversight as the TXT record isn't exactly meant to be secret.
-
The txt record that is added when we do this is automatically generated and as of right now you cannot successfully perform DNS DCV with AutoSSL if your server is not authoritative for the domain. This is also noted in the documentation under Limitations for Wildcard Domains: [QUOTE=https://docs.cpanel.net/knowledge-base/third-party/the-lets-encrypt-plugin/88/#wildcard-domains] Limitations If you use the Let"s Encrypt plugin to issue certificates for wildcard domains, be aware that: 0 -
The txt record that is added when we do this is automatically generated and as of right now you cannot successfully perform DNS DCV with AutoSSL if your server is not authoritative for the domain. This is also noted in the documentation under Limitations for Wildcard Domains:
Why though? Why is there not a text box that pops up saying the TXT record to add? Why did the development team just assume everyone is going to use cPanel's DNS?0 -
As I don't have specifics I can assume that this was done this way to match with the existing method of DCV check generation - we auto-generate the HTTP CSR Hash as well. It looks like one of our teams is working on something for this (I see an improvement case marked as To Do) but there is no timeframe for competition. I'd also assume they'd have to change the way the entire module works doing this since for all other certificate types the fallback to HTTP DCV check will bypass the need for locally managed nameservers. 0 -
Hi, is there any update on this feature? I'm trying to get a wildcard certificate through AutoSSL using Let's Encrypt and I'm getting the following error for my subdomains: WARN Local HTTP DCV error (MY SUBDOMAIN): "MY SUBDOMAIN" does not resolve to any IP addresses on the internet. I'm assuming it's because I've purchased my domain through a third party? Any assistance is appreciated. Thanks. 0 -
@WHJabe - there hasn't been any change to the way Let's Encrypt validates the wildcard certificates. As far as I can tell this is on Let's Encrypt's end as they state the following here: ACME v2 Production Environment & Wildcards "To request a wildcard certificate simply send a wildcard DNS identifier in the newOrder request." Because of that, there is no http request option for wildcard verification. 0 -
@WHJabe - there hasn't been any change to the way Let's Encrypt validates the wildcard certificates. As far as I can tell this is on Let's Encrypt's end as they state the following here:
I'm fine with using a DNS identifier, but it seems like there are no options for adding a DNS record to validate the certificate. I was just wondering if I was missing something. The above post from 2 years ago mentions the cPanel team working on this. The error I'm getting mentions HTTP but there are no options to select DNS. Everything is just done automatically.0 -
There is no way to manually add that - as the "auto" in AutoSSL implies, this would be setup in the DNS zone automatically by the tool. The specific error you're receiving would indicate either a general DNS issue with the domain, or a DNS issue outside the server. I would recommend scanning the domain with a tool like IntoDNS.com as any issues reported there would keep the AutoSSL system from working properly. 0
Please sign in to leave a comment.
Comments
7 comments