Issue with DNS auth sequence about certbot-dns-google-domains HOT 14 CLOSED

I ran the following command

certbot certonly \
        --dry-run \
        --noninteractive --agree-tos --email '[email protected]' \
        --authenticator 'dns-google-domains' \
        --dns-google-domains-credentials '/home/canada/.secrets/certbot/google_api_key.ini' \
        --dns-google-domains-zone 'evocable.ca' \
        -d 'www.evocable.ca' \
        --config-dir ~/.certbot/config --logs-dir ~/.certbot/logs --work-dir ~/.certbot/work

The output from the command is:

Saving debug log to /home/canada/.certbot/logs/letsencrypt.log
Simulating a certificate request for www.evocable.ca
Waiting 30 seconds for DNS changes to propagate
Encountered exception during recovery: certbot.errors.PluginError: Unable to rotate DNS challenges: 'record'
The dry run was successful.

The log file is attached:
letsencrypt.log

from certbot-dns-google-domains.

Okay, good to hear that it's just a stray error and not impacting renewals. I'll address this in the coming week.

from certbot-dns-google-domains.

I'm also encountering the same error, but on Ubuntu 22.04.02 with the same version of certbot. I used the docker run method.

from certbot-dns-google-domains.

Hmm I'm trying to recreate this bug. Haven't had success so far.

I think I see what's going on.

NVM Still can't figure it out. Odd.

from certbot-dns-google-domains.

I am seeing the same issue. :( I am extending the ghcr.io/aaomidi/certbot-dns-google-domains:latest docker image.

from certbot-dns-google-domains.

from certbot-dns-google-domains.

Of course:

certbot certonly \
        --dry-run \
        --noninteractive --agree-tos --email '<email>' \
        --authenticator 'dns-google-domains' \
        --dns-google-domains-credentials '/var/lib/letsencrypt/dns_google_domains_credentials.ini' \
        --dns-google-domains-zone '<zone>' \
        -d '<domain>'

output:

Saving debug log to /var/log/letsencrypt/letsencrypt.log
Account registered.
Simulating a certificate request for <domain> and 4 more domains
Unsafe permissions on credentials configuration file: /var/lib/letsencrypt/dns_google_domains_credentials.ini
Zone selected for ...
Waiting 30 seconds for DNS changes to propagate
Encountered exception during recovery: certbot.errors.PluginError: Unable to rotate DNS challenges: 'record'
The dry run was successful.

from certbot-dns-google-domains.

The module (https://pypi.org/project/certbot-dns-google-domains/) has been updated with some additional logging (by default stored at /var/log/letsencrypt/letsencrypt.log).

The access token is already removed from the logs for security purposes. However, if you need to share the logs to investigate the issue, you can also redact any other information that you don't want to share. Keep in mind that domain names in certificates are public information due to certificate transparency, as they are listed on websites such as crt.sh.

Thank you for helping me find the root cause of the problem.

from certbot-dns-google-domains.

Thank you so much @epicrunze. PR is out to fix this.

I wasn't running into this issue because during my testing I had ended up with a ton of dangling challenges :)

from certbot-dns-google-domains.

Looks like the docker build release is failing, might be related to all the certificate issues GitHub has been having. Will try again tomorrow. Keeping the bug open till then.

from certbot-dns-google-domains.

Is this fixed with docker?

from certbot-dns-google-domains.

I get the error: Encountered exception during recovery: certbot.errors.PluginError: Unable to rotate DNS challenges: 400 Client Error: Bad Request for url: https://acmedns.googleapis.com/v1/acmeChallengeSets /:rotateChallenges. I tried to issue a certificate through docker, and through certbot installed via pip3, but it's still the same

from certbot-dns-google-domains.

Is this fixed with docker?

This should be pushed with docker too at this point.

from certbot-dns-google-domains.

I get the error: Encountered exception during recovery: certbot.errors.PluginError: Unable to rotate DNS challenges: 400 Client Error: Bad Request for url: https://acmedns.googleapis.com/v1/acmeChallengeSets /:rotateChallenges. I tried to issue a certificate through docker, and through certbot installed via pip3, but it's still the same

I think I'll have to see the exact logs to be able to figure out what's going on. E.g. if you used

--logs-dir ~/.certbot/logs 

The logs will be in there.

Please make an issue with that information and I'll investigate it more.

from certbot-dns-google-domains.