Trouble with DNS NSUPDATE (Enable DNS alias mode )

maverick_slo

I tried renew, some of my certs are renewing OK, some not (because of above error).

But then I tried to add BRAND NEW subdomain cert and it failed.

If I revert commit made by some 3rd party guy all starts to work again just fine.
https://github.com/pfsense/FreeBSD-ports/pull/1330/commits/bdd9ddf709119c51cd67719213d9ab15dafaa3ab

Tried on ACME PKG 0.8 on:
2.7.2
24.03

This is such a mess....

maverick_slo

And people will start to complain when they try to issue new cert with this method.

See below for renewal and why it is working:

When I renewed just now it added 2 wrongly named files but it did work, because in that folder there were still old files WHICH HAVE SAME CONTENT as new files.

So this explain why renew could work, and new cert will not work at all.

maverick_slo

I just got of the phone, my fellow sysadmin from other company has exactly the same issue on his pfsense install, he is trying to create new cert and he spent like 3 hours trying :)

Gertjan

@maverick_slo

Do you use any of these two :

maverick_slo

@Gertjan I use ENABLE DNS ALIAS MODE, see my above screenshot...

maverick_slo

Reverted this:

And voila, all is fine again.

jimp

I reverted that particular change, new version is building now and should be available in a while.

maverick_slo

@jimp Thanks, will try tomorrow!

maverick_slo

Yeah now its working just fine again.
Thanks!

HeMaN

I think I had the same issue with ACME - LE and DA dns check. See this topic
This one was also solved with the update/reverted code.
Thank you for the quick fix release @jimp