Acme DNS-NSupdate / RFC 2136

[yon]

acme 0.2.6 DNS-NSupdate / RFC 2136 in PF2.4.3 not work.

i have test v1 and v2.    it is can't use TSIG for update.

Renewing certificateaccount: xiao@on.org
server: letsencrypt-production

/usr/local/pkg/acme/acme.sh –issue -d 'xiao.net' --home '/tmp/acme/xiao.net-xmpp/' --accountconf '/tmp/acme/xiao.net-xmpp/accountconf.conf' --force --reloadCmd '/tmp/acme/xiao.net-xmpp/reloadcmd.sh' --dns 'dns_nsupdate' --log-level 3 --log '/tmp/acme/xiao.net-xmpp/acme_issuecert.log'

Array
(
[path] => /etc:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin/
[PATH] => /etc:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin/
[NSUPDATE_SERVER] => /tmp/acme/xiao.net-xmpp/xiao.net/nsupdate
[NSUPDATE_KEYNAME] =>
[NSUPDATE_KEYALGO] => 157
[NSUPDATE_KEY] => /tmp/acme/xiao.net-xmpp/xiao.net/nsupdate
)
[Tue Apr 3 13:08:25 CST 2018] Single domain='xiao.net'
[Tue Apr 3 13:08:25 CST 2018] Getting domain auth token for each domain
[Tue Apr 3 13:08:25 CST 2018] Getting webroot for domain='xiao.net'
[Tue Apr 3 13:08:25 CST 2018] Getting new-authz for domain='xiao.net'
[Tue Apr 3 13:08:32 CST 2018] The new-authz request is ok.
[Tue Apr 3 13:08:32 CST 2018] Found domain api file: /usr/local/pkg/acme/dnsapi/dns_nsupdate.sh
[Tue Apr 3 13:08:32 CST 2018] adding _acme-challenge.xiao.net. 60 in txt "tLfHes4-b6Q9-dRkkOrX1yFN1s4QLAKQ6OxGY2e7RKg"
dns_request_getresponse: expected a TSIG or SIG(0)
[Tue Apr 3 13:08:32 CST 2018] error updating domain
[Tue Apr 3 13:08:32 CST 2018] Error add txt for domain:_acme-challenge.xiao.net
[Tue Apr 3 13:08:32 CST 2018] Please check log file for more details: /tmp/acme/xiao.net-xmpp/acme_issuecert.log

[Derelict]

You need to have an RFC2136 server to update:

https://doc.pfsense.org/index.php/RFC2136_Dynamic_DNS

[yon]

@Derelict:

You need to have an RFC2136 server to update:

https://doc.pfsense.org/index.php/RFC2136_Dynamic_DNS

the services_dyndns.php is normal work.

but acme update not work.

[jimp]

The code is fine, it works for me and hundreds, maybe thousands, of others.

Something is wrong in your settings or with your DNS provider.