4. Acme DNS-NSupdate / RFC 2136 issue

Acme DNS-NSupdate / RFC 2136 issue

  • D

    Hi All,
    Hoping someone can help.

    New build pfSense 2.4.4-RELEASE-p3, acme 0.5.8

    I am trying to issue a cert, and keep getting

    dns_request_getresponse: expected a TSIG or SIG(0)
    [Mon Aug 5 15:09:43 UTC 2019] error updating domain

    I have tested using nsupdate via the shell manually, using the keyfile created by the web interface and all works fine. (as indeed does my older pfSense kit running 2.3.4 against the same name server/key etc)

    login.cnet.sgul.ac.uk
Renewing certificate 
account: testing 
server: letsencrypt-staging 


/usr/local/pkg/acme/acme.sh --issue -d 'login.cnet.sgul.ac.uk' --dns 'dns_nsupdate' --home '/tmp/acme/login.cnet.sgul.ac.uk/' --accountconf '/tmp/acme/login.cnet.sgul.ac.uk/accountconf.conf' --force --reloadCmd '/tmp/acme/login.cnet.sgul.ac.uk/reloadcmd.sh' --dnssleep '60' --log-level 3 --log '/tmp/acme/login.cnet.sgul.ac.uk/acme_issuecert.log'

Array
(
[path] => /etc:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin/
[PATH] => /etc:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin/
[NSUPDATE_SERVER] => /tmp/acme/login.cnet.sgul.ac.uk/login.cnet.sgul.ac.uknsupdate
[NSUPDATE_KEYNAME] => _acme-challenge.login.cnet.sgul.ac.uk
[NSUPDATE_KEYALGO] => 157
[NSUPDATE_KEY] => /tmp/acme/login.cnet.sgul.ac.uk/login.cnet.sgul.ac.uknsupdate
[NSUPDATE_ZONE] => cnet.sgul.ac.uk
)
[Mon Aug 5 15:13:11 UTC 2019] Single domain='login.cnet.sgul.ac.uk'
[Mon Aug 5 15:13:11 UTC 2019] Getting domain auth token for each domain
[Mon Aug 5 15:13:11 UTC 2019] Getting webroot for domain='login.cnet.sgul.ac.uk'
[Mon Aug 5 15:13:11 UTC 2019] Getting new-authz for domain='login.cnet.sgul.ac.uk'
[Mon Aug 5 15:13:12 UTC 2019] The new-authz request is ok.
[Mon Aug 5 15:13:12 UTC 2019] Found domain api file: /usr/local/pkg/acme/dnsapi/dns_nsupdate.sh
[Mon Aug 5 15:13:12 UTC 2019] adding _acme-challenge.login.cnet.sgul.ac.uk. 60 in txt "EbZ98wgnVknvX_M2t71uhc5ZdURzgXXQqSIpTN1hFxk"
dns_request_getresponse: expected a TSIG or SIG(0)
[Mon Aug 5 15:13:12 UTC 2019] error updating domain
[Mon Aug 5 15:13:12 UTC 2019] Error add txt for domain:_acme-challenge.login.cnet.sgul.ac.uk
[Mon Aug 5 15:13:12 UTC 2019] Please check log file for more details: /tmp/acme/login.cnet.sgul.ac.uk/acme_issuecert.log

    In Acme_issuecert.log it looks like it's not parsing or providing the correct data (NSUPDATE_ZONE not populated) to dns_nsupdate.sh maybe?

    [Mon Aug  5 15:13:12 UTC 2019] txtdomain='_acme-challenge.login.cnet.sgul.ac.uk'
[Mon Aug  5 15:13:12 UTC 2019] base64 single line.
[Mon Aug  5 15:13:12 UTC 2019] txt='EbZ98wgnVknvX_M2t71uhc5ZdURzgXXQqSIpTN1hFxk'
[Mon Aug  5 15:13:12 UTC 2019] d_api='/usr/local/pkg/acme/dnsapi/dns_nsupdate.sh'
[Mon Aug  5 15:13:12 UTC 2019] dns_entry='login.cnet.sgul.ac.uk,_acme-challenge.login.cnet.sgul.ac.uk,,dns_nsupdate,EbZ98wgnVknvX_M2t71uhc5ZdURzgXXQqSIpTN1hFxk,/usr/local/pkg/acme/dnsapi/dns_nsupdate.sh'
[Mon Aug  5 15:13:12 UTC 2019] Found domain api file: /usr/local/pkg/acme/dnsapi/dns_nsupdate.sh
[Mon Aug  5 15:13:12 UTC 2019] dns_nsupdate_add exists=0
[Mon Aug  5 15:13:12 UTC 2019] APP
[Mon Aug  5 15:13:12 UTC 2019] 5:NSUPDATE_SERVER='194.82.51.2'
[Mon Aug  5 15:13:12 UTC 2019] APP
[Mon Aug  5 15:13:12 UTC 2019] 6:NSUPDATE_SERVER_PORT=''
[Mon Aug  5 15:13:12 UTC 2019] APP
[Mon Aug  5 15:13:12 UTC 2019] 7:NSUPDATE_KEY='/tmp/acme/login.cnet.sgul.ac.uk/login.cnet.sgul.ac.uknsupdate_acme-challenge.login.cnet.sgul.ac.uk.key'
[Mon Aug  5 15:13:12 UTC 2019] APP
[Mon Aug  5 15:13:12 UTC 2019] 8:NSUPDATE_ZONE=''
[Mon Aug  5 15:13:12 UTC 2019] adding _acme-challenge.login.cnet.sgul.ac.uk. 60 in txt "EbZ98wgnVknvX_M2t71uhc5ZdURzgXXQqSIpTN1hFxk"
[Mon Aug  5 15:13:12 UTC 2019] error updating domain
[Mon Aug  5 15:13:12 UTC 2019] Error add txt for domain:_acme-challenge.login.cnet.sgul.ac.uk
[Mon Aug  5 15:13:12 UTC 2019] _on_issue_err
    0
    D
     1 Reply
  • Rebel Alliance Developer Netgate

    How exactly are you testing from the CLI? You probably need to set the zone parameter, it's blank in your output above.

    0
  • D

    Hi,
    Many thnkas for the feedback.

    In the GUI, I have set the Zone section to the correct zone (cnet.sgul.ac.uk)

    acme.PNG

    On the shell on pfSense

    [2.4.4-RELEASE][admin@pfSense.localdomain]/tmp/acme/testing: nsupdate -v -k /tmp/acme/testing/login.cnet.sgul.ac.uknsupdate_acme-challenge.login.cnet.sgul.ac.uk.key
> server 194.82.51.2
> zone cnet.sgul.ac.uk
> update add fiddy.cnet.sgul.ac.uk 3600 a 10.10.10.50
> update add fiddy.cnet.sgul.ac.uk 3600 txt fiddy text
> send
> quit
> 

    [2.4.4-RELEASE][admin@pfSense.localdomain]/tmp/acme/testing: dig fiddy.cnet.sgul.ac.uk txt @194.82.51.2

; <<>> DiG 9.12.2-P1 <<>> fiddy.cnet.sgul.ac.uk txt @194.82.51.2
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 56306
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1452
;; QUESTION SECTION:
;fiddy.cnet.sgul.ac.uk.         IN      TXT

;; ANSWER SECTION:
fiddy.cnet.sgul.ac.uk.  3484    IN      TXT     "fiddy" "text"

;; Query time: 4 msec
;; SERVER: 194.82.51.2#53(194.82.51.2)
;; WHEN: Tue Aug 06 00:07:39 UTC 2019
;; MSG SIZE  rcvd: 73

    Interestingly, If I omit the "-v" from nsupdate it fails

    [2.4.4-RELEASE][admin@pfSense.localdomain]/tmp/acme/testing: nsupdate -k /tmp/acme/testing/login.cnet.sgul.ac.uknsupdate_acme-challenge.login.cnet.sgul.ac.uk.key
> server 194.82.51.2
> zone cnet.sgul.ac.uk
> update add fiddy1.cnet.sgul.ac.uk 3600 a 10.10.10.51
> send
; TSIG error with server: expected a TSIG or SIG(0)
update failed: SERVFAIL
> quit
    0
  • D

    @dansgul

    More info on this

    It appears accountconf.conf contains an NULL NSUPDATE_ZONE (and is overwritten by dns_nsupdate.sh)

    ACME_DIRECTORY='https://acme-v01.api.letsencrypt.org/directory'
ACCOUNT_EMAIL=xxxxxxxx'
LOG_FILE='/tmp/acme/testing/acme_issuecert.log'
LOG_LEVEL='3'
NSUPDATE_SERVER='login.cnet.sgul.ac.uk'
NSUPDATE_SERVER_PORT=''
NSUPDATE_KEY='/tmp/acme/testing/login.cnet.sgul.ac.uknsupdate_acme-challenge.login.cnet.sgul.ac.uk.key'
NSUPDATE_ZONE=''

    If I set THISNSUPDATE_ZONE at the top of /usr/local/pkg/acme/dnsapi/dns_nsupdate.sh it can issue a cert

    0 1 Reply

  • @dansgul said in Acme DNS-NSupdate / RFC 2136 issue:

    THISNSUPDATE_ZONE

    I've looked for this one before.
    It's used before its initialized, so that explains :

    @dansgul said in Acme DNS-NSupdate / RFC 2136 issue:

    It appears accountconf.conf contains an NULL NSUPDATE_ZONE (and is overwritten by dns_nsupdate.s

    very well.

    Better yet : can't find "THISNSUPDATE_ZONE" here https://github.com/Neilpang/acme.sh/blob/master/dnsapi/dns_nsupdate.sh

    0
  • Rebel Alliance Developer Netgate

    Are you on the latest version of the ACME package? There was a bug with that a while back IIRC.

    The THISNSUPDATE_<x> stuff is just in pfSense. The stock files from acme.sh don't easily support multiple RFC2136 entries on a single cert the way pfSense uses them.

    0 1 Reply

  • @jimp said in Acme DNS-NSupdate / RFC 2136 issue:

    Are you on the latest version of the ACME package? There was a bug with that a while back IIRC.

    1b14debe-a30c-4b9b-8f70-330f7b8cb40a-image.png

    The THISNSUPDATE_<x> stuff is just in pfSense. The stock files from acme.sh don't easily support multiple RFC2136 entries on a single cert the way pfSense uses them.

    Ah, ok.
    Have a look at this "THISNSUPDATE_ZONE" in dnsapi/dns_nsupdate.sh - shouldnt it be init (= read) before used and written ?

    0
  • Rebel Alliance Developer Netgate

    Yeah, I thought it was but I'm not seeing it now, either. I'll look into it.

    1
  • Rebel Alliance Developer Netgate

    I just pushed a new version of ACME that should fix this. Give it a try when it shows up for you (0.6)

    1

  • Saw it.
    Tested !
    Worked !

    👍

    0
  • D

    Hi there, this still isn't working for me; I've upgraded to 0.6
    I still see "NSUPDATE_ZONE" as empty and the issue fails. (I know our DNS server needs to have the zone sent for this to work)

    [Wed Aug  7 17:23:39 BST 2019] d='login.cnet.sgul.ac.uk'
[Wed Aug  7 17:23:39 BST 2019] _d_alias
[Wed Aug  7 17:23:39 BST 2019] txtdomain='_acme-challenge.login.cnet.sgul.ac.uk'
[Wed Aug  7 17:23:39 BST 2019] base64 single line.
[Wed Aug  7 17:23:39 BST 2019] txt='_WaKP7V9YAEUOHv0Y6MJWEhq7KPImm7n8t6WcSwPqZE'
[Wed Aug  7 17:23:39 BST 2019] d_api='/usr/local/pkg/acme/dnsapi/dns_nsupdate.sh'
[Wed Aug  7 17:23:39 BST 2019] dns_entry='login.cnet.sgul.ac.uk,_acme-challenge.login.cnet.sgul.ac.uk,,dns_nsupdate,_WaKP7V9YAEUOHv0Y6MJWEhq7KPImm7n8t6WcSwPqZE,/usr/local/pkg/acme/dnsapi/dns_nsupdate.sh'
[Wed Aug  7 17:23:39 BST 2019] Found domain api file: /usr/local/pkg/acme/dnsapi/dns_nsupdate.sh
[Wed Aug  7 17:23:39 BST 2019] dns_nsupdate_add exists=0
[Wed Aug  7 17:23:39 BST 2019] Adding txt value: _WaKP7V9YAEUOHv0Y6MJWEhq7KPImm7n8t6WcSwPqZE for domain:  _acme-challenge.login.cnet.sgul.ac.uk
[Wed Aug  7 17:23:39 BST 2019] APP
[Wed Aug  7 17:23:39 BST 2019] 5:NSUPDATE_SERVER='ns1.sgul.ac.uk'
[Wed Aug  7 17:23:39 BST 2019] APP
[Wed Aug  7 17:23:39 BST 2019] 6:NSUPDATE_SERVER_PORT=''
[Wed Aug  7 17:23:39 BST 2019] APP
[Wed Aug  7 17:23:39 BST 2019] 7:NSUPDATE_KEY='/tmp/acme/testing/login.cnet.sgul.ac.uknsupdate_acme-challenge.login.cnet.sgul.ac.uk.key'
[Wed Aug  7 17:23:39 BST 2019] APP
[Wed Aug  7 17:23:39 BST 2019] 8:NSUPDATE_ZONE=''
[Wed Aug  7 17:23:39 BST 2019] adding _acme-challenge.login.cnet.sgul.ac.uk. 60 in txt "_WaKP7V9YAEUOHv0Y6MJWEhq7KPImm7n8t6WcSwPqZE"
[Wed Aug  7 17:23:39 BST 2019] error updating domain
[Wed Aug  7 17:23:39 BST 2019] Error add txt for domain:_acme-challenge.login.cnet.sgul.ac.uk
[Wed Aug  7 17:23:39 BST 2019] _on_issue_err
    0
  • Rebel Alliance Developer Netgate

    OK, I missed a couple bits. I just pushed ACME pkg v 0.6.2 which should work now. I didn't test it completely but I did confirm at least that the zone makes it into the account config and logs where it was missing before.

    0
  • D

    Working now after upgrade to 0.6.2

    Many thanks jimp!

    1
Log in to reply
 

Products

Applications

Support

Services

News

Resources

Company

Our Mission

As host of the pfSense open source firewall project, Netgate believes in enhancing network connectivity that maintains both security and privacy. We also believe everyone should be able to afford it.

Subscribe to our Newsletter

Product information, software announcements, and special offers. See our newsletter archive for past announcements.

© Copyright 2002 - 2019 Rubicon Communications, LLC | Privacy Policy