1. Caddy version (caddy version):
v2.5.2 h1:eCJdLyEyAGzuQTa5Mh3gETnYWDClo1LjtQm2q9RNZrs=
2. How I run Caddy:
Virtual Machine in Proxmox PVE
a. System environment:
Operating System:
|Description:|Ubuntu 22.04 LTS|
|Release:|22.04|
|Codename:|jammy|
Caddy is not containerized.
b. Command:
sudo service caddy start
c. Service/unit/compose file:
none
d. My complete Caddyfile:
{
acme_ca https://acme-staging-v02.api.letsencrypt.org/directory
email <mail>
log {
level DEBUG
output file /var/log/caddy/acme3.log {
roll_size 10MB
roll_keep 10
}
}
}
bw.exampledomain:61060 {
import /etc/caddy/caddy_security.conf
tls {
dns netcup {
customer_number {env.NETCUP_CUSTOMER_NUMBER}
api_key {env.NETCUP_API_KEY}
api_password {env.NETCUP_API_PASSWORD}
}
}
reverse_proxy * {
to 172.30.0.199:443
transport http {
tls
tls_insecure_skip_verify
read_buffer 8192
}
}
}
nas1.exampledomain:61068 {
import /etc/caddy/caddy_security.conf
tls {
dns netcup {
customer_number {env.NETCUP_CUSTOMER_NUMBER}
api_key {env.NETCUP_API_KEY}
api_password {env.NETCUP_API_PASSWORD}
}
}
log {
level DEBUG
output file /var/log/caddy/nas1.log {
roll_size 10MB
roll_keep 10
}
}
reverse_proxy * {
to 172.30.20.2:51328
transport http {
tls
tls_insecure_skip_verify
read_buffer 8192
}
}
}
#Below is Caddyserver's local IPv4 Address
172.30.22.2:UnusedPort {
...
reverse_proxy <toAnotherLocalIP>:<Port>
...
}
#Below is Caddyserver's local IPv4 Address
172.30.22.2:UnusedPort {
...
reverse_proxy <toAnotherLocalIP>:<Port>
...
}
3. The problem I’m having:
Im trying to get my first certificate for nas1.exampledomain, which is mentioned in my Caddyfile.
The certificate should be retrieved by solving the dns-01 Challenge (LetsEncrypt).
I already installed my Domain-Provider’s DNS-Plugin. My Domain-Provider is Netcup.
I already put my Netcup-API credentials in /etc/environment and these were applied correctly to the system, since “caddy environ” does list them.
I havent used Caddy a lot. Its been a week since I installed it on this VM. The initial certificates for “bw.exampledomain” were done through HTTP-Challenge (opening and forwarding Port 443). I dont want to use HTTP-01 in the long run though.
The process of receiving a new certificate through dns01-Challenge fails according to the above mentioned Debug-Log /var/log/caddy/acme3.log
When I remove the global option “acme_ca” and keep the “tls” and “dns” options in each site (“nas1.exampledomain” and “bw.exampledomain”) nothing happens in their Debug-Log (for example in /var/log/nas1.log). It doesnt even get created. This makes me think that the per-site dns-options dont do anything (?). The first time I got to see a Logfile regarding the dns0-challenge was when I enabled the global option “acme_ca”. But this failed, as you can see in the posted Logfile /var/log/caddy/acme3.log
4. Error messages and/or full log output:
This is the output of the Debug-Log /var/log/caddy/acme3.log:
cat /var/log/caddy/acme3.log
{"level":"info","ts":1658678461.45326,"logger":"admin","msg":"admin endpoint started","address":"tcp/localhost:2019","enforce_origin":false,"origins":["//localhost:2019","//[::1]:2019","//127.0.0.1:2019"]}
{"level":"info","ts":1658678461.453756,"logger":"tls.cache.maintenance","msg":"started background certificate maintenance","cache":"0xc0004e68c0"}
{"level":"info","ts":1658678461.4538345,"logger":"http","msg":"enabling automatic HTTP->HTTPS redirects","server_name":"srv7"}
{"level":"info","ts":1658678461.453848,"logger":"http","msg":"enabling automatic HTTP->HTTPS redirects","server_name":"srv8"}
{"level":"info","ts":1658678461.4538574,"logger":"http","msg":"enabling automatic HTTP->HTTPS redirects","server_name":"srv2"}
{"level":"info","ts":1658678461.4538658,"logger":"http","msg":"enabling automatic HTTP->HTTPS redirects","server_name":"srv1"}
{"level":"info","ts":1658678461.4538767,"logger":"http","msg":"enabling automatic HTTP->HTTPS redirects","server_name":"srv3"}
{"level":"info","ts":1658678461.453891,"logger":"http","msg":"enabling automatic HTTP->HTTPS redirects","server_name":"srv4"}
{"level":"info","ts":1658678461.4539042,"logger":"http","msg":"enabling automatic HTTP->HTTPS redirects","server_name":"srv5"}
{"level":"info","ts":1658678461.4539123,"logger":"http","msg":"enabling automatic HTTP->HTTPS redirects","server_name":"srv6"}
{"level":"info","ts":1658678461.4539227,"logger":"http","msg":"enabling automatic HTTP->HTTPS redirects","server_name":"srv0"}
{"level":"debug","ts":1658678461.455401,"logger":"http","msg":"starting server loop","address":"[::]:61062","http3":false,"tls":true}
{"level":"debug","ts":1658678461.455439,"logger":"http","msg":"starting server loop","address":"[::]:61067","http3":false,"tls":true}
{"level":"debug","ts":1658678461.455456,"logger":"http","msg":"starting server loop","address":"[::]:61068","http3":false,"tls":true}
{"level":"debug","ts":1658678461.4554677,"logger":"http","msg":"starting server loop","address":"[::]:80","http3":false,"tls":false}
{"level":"debug","ts":1658678461.455542,"logger":"http","msg":"starting server loop","address":"[::]:61066","http3":false,"tls":true}
{"level":"debug","ts":1658678461.4555583,"logger":"http","msg":"starting server loop","address":"[::]:61060","http3":false,"tls":true}
{"level":"debug","ts":1658678461.455572,"logger":"http","msg":"starting server loop","address":"[::]:61061","http3":false,"tls":true}
{"level":"debug","ts":1658678461.455619,"logger":"http","msg":"starting server loop","address":"[::]:61063","http3":false,"tls":true}
{"level":"debug","ts":1658678461.4556334,"logger":"http","msg":"starting server loop","address":"[::]:61064","http3":false,"tls":true}
{"level":"debug","ts":1658678461.455645,"logger":"http","msg":"starting server loop","address":"[::]:61065","http3":false,"tls":true}
{"level":"info","ts":1658678461.4556496,"logger":"http","msg":"enabling automatic TLS certificate management","domains":["172.30.22.2","nas1.exampledomain","bw.exampledomain"]}
{"level":"warn","ts":1658678461.4559293,"logger":"tls","msg":"stapling OCSP","error":"no OCSP stapling for [172.30.22.2]: no OCSP server specified in certificate","identifiers":["172.30.22.2"]}
{"level":"debug","ts":1658678461.4559445,"logger":"tls.cache","msg":"added certificate to cache","subjects":["172.30.22.2"],"expiration":1658721000,"managed":true,"issuer_key":"local","hash":"43ee708ccf3d4c8a40e970bf2c6f6b5ce07562f836feab3ea5c42056e812e628","cache_size":1,"cache_capacity":10000}
{"level":"info","ts":1658678461.456218,"logger":"tls.obtain","msg":"acquiring lock","identifier":"nas1.exampledomain"}
{"level":"info","ts":1658678461.4567537,"logger":"tls","msg":"cleaning storage unit","description":"FileStorage:/home/caddy/.local/share/caddy"}
{"level":"info","ts":1658678461.456875,"logger":"tls.obtain","msg":"acquiring lock","identifier":"bw.exampledomain"}
{"level":"info","ts":1658678461.4574347,"logger":"tls.obtain","msg":"lock acquired","identifier":"nas1.exampledomain"}
{"level":"info","ts":1658678461.460538,"logger":"tls","msg":"finished cleaning storage units"}
{"level":"debug","ts":1658678461.4608033,"logger":"tls.obtain","msg":"trying issuer 1/2","issuer":"acme-staging-v02.api.letsencrypt.org-directory"}
{"level":"info","ts":1658678461.460979,"logger":"tls.issuance.acme","msg":"waiting on internal rate limiter","identifiers":["nas1.exampledomain"],"ca":"https://acme-staging-v02.api.letsencrypt.org/directory","account":"mail@proton.me"}
{"level":"info","ts":1658678461.4609885,"logger":"tls.issuance.acme","msg":"done waiting on internal rate limiter","identifiers":["nas1.exampledomain"],"ca":"https://acme-staging-v02.api.letsencrypt.org/directory","account":"mail@proton.me"}
{"level":"info","ts":1658678461.4611585,"logger":"tls.obtain","msg":"lock acquired","identifier":"bw.exampledomain"}
{"level":"debug","ts":1658678461.4613795,"logger":"tls.obtain","msg":"trying issuer 1/2","issuer":"acme-staging-v02.api.letsencrypt.org-directory"}
{"level":"info","ts":1658678461.4614732,"logger":"tls.issuance.acme","msg":"waiting on internal rate limiter","identifiers":["bw.exampledomain"],"ca":"https://acme-staging-v02.api.letsencrypt.org/directory","account":"mail@proton.me"}
{"level":"info","ts":1658678461.4615788,"logger":"tls.issuance.acme","msg":"done waiting on internal rate limiter","identifiers":["bw.exampledomain"],"ca":"https://acme-staging-v02.api.letsencrypt.org/directory","account":"mail@proton.me"}
{"level":"warn","ts":1658678461.4683542,"logger":"pki.ca.local","msg":"installing root certificate (you might be prompted for password)","path":"storage:pki/authorities/local/root.crt"}
{"level":"error","ts":1658678461.472704,"logger":"pki.ca.local","msg":"failed to install root certificate","error":"failed to execute sudo: exit status 1","certificate_file":"storage:pki/authorities/local/root.crt"}
{"level":"info","ts":1658678461.4728737,"msg":"autosaved config (load with --resume flag)","file":"/home/caddy/.config/caddy/autosave.json"}
{"level":"info","ts":1658678461.472949,"msg":"serving initial configuration"}
{"level":"debug","ts":1658678461.801857,"logger":"tls.handshake","msg":"no matching certificates and no custom selection logic","identifier":"bw.exampledomain"}
{"level":"debug","ts":1658678461.8018842,"logger":"tls.handshake","msg":"no matching certificates and no custom selection logic","identifier":"*.exampledomain"}
{"level":"debug","ts":1658678461.8018875,"logger":"tls.handshake","msg":"no matching certificates and no custom selection logic","identifier":"*.*.de"}
{"level":"debug","ts":1658678461.80189,"logger":"tls.handshake","msg":"no matching certificates and no custom selection logic","identifier":"*.*.*"}
{"level":"debug","ts":1658678461.8018935,"logger":"tls.handshake","msg":"all external certificate managers yielded no certificates and no errors","sni":"bw.exampledomain"}
{"level":"debug","ts":1658678461.801898,"logger":"tls.handshake","msg":"no certificate matching TLS ClientHello","server_name":"bw.exampledomain","remote":"PublicIPv4Address:39660","identifier":"bw.exampledomain","cipher_suites":[4865,4867,4866,49195,49199,52393,52392,49196,49200,49162,49161,49171,49172,156,157,47,53],"cert_cache_fill":0.0001,"load_if_necessary":true,"obtain_if_necessary":true,"on_demand":false}
{"level":"debug","ts":1658678461.8019404,"logger":"http.stdlib","msg":"http: TLS handshake error from PublicIPv4Address:39660: no certificate available for 'bw.exampledomain'"}
{"level":"debug","ts":1658678461.979279,"logger":"tls.issuance.acme.acme_client","msg":"http request","method":"GET","url":"https://acme-staging-v02.api.letsencrypt.org/directory","headers":{"User-Agent":["Caddy/2.5.2 CertMagic acmez (linux; amd64)"]},"response_headers":{"Cache-Control":["public, max-age=0, no-cache"],"Content-Length":["822"],"Content-Type":["application/json"],"Date":["Sun, 24 Jul 2022 16:01:01 GMT"],"Server":["nginx"],"Strict-Transport-Security":["max-age=604800"],"X-Frame-Options":["DENY"]},"status_code":200}
{"level":"debug","ts":1658678462.1332712,"logger":"tls.issuance.acme.acme_client","msg":"http request","method":"HEAD","url":"https://acme-staging-v02.api.letsencrypt.org/acme/new-nonce","headers":{"User-Agent":["Caddy/2.5.2 CertMagic acmez (linux; amd64)"]},"response_headers":{"Cache-Control":["public, max-age=0, no-cache"],"Date":["Sun, 24 Jul 2022 16:01:02 GMT"],"Link":["<https://acme-staging-v02.api.letsencrypt.org/directory>;rel=\"index\""],"Replay-Nonce":["0002Ds407rmvqENqWM0TRK1XFXiT9hyWH6kTNw3yqM6ClZc"],"Server":["nginx"],"Strict-Transport-Security":["max-age=604800"],"X-Frame-Options":["DENY"]},"status_code":200}
{"level":"debug","ts":1658678462.1806855,"logger":"tls.issuance.acme.acme_client","msg":"http request","method":"HEAD","url":"https://acme-staging-v02.api.letsencrypt.org/acme/new-nonce","headers":{"User-Agent":["Caddy/2.5.2 CertMagic acmez (linux; amd64)"]},"response_headers":{"Cache-Control":["public, max-age=0, no-cache"],"Date":["Sun, 24 Jul 2022 16:01:02 GMT"],"Link":["<https://acme-staging-v02.api.letsencrypt.org/directory>;rel=\"index\""],"Replay-Nonce":["0001eP76rZstWKXKPmeCWWFzwPMqEIXw_CfXBRz764dhAX4"],"Server":["nginx"],"Strict-Transport-Security":["max-age=604800"],"X-Frame-Options":["DENY"]},"status_code":200}
{"level":"debug","ts":1658678462.3138912,"logger":"tls.issuance.acme.acme_client","msg":"http request","method":"POST","url":"https://acme-staging-v02.api.letsencrypt.org/acme/new-order","headers":{"Content-Type":["application/jose+json"],"User-Agent":["Caddy/2.5.2 CertMagic acmez (linux; amd64)"]},"response_headers":{"Boulder-Requester":["61940324"],"Cache-Control":["public, max-age=0, no-cache"],"Content-Length":["349"],"Content-Type":["application/json"],"Date":["Sun, 24 Jul 2022 16:01:02 GMT"],"Link":["<https://acme-staging-v02.api.letsencrypt.org/directory>;rel=\"index\""],"Location":["https://acme-staging-v02.api.letsencrypt.org/acme/order/61940324/3340291894"],"Replay-Nonce":["0001lq_63eVhq0N-NRbWJnTmHRvO5PBv_9L7Zj0q5lkrm0I"],"Server":["nginx"],"Strict-Transport-Security":["max-age=604800"],"X-Frame-Options":["DENY"]},"status_code":201}
{"level":"debug","ts":1658678462.3628232,"logger":"tls.issuance.acme.acme_client","msg":"http request","method":"POST","url":"https://acme-staging-v02.api.letsencrypt.org/acme/new-order","headers":{"Content-Type":["application/jose+json"],"User-Agent":["Caddy/2.5.2 CertMagic acmez (linux; amd64)"]},"response_headers":{"Boulder-Requester":["61940324"],"Cache-Control":["public, max-age=0, no-cache"],"Content-Length":["347"],"Content-Type":["application/json"],"Date":["Sun, 24 Jul 2022 16:01:02 GMT"],"Link":["<https://acme-staging-v02.api.letsencrypt.org/directory>;rel=\"index\""],"Location":["https://acme-staging-v02.api.letsencrypt.org/acme/order/61940324/3340291904"],"Replay-Nonce":["0002IRgv8kUeEjZniwEYelCjY-0dpjKlDCk9boP4zSkq-U0"],"Server":["nginx"],"Strict-Transport-Security":["max-age=604800"],"X-Frame-Options":["DENY"]},"status_code":201}
{"level":"debug","ts":1658678462.4706204,"logger":"tls.issuance.acme.acme_client","msg":"http request","method":"POST","url":"https://acme-staging-v02.api.letsencrypt.org/acme/authz-v3/3115867734","headers":{"Content-Type":["application/jose+json"],"User-Agent":["Caddy/2.5.2 CertMagic acmez (linux; amd64)"]},"response_headers":{"Boulder-Requester":["61940324"],"Cache-Control":["public, max-age=0, no-cache"],"Content-Length":["815"],"Content-Type":["application/json"],"Date":["Sun, 24 Jul 2022 16:01:02 GMT"],"Link":["<https://acme-staging-v02.api.letsencrypt.org/directory>;rel=\"index\""],"Replay-Nonce":["0002k6wEnBXGaNiI90rL_80zxRbJDBcer9gsmWIketZ3C38"],"Server":["nginx"],"Strict-Transport-Security":["max-age=604800"],"X-Frame-Options":["DENY"]},"status_code":200}
{"level":"debug","ts":1658678462.4708097,"logger":"tls.issuance.acme.acme_client","msg":"no solver configured","challenge_type":"tls-alpn-01"}
{"level":"info","ts":1658678462.4708211,"logger":"tls.issuance.acme.acme_client","msg":"trying to solve challenge","identifier":"nas1.exampledomain","challenge_type":"dns-01","ca":"https://acme-staging-v02.api.letsencrypt.org/directory"}
{"level":"debug","ts":1658678462.5219474,"logger":"tls.issuance.acme.acme_client","msg":"http request","method":"POST","url":"https://acme-staging-v02.api.letsencrypt.org/acme/authz-v3/3115867744","headers":{"Content-Type":["application/jose+json"],"User-Agent":["Caddy/2.5.2 CertMagic acmez (linux; amd64)"]},"response_headers":{"Boulder-Requester":["61940324"],"Cache-Control":["public, max-age=0, no-cache"],"Content-Length":["813"],"Content-Type":["application/json"],"Date":["Sun, 24 Jul 2022 16:01:02 GMT"],"Link":["<https://acme-staging-v02.api.letsencrypt.org/directory>;rel=\"index\""],"Replay-Nonce":["0002_fvG4Kwr7CuT0cLl4Zwp5vZj-j6_FEDFQcG_K3QLkQM"],"Server":["nginx"],"Strict-Transport-Security":["max-age=604800"],"X-Frame-Options":["DENY"]},"status_code":200}
{"level":"debug","ts":1658678462.52207,"logger":"tls.issuance.acme.acme_client","msg":"no solver configured","challenge_type":"tls-alpn-01"}
{"level":"info","ts":1658678462.5220778,"logger":"tls.issuance.acme.acme_client","msg":"trying to solve challenge","identifier":"bw.exampledomain","challenge_type":"dns-01","ca":"https://acme-staging-v02.api.letsencrypt.org/directory"}
{"level":"error","ts":1658678462.6699035,"logger":"tls.issuance.acme.acme_client","msg":"cleaning up solver","identifier":"nas1.exampledomain","challenge_type":"dns-01","error":"no memory of presenting a DNS record for nas1.exampledomain (probably OK if presenting failed)"}
{"level":"error","ts":1658678462.7197459,"logger":"tls.issuance.acme.acme_client","msg":"cleaning up solver","identifier":"bw.exampledomain","challenge_type":"dns-01","error":"no memory of presenting a DNS record for bw.exampledomain (probably OK if presenting failed)"}
{"level":"debug","ts":1658678462.83004,"logger":"tls.issuance.acme.acme_client","msg":"http request","method":"POST","url":"https://acme-staging-v02.api.letsencrypt.org/acme/authz-v3/3115867734","headers":{"Content-Type":["application/jose+json"],"User-Agent":["Caddy/2.5.2 CertMagic acmez (linux; amd64)"]},"response_headers":{"Boulder-Requester":["61940324"],"Cache-Control":["public, max-age=0, no-cache"],"Content-Length":["819"],"Content-Type":["application/json"],"Date":["Sun, 24 Jul 2022 16:01:02 GMT"],"Link":["<https://acme-staging-v02.api.letsencrypt.org/directory>;rel=\"index\""],"Replay-Nonce":["0002Ayr1l_zm1QR3SvSwtYIG8taeCbTjEL5NsWgGk8KXj7U"],"Server":["nginx"],"Strict-Transport-Security":["max-age=604800"],"X-Frame-Options":["DENY"]},"status_code":200}
{"level":"error","ts":1658678462.830171,"logger":"tls.obtain","msg":"could not get certificate from issuer","identifier":"nas1.exampledomain","issuer":"acme-staging-v02.api.letsencrypt.org-directory","error":"[nas1.exampledomain] solving challenges: presenting for challenge: adding temporary record for zone exampledomain.: [netcup] Validation Error.: Invalid entry for field apikey (order=https://acme-staging-v02.api.letsencrypt.org/acme/order/61940324/3340291894) (ca=https://acme-staging-v02.api.letsencrypt.org/directory)"}
{"level":"debug","ts":1658678462.830184,"logger":"tls.obtain","msg":"trying issuer 2/2","issuer":"acme-staging-v02.api.letsencrypt.org-directory"}
{"level":"info","ts":1658678462.8303726,"logger":"tls.issuance.acme","msg":"waiting on internal rate limiter","identifiers":["nas1.exampledomain"],"ca":"https://acme-staging-v02.api.letsencrypt.org/directory","account":"mail@proton.me"}
{"level":"info","ts":1658678462.8303964,"logger":"tls.issuance.acme","msg":"done waiting on internal rate limiter","identifiers":["nas1.exampledomain"],"ca":"https://acme-staging-v02.api.letsencrypt.org/directory","account":"mail@proton.me"}
{"level":"debug","ts":1658678462.8829553,"logger":"tls.issuance.acme.acme_client","msg":"http request","method":"POST","url":"https://acme-staging-v02.api.letsencrypt.org/acme/authz-v3/3115867744","headers":{"Content-Type":["application/jose+json"],"User-Agent":["Caddy/2.5.2 CertMagic acmez (linux; amd64)"]},"response_headers":{"Boulder-Requester":["61940324"],"Cache-Control":["public, max-age=0, no-cache"],"Content-Length":["817"],"Content-Type":["application/json"],"Date":["Sun, 24 Jul 2022 16:01:02 GMT"],"Link":["<https://acme-staging-v02.api.letsencrypt.org/directory>;rel=\"index\""],"Replay-Nonce":["0002b2GwpqkQ1H7o4-lWq7r5xjabfKV9Abko6uGs8R0rYW8"],"Server":["nginx"],"Strict-Transport-Security":["max-age=604800"],"X-Frame-Options":["DENY"]},"status_code":200}
{"level":"error","ts":1658678462.8830817,"logger":"tls.obtain","msg":"could not get certificate from issuer","identifier":"bw.exampledomain","issuer":"acme-staging-v02.api.letsencrypt.org-directory","error":"[bw.exampledomain] solving challenges: presenting for challenge: adding temporary record for zone exampledomain.: [netcup] Validation Error.: Invalid entry for field apikey (order=https://acme-staging-v02.api.letsencrypt.org/acme/order/61940324/3340291904) (ca=https://acme-staging-v02.api.letsencrypt.org/directory)"}
{"level":"debug","ts":1658678462.8830943,"logger":"tls.obtain","msg":"trying issuer 2/2","issuer":"acme-staging-v02.api.letsencrypt.org-directory"}
{"level":"info","ts":1658678462.8832483,"logger":"tls.issuance.acme","msg":"waiting on internal rate limiter","identifiers":["bw.exampledomain"],"ca":"https://acme-staging-v02.api.letsencrypt.org/directory","account":"mail@proton.me"}
{"level":"info","ts":1658678462.8832614,"logger":"tls.issuance.acme","msg":"done waiting on internal rate limiter","identifiers":["bw.exampledomain"],"ca":"https://acme-staging-v02.api.letsencrypt.org/directory","account":"mail@proton.me"}
{"level":"debug","ts":1658678463.2991533,"logger":"tls.issuance.acme.acme_client","msg":"http request","method":"HEAD","url":"https://acme-staging-v02.api.letsencrypt.org/acme/new-nonce","headers":{"User-Agent":["Caddy/2.5.2 CertMagic acmez (linux; amd64)"]},"response_headers":{"Cache-Control":["public, max-age=0, no-cache"],"Date":["Sun, 24 Jul 2022 16:01:03 GMT"],"Link":["<https://acme-staging-v02.api.letsencrypt.org/directory>;rel=\"index\""],"Replay-Nonce":["00020p-UcQwtPQgrHU-9HfCA2mMc0ExSaQ6a3237MvoPLyg"],"Server":["nginx"],"Strict-Transport-Security":["max-age=604800"],"X-Frame-Options":["DENY"]},"status_code":200}
{"level":"debug","ts":1658678463.3478408,"logger":"tls.issuance.acme.acme_client","msg":"http request","method":"HEAD","url":"https://acme-staging-v02.api.letsencrypt.org/acme/new-nonce","headers":{"User-Agent":["Caddy/2.5.2 CertMagic acmez (linux; amd64)"]},"response_headers":{"Cache-Control":["public, max-age=0, no-cache"],"Date":["Sun, 24 Jul 2022 16:01:03 GMT"],"Link":["<https://acme-staging-v02.api.letsencrypt.org/directory>;rel=\"index\""],"Replay-Nonce":["0001c3GlVu4LoecJb35bnoIMqYW_aq7hfvhzSwaKx1bZaxw"],"Server":["nginx"],"Strict-Transport-Security":["max-age=604800"],"X-Frame-Options":["DENY"]},"status_code":200}
{"level":"debug","ts":1658678463.4742422,"logger":"tls.issuance.acme.acme_client","msg":"http request","method":"POST","url":"https://acme-staging-v02.api.letsencrypt.org/acme/new-order","headers":{"Content-Type":["application/jose+json"],"User-Agent":["Caddy/2.5.2 CertMagic acmez (linux; amd64)"]},"response_headers":{"Boulder-Requester":["61940324"],"Cache-Control":["public, max-age=0, no-cache"],"Content-Length":["347"],"Content-Type":["application/json"],"Date":["Sun, 24 Jul 2022 16:01:03 GMT"],"Link":["<https://acme-staging-v02.api.letsencrypt.org/directory>;rel=\"index\""],"Location":["https://acme-staging-v02.api.letsencrypt.org/acme/order/61940324/3340292154"],"Replay-Nonce":["0001178PtRBbXcnBVc62legvUCL1w4OA7Jicz5ENI6w3gOM"],"Server":["nginx"],"Strict-Transport-Security":["max-age=604800"],"X-Frame-Options":["DENY"]},"status_code":201}
{"level":"debug","ts":1658678463.52441,"logger":"tls.issuance.acme.acme_client","msg":"http request","method":"POST","url":"https://acme-staging-v02.api.letsencrypt.org/acme/new-order","headers":{"Content-Type":["application/jose+json"],"User-Agent":["Caddy/2.5.2 CertMagic acmez (linux; amd64)"]},"response_headers":{"Boulder-Requester":["61940324"],"Cache-Control":["public, max-age=0, no-cache"],"Content-Length":["349"],"Content-Type":["application/json"],"Date":["Sun, 24 Jul 2022 16:01:03 GMT"],"Link":["<https://acme-staging-v02.api.letsencrypt.org/directory>;rel=\"index\""],"Location":["https://acme-staging-v02.api.letsencrypt.org/acme/order/61940324/3340292184"],"Replay-Nonce":["00027qhHb6cBKAu258IDU1rIXqR8sgxHlA_O9otTaFfSd6I"],"Server":["nginx"],"Strict-Transport-Security":["max-age=604800"],"X-Frame-Options":["DENY"]},"status_code":201}
{"level":"debug","ts":1658678463.630143,"logger":"tls.issuance.acme.acme_client","msg":"http request","method":"POST","url":"https://acme-staging-v02.api.letsencrypt.org/acme/authz-v3/3115867894","headers":{"Content-Type":["application/jose+json"],"User-Agent":["Caddy/2.5.2 CertMagic acmez (linux; amd64)"]},"response_headers":{"Boulder-Requester":["61940324"],"Cache-Control":["public, max-age=0, no-cache"],"Content-Length":["813"],"Content-Type":["application/json"],"Date":["Sun, 24 Jul 2022 16:01:03 GMT"],"Link":["<https://acme-staging-v02.api.letsencrypt.org/directory>;rel=\"index\""],"Replay-Nonce":["00012sHfVt3GA87eYM5BbUEBUwIttCfs0mhnIUfrkPOwkE0"],"Server":["nginx"],"Strict-Transport-Security":["max-age=604800"],"X-Frame-Options":["DENY"]},"status_code":200}
{"level":"debug","ts":1658678463.6302366,"logger":"tls.issuance.acme.acme_client","msg":"no solver configured","challenge_type":"tls-alpn-01"}
{"level":"info","ts":1658678463.6302428,"logger":"tls.issuance.acme.acme_client","msg":"trying to solve challenge","identifier":"bw.exampledomain","challenge_type":"dns-01","ca":"https://acme-staging-v02.api.letsencrypt.org/directory"}
{"level":"error","ts":1658678463.6619968,"logger":"tls.issuance.acme.acme_client","msg":"cleaning up solver","identifier":"bw.exampledomain","challenge_type":"dns-01","error":"no memory of presenting a DNS record for bw.exampledomain (probably OK if presenting failed)"}
{"level":"debug","ts":1658678463.6817498,"logger":"tls.issuance.acme.acme_client","msg":"http request","method":"POST","url":"https://acme-staging-v02.api.letsencrypt.org/acme/authz-v3/3115867904","headers":{"Content-Type":["application/jose+json"],"User-Agent":["Caddy/2.5.2 CertMagic acmez (linux; amd64)"]},"response_headers":{"Boulder-Requester":["61940324"],"Cache-Control":["public, max-age=0, no-cache"],"Content-Length":["815"],"Content-Type":["application/json"],"Date":["Sun, 24 Jul 2022 16:01:03 GMT"],"Link":["<https://acme-staging-v02.api.letsencrypt.org/directory>;rel=\"index\""],"Replay-Nonce":["0001R1bsVVrBFslMMJ9se3mVLKQJ4bMRxjPitouosqK4Q7U"],"Server":["nginx"],"Strict-Transport-Security":["max-age=604800"],"X-Frame-Options":["DENY"]},"status_code":200}
{"level":"debug","ts":1658678463.6818578,"logger":"tls.issuance.acme.acme_client","msg":"no solver configured","challenge_type":"tls-alpn-01"}
{"level":"info","ts":1658678463.6818793,"logger":"tls.issuance.acme.acme_client","msg":"trying to solve challenge","identifier":"nas1.exampledomain","challenge_type":"dns-01","ca":"https://acme-staging-v02.api.letsencrypt.org/directory"}
{"level":"error","ts":1658678463.7106369,"logger":"tls.issuance.acme.acme_client","msg":"cleaning up solver","identifier":"nas1.exampledomain","challenge_type":"dns-01","error":"no memory of presenting a DNS record for nas1.exampledomain (probably OK if presenting failed)"}
{"level":"debug","ts":1658678463.8219008,"logger":"tls.issuance.acme.acme_client","msg":"http request","method":"POST","url":"https://acme-staging-v02.api.letsencrypt.org/acme/authz-v3/3115867894","headers":{"Content-Type":["application/jose+json"],"User-Agent":["Caddy/2.5.2 CertMagic acmez (linux; amd64)"]},"response_headers":{"Boulder-Requester":["61940324"],"Cache-Control":["public, max-age=0, no-cache"],"Content-Length":["817"],"Content-Type":["application/json"],"Date":["Sun, 24 Jul 2022 16:01:03 GMT"],"Link":["<https://acme-staging-v02.api.letsencrypt.org/directory>;rel=\"index\""],"Replay-Nonce":["0002qjuQRye-dsEMKVE3gJwzZei_bRC7UFmFi7ArExiHVPk"],"Server":["nginx"],"Strict-Transport-Security":["max-age=604800"],"X-Frame-Options":["DENY"]},"status_code":200}
{"level":"error","ts":1658678463.8220704,"logger":"tls.obtain","msg":"could not get certificate from issuer","identifier":"bw.exampledomain","issuer":"acme-staging-v02.api.letsencrypt.org-directory","error":"[bw.exampledomain] solving challenges: presenting for challenge: adding temporary record for zone exampledomain.: [netcup] Validation Error.: Invalid entry for field apikey (order=https://acme-staging-v02.api.letsencrypt.org/acme/order/61940324/3340292154) (ca=https://acme-staging-v02.api.letsencrypt.org/directory)"}
{"level":"error","ts":1658678463.8220935,"logger":"tls.obtain","msg":"will retry","error":"[bw.exampledomain] Obtain: [bw.exampledomain] solving challenges: presenting for challenge: adding temporary record for zone exampledomain.: [netcup] Validation Error.: Invalid entry for field apikey (order=https://acme-staging-v02.api.letsencrypt.org/acme/order/61940324/3340292154) (ca=https://acme-staging-v02.api.letsencrypt.org/directory)","attempt":1,"retrying_in":60,"elapsed":2.360927729,"max_duration":2592000}
{"level":"debug","ts":1658678463.874204,"logger":"tls.issuance.acme.acme_client","msg":"http request","method":"POST","url":"https://acme-staging-v02.api.letsencrypt.org/acme/authz-v3/3115867904","headers":{"Content-Type":["application/jose+json"],"User-Agent":["Caddy/2.5.2 CertMagic acmez (linux; amd64)"]},"response_headers":{"Boulder-Requester":["61940324"],"Cache-Control":["public, max-age=0, no-cache"],"Content-Length":["819"],"Content-Type":["application/json"],"Date":["Sun, 24 Jul 2022 16:01:03 GMT"],"Link":["<https://acme-staging-v02.api.letsencrypt.org/directory>;rel=\"index\""],"Replay-Nonce":["00014uslDSZBL97jBU2p1H1e_vc1A3-sS3NqK9A-o41QyIY"],"Server":["nginx"],"Strict-Transport-Security":["max-age=604800"],"X-Frame-Options":["DENY"]},"status_code":200}
{"level":"error","ts":1658678463.874369,"logger":"tls.obtain","msg":"could not get certificate from issuer","identifier":"nas1.exampledomain","issuer":"acme-staging-v02.api.letsencrypt.org-directory","error":"[nas1.exampledomain] solving challenges: presenting for challenge: adding temporary record for zone exampledomain.: [netcup] Validation Error.: Invalid entry for field apikey (order=https://acme-staging-v02.api.letsencrypt.org/acme/order/61940324/3340292184) (ca=https://acme-staging-v02.api.letsencrypt.org/directory)"}
{"level":"error","ts":1658678463.8743868,"logger":"tls.obtain","msg":"will retry","error":"[nas1.exampledomain] Obtain: [nas1.exampledomain] solving challenges: presenting for challenge: adding temporary record for zone exampledomain.: [netcup] Validation Error.: Invalid entry for field apikey (order=https://acme-staging-v02.api.letsencrypt.org/acme/order/61940324/3340292184) (ca=https://acme-staging-v02.api.letsencrypt.org/directory)","attempt":1,"retrying_in":60,"elapsed":2.416823071,"max_duration":2592000}
5. What I already tried:
I recreated my Netcup-API credentials (API Key and API Password) and reapplied them to “/etc/environment”. It didnt fix the issue though.
How Netcup’s DNS-Plugin retrieves the API credentials through caddyfile:
customer_number {env.NETCUP_CUSTOMER_NUMBER}
api_key {env.NETCUP_API_KEY}
api_password {env.NETCUP_API_PASSWORD}
And this is what I put into /etc/environment:
cat /etc/environment
NETCUP_CUSTOMER_NUMBER=customernumber
NETCUP_API_KEY=apiKey
NETCUP_API_PASSWORD=apiPassword
Maybe I misconfigured the API credentials?
6. Links to relevant resources:
Follwed this guide to install Netcup’s DNS-Plugin for Caddy
Installed this Netcup DNS-Plugin with xcaddy
Thanks for your help and have a nice sunday 
