1. The problem I’m having:
I’m trying to obtain a TLS certificate using Caddy with the DNS challenge and Cloudflare as my DNS provider. However, the DNS challenge fails and Caddy is unable to present the required DNS record. Despite verifying that the container has full internet access and testing the Cloudflare API (which responds correctly), the challenge fails with a lot of errors.
I tried to use chatgpt gemini but i found no solution.
2. Error messages and/or full log output:
84","headers":{"Content-Type":["application/jose+json"],"User-Agent":["Caddy/2.9.1 CertMagic acmez (linux; amd64)"]},"response_headers":{"Cache-Control":["public, max-age=0, no-cache"],"Content-Length":["472"],"Content-Type":["application/json"],"Date":["Fri, 04 Apr 2025 13:11:50 GMT"],"Link":["<https://acme-staging-v02.api.letsencrypt.org/directory>;rel=\"index\""],"Replay-Nonce":["2tykYePSczpDu9fexDiVN3t0H_5KnxwazSZQk-elcp3pdeGhRxA"],"Server":["nginx"],"Strict-Transport-Security":["max-age=604800"],"X-Frame-Options":["DENY"]},"status_code":200}
{"level":"debug","ts":1743772311.1647732,"msg":"http request","method":"POST","url":"https://acme-staging-v02.api.letsencrypt.org/acme/cert/2cd7927212daec563a470cc6d2c94004858f","headers":{"Content-Type":["application/jose+json"],"User-Agent":["Caddy/2.9.1 CertMagic acmez (linux; amd64)"]},"response_headers":{"Cache-Control":["public, max-age=0, no-cache"],"Content-Length":["3067"],"Content-Type":["application/pem-certificate-chain"],"Date":["Fri, 04 Apr 2025 13:11:51 GMT"],"Link":["<https://acme-staging-v02.api.letsencrypt.org/directory>;rel=\"index\"","<https://acme-staging-v02.api.letsencrypt.org/acme/cert/2cd7927212daec563a470cc6d2c94004858f/1>;rel=\"alternate\""],"Replay-Nonce":["2tykYePSXlmKEMVULODWdz-jeN6ZIhlK1fdbT2MNm08DrEKbRww"],"Server":["nginx"],"Strict-Transport-Security":["max-age=604800"],"X-Frame-Options":["DENY"]},"status_code":200}
{"level":"debug","ts":1743772311.1649537,"msg":"getting renewal info","names":["test.home-lab.li"]}
{"level":"debug","ts":1743772311.4218931,"msg":"http request","method":"GET","url":"https://acme-staging-v02.api.letsencrypt.org/draft-ietf-acme-ari-03/renewalInfo/oXQaBm1Qt4YtSizBfrSNiElszRY.LNeSchLa7FY6RwzG0slABIWP","headers":{"User-Agent":["Caddy/2.9.1 CertMagic acmez (linux; amd64)"]},"response_headers":{"Cache-Control":["public, max-age=0, no-cache"],"Content-Length":["101"],"Content-Type":["application/json"],"Date":["Fri, 04 Apr 2025 13:11:51 GMT"],"Link":["<https://acme-staging-v02.api.letsencrypt.org/directory>;rel=\"index\""],"Retry-After":["21600"],"Server":["nginx"],"Strict-Transport-Security":["max-age=604800"],"X-Frame-Options":["DENY"]},"status_code":200}
{"level":"info","ts":1743772311.4219947,"msg":"got renewal info","names":["test.home-lab.li"],"window_start":1748876241,"window_end":1749031691,"selected_time":1748921673,"recheck_after":1743793911.421988,"explanation_url":""}
{"level":"debug","ts":1743772311.671596,"msg":"http request","method":"POST","url":"https://acme-staging-v02.api.letsencrypt.org/acme/cert/2cd7927212daec563a470cc6d2c94004858f/1","headers":{"Content-Type":["application/jose+json"],"User-Agent":["Caddy/2.9.1 CertMagic acmez (linux; amd64)"]},"response_headers":{"Cache-Control":["public, max-age=0, no-cache"],"Content-Length":["2510"],"Content-Type":["application/pem-certificate-chain"],"Date":["Fri, 04 Apr 2025 13:11:51 GMT"],"Link":["<https://acme-staging-v02.api.letsencrypt.org/directory>;rel=\"index\"","<https://acme-staging-v02.api.letsencrypt.org/acme/cert/2cd7927212daec563a470cc6d2c94004858f/0>;rel=\"alternate\""],"Replay-Nonce":["cFzjDXVwQKKwpKedQo3m1-0yQKf1aplynPjDUJ3tIIRUz80KmO8"],"Server":["nginx"],"Strict-Transport-Security":["max-age=604800"],"X-Frame-Options":["DENY"]},"status_code":200}
{"level":"debug","ts":1743772311.6717796,"msg":"getting renewal info","names":["test.home-lab.li"]}
{"level":"debug","ts":1743772311.9237158,"msg":"http request","method":"GET","url":"https://acme-staging-v02.api.letsencrypt.org/draft-ietf-acme-ari-03/renewalInfo/oXQaBm1Qt4YtSizBfrSNiElszRY.LNeSchLa7FY6RwzG0slABIWP","headers":{"User-Agent":["Caddy/2.9.1 CertMagic acmez (linux; amd64)"]},"response_headers":{"Cache-Control":["public, max-age=0, no-cache"],"Content-Length":["101"],"Content-Type":["application/json"],"Date":["Fri, 04 Apr 2025 13:11:51 GMT"],"Link":["<https://acme-staging-v02.api.letsencrypt.org/directory>;rel=\"index\""],"Retry-After":["21600"],"Server":["nginx"],"Strict-Transport-Security":["max-age=604800"],"X-Frame-Options":["DENY"]},"status_code":200}
{"level":"info","ts":1743772311.9238791,"msg":"got renewal info","names":["test.home-lab.li"],"window_start":1748876241,"window_end":1749031691,"selected_time":1749030688,"recheck_after":1743793911.9238513,"explanation_url":""}
{"level":"info","ts":1743772311.9239392,"msg":"successfully downloaded available certificate chains","count":2,"first_url":"https://acme-staging-v02.api.letsencrypt.org/acme/cert/2cd7927212daec563a470cc6d2c94004858f"}
{"level":"debug","ts":1743772311.9239726,"logger":"tls.issuance.acme","msg":"selected certificate chain","url":"https://acme-staging-v02.api.letsencrypt.org/acme/cert/2cd7927212daec563a470cc6d2c94004858f"}
{"level":"debug","ts":1743772311.9243572,"logger":"tls.issuance.acme","msg":"using existing ACME account because key found in storage associated with email","email":"","ca":"https://acme-v02.api.letsencrypt.org/directory"}
{"level":"info","ts":1743772311.9243886,"logger":"tls.issuance.acme","msg":"waiting on internal rate limiter","identifiers":["test.home-lab.li"],"ca":"https://acme-v02.api.letsencrypt.org/directory","account":""}
{"level":"info","ts":1743772311.9244044,"logger":"tls.issuance.acme","msg":"done waiting on internal rate limiter","identifiers":["test.home-lab.li"],"ca":"https://acme-v02.api.letsencrypt.org/directory","account":""}
{"level":"info","ts":1743772311.924417,"logger":"tls.issuance.acme","msg":"using ACME account","account_id":"https://acme-v02.api.letsencrypt.org/acme/acct/2320609367","account_contact":[]}
{"level":"debug","ts":1743772311.9244545,"msg":"creating order","account":"https://acme-v02.api.letsencrypt.org/acme/acct/2320609367","identifiers":["test.home-lab.li"]}
{"level":"debug","ts":1743772312.7700331,"msg":"http request","method":"HEAD","url":"https://acme-v02.api.letsencrypt.org/acme/new-nonce","headers":{"User-Agent":["Caddy/2.9.1 CertMagic acmez (linux; amd64)"]},"response_headers":{"Cache-Control":["public, max-age=0, no-cache"],"Date":["Fri, 04 Apr 2025 13:11:52 GMT"],"Link":["<https://acme-v02.api.letsencrypt.org/directory>;rel=\"index\""],"Replay-Nonce":["NLny9_EduQESq5BsaC_WqVIUOP8Vb5PRATWsE-8Re1nBT0a4M3Q"],"Server":["nginx"],"Strict-Transport-Security":["max-age=604800"],"X-Frame-Options":["DENY"]},"status_code":200}
{"level":"debug","ts":1743772313.1234367,"msg":"http request","method":"POST","url":"https://acme-v02.api.letsencrypt.org/acme/new-order","headers":{"Content-Type":["application/jose+json"],"User-Agent":["Caddy/2.9.1 CertMagic acmez (linux; amd64)"]},"response_headers":{"Boulder-Requester":["2320609367"],"Cache-Control":["public, max-age=0, no-cache"],"Content-Length":["350"],"Content-Type":["application/json"],"Date":["Fri, 04 Apr 2025 13:11:52 GMT"],"Link":["<https://acme-v02.api.letsencrypt.org/directory>;rel=\"index\""],"Location":["https://acme-v02.api.letsencrypt.org/acme/order/2320609367/370659333527"],"Replay-Nonce":["mjolWR0r-t_dUBjZ4pkmbwoSOf3jLV6XaM2m97Hyb9et-wdDy1s"],"Server":["nginx"],"Strict-Transport-Security":["max-age=604800"],"X-Frame-Options":["DENY"]},"status_code":201}
{"level":"debug","ts":1743772313.3882303,"msg":"http request","method":"POST","url":"https://acme-v02.api.letsencrypt.org/acme/authz/2320609367/500335459397","headers":{"Content-Type":["application/jose+json"],"User-Agent":["Caddy/2.9.1 CertMagic acmez (linux; amd64)"]},"response_headers":{"Boulder-Requester":["2320609367"],"Cache-Control":["public, max-age=0, no-cache"],"Content-Length":["824"],"Content-Type":["application/json"],"Date":["Fri, 04 Apr 2025 13:11:53 GMT"],"Link":["<https://acme-v02.api.letsencrypt.org/directory>;rel=\"index\""],"Replay-Nonce":["NLny9_EdTSWcccBGWwG43OmcAePe1E1YKxXCDTCXcCe_D2CdrLs"],"Server":["nginx"],"Strict-Transport-Security":["max-age=604800"],"X-Frame-Options":["DENY"]},"status_code":200}
{"level":"debug","ts":1743772313.3883786,"msg":"no solver configured","challenge_type":"http-01"}
{"level":"debug","ts":1743772313.388385,"msg":"no solver configured","challenge_type":"tls-alpn-01"}
{"level":"info","ts":1743772313.3883886,"msg":"trying to solve challenge","identifier":"test.home-lab.li","challenge_type":"dns-01","ca":"https://acme-v02.api.letsencrypt.org/directory"}
{"level":"error","ts":1743772314.5024095,"msg":"cleaning up solver","identifier":"test.home-lab.li","challenge_type":"dns-01","error":"no memory of presenting a DNS record for \"_acme-challenge.test.home-lab.li\" (usually OK if presenting also failed)","stacktrace":"github.com/mholt/acmez/v3.(*Client).solveChallenges.func1\n\tgithub.com/mholt/acmez/v3@v3.0.0/client.go:318\ngithub.com/mholt/acmez/v3.(*Client).solveChallenges\n\tgithub.com/mholt/acmez/v3@v3.0.0/client.go:363\ngithub.com/mholt/acmez/v3.(*Client).ObtainCertificate\n\tgithub.com/mholt/acmez/v3@v3.0.0/client.go:136\ngithub.com/caddyserver/certmagic.(*ACMEIssuer).doIssue\n\tgithub.com/caddyserver/certmagic@v0.21.6/acmeissuer.go:477\ngithub.com/caddyserver/certmagic.(*ACMEIssuer).Issue\n\tgithub.com/caddyserver/certmagic@v0.21.6/acmeissuer.go:399\ngithub.com/caddyserver/caddy/v2/modules/caddytls.(*ACMEIssuer).Issue\n\tgithub.com/caddyserver/caddy/v2@v2.9.1/modules/caddytls/acmeissuer.go:249\ngithub.com/caddyserver/certmagic.(*Config).obtainCert.func2\n\tgithub.com/caddyserver/certmagic@v0.21.6/config.go:626\ngithub.com/caddyserver/certmagic.doWithRetry\n\tgithub.com/caddyserver/certmagic@v0.21.6/async.go:104\ngithub.com/caddyserver/certmagic.(*Config).obtainCert\n\tgithub.com/caddyserver/certmagic@v0.21.6/config.go:700\ngithub.com/caddyserver/certmagic.(*Config).ObtainCertAsync\n\tgithub.com/caddyserver/certmagic@v0.21.6/config.go:505\ngithub.com/caddyserver/certmagic.(*Config).manageOne.func1\n\tgithub.com/caddyserver/certmagic@v0.21.6/config.go:415\ngithub.com/caddyserver/certmagic.(*jobManager).worker\n\tgithub.com/caddyserver/certmagic@v0.21.6/async.go:73"}
{"level":"debug","ts":1743772314.805724,"msg":"http request","method":"POST","url":"https://acme-v02.api.letsencrypt.org/acme/authz/2320609367/500335459397","headers":{"Content-Type":["application/jose+json"],"User-Agent":["Caddy/2.9.1 CertMagic acmez (linux; amd64)"]},"response_headers":{"Boulder-Requester":["2320609367"],"Cache-Control":["public, max-age=0, no-cache"],"Content-Length":["828"],"Content-Type":["application/json"],"Date":["Fri, 04 Apr 2025 13:11:54 GMT"],"Link":["<https://acme-v02.api.letsencrypt.org/directory>;rel=\"index\""],"Replay-Nonce":["NLny9_Ed5F1Cf47pZzfeHFKUeF7QktuKanGymX4tgQvva7w5ZGc"],"Server":["nginx"],"Strict-Transport-Security":["max-age=604800"],"X-Frame-Options":["DENY"]},"status_code":200}
{"level":"error","ts":1743772314.8059533,"logger":"tls.obtain","msg":"could not get certificate from issuer","identifier":"test.home-lab.li","issuer":"acme-v02.api.letsencrypt.org-directory","error":"[test.home-lab.li] solving challenges: presenting for challenge: adding temporary record for zone \"li.\": expected 1 zone, got 0 for li. (order=https://acme-v02.api.letsencrypt.org/acme/order/2320609367/370659333527) (ca=https://acme-v02.api.letsencrypt.org/directory)"}
{"level":"debug","ts":1743772314.8059952,"logger":"events","msg":"event","name":"cert_failed","id":"7225b055-8e0c-4991-8070-93d06a732fe8","origin":"tls","data":{"error":{"Err":{}},"identifier":"test.home-lab.li","issuers":["acme-v02.api.letsencrypt.org-directory"],"renewal":false}}
{"level":"info","ts":1743772314.806051,"logger":"tls.obtain","msg":"releasing lock","identifier":"test.home-lab.li"}
{"level":"error","ts":1743772314.8066485,"logger":"tls","msg":"job failed","error":"test.home-lab.li: obtaining certificate: [test.home-lab.li] Obtain: [test.home-lab.li] solving challenges: presenting for challenge: adding temporary record for zone \"li.\": expected 1 zone, got 0 for li. (order=https://acme-v02.api.letsencrypt.org/acme/order/2320609367/370659333527) (ca=https://acme-v02.api.letsencrypt.org/directory)"}
3. Caddy version:
I’m running Caddy 2.9.1
4. How I installed and ran Caddy:
- OS/Platform: Docker container on a Linux host
- Architecture: amd64
- Deployment: Docker Compose
b. Command:
docker-compose up -d
c. Service/unit/compose file:
services:
caddy:
container_name: caddy
build: .
restart: unless-stopped
ports:
- "80:80"
- "443:443"
volumes:
- /data/caddy/caddyconf:/etc/caddy # This is the directory, not the Caddyfile
- /data/caddy/site:/srv
- /data/caddy/caddy_data:/data
- /data/caddy/caddy_config:/config
networks:
- alex_web
networks:
alex_web:
external: true
Dockerfile
FROM caddy:2-builder AS builder
RUN xcaddy build \
--with github.com/caddy-dns/cloudflare
FROM caddy:2
COPY --from=builder /usr/bin/caddy /usr/bin/caddy
d. My complete Caddy config:
{
debug
}
test.home-lab.li {
tls {
dns cloudflare API_KEY_HERE {
# zone home-lab.li
# propagation_delay 60s
}
}
respond "Test certificate for test.home-lab.li active"
}
I’ve also tried an alternate configuration using:
{
acme_dns cloudflare "API_KEY_HERE"
}
but the result is the same…
What else i tried?
same error with acme_dns
{
acme_dns cloudflare "API_KEY_HERE"
}
check if the API KEY works
curl -X GET "https://api.cloudflare.com/client/v4/zones" \
-H "Authorization: Bearer YOUR_API_KEY_HERE" \
-H "Content-Type: application/json"
{
"result": [
{
"id": "REDACTED",
"name": "home-lab.li",
"status": "active",
"paused": false,
"type": "full",
"development_mode": 0,
"name_servers": [
"alina.ns.cloudflare.com",
"carter.ns.cloudflare.com"
],
"original_name_servers": null,
"original_registrar": null,
"original_dnshost": null,
"modified_on": "2025-03-25T16:00:56.672494Z",
"created_on": "2025-03-25T14:55:19.954823Z",
"activated_on": "2025-03-25T16:00:56.672494Z",
"meta": {
"step": 2,
"custom_certificate_quota": 0,
"page_rule_quota": 3,
"phishing_detected": false
},
"owner": {
"id": null,
"type": "user",
"email": null
},
"account": {
"id": "REDACTED",
"name": "underwater-way"
},
"tenant": {
"id": null,
"name": null
},
"tenant_unit": {
"id": null
},
"permissions": [
"#zone:read",
"#zone_settings:read",
"#dns_records:edit",
"#dns_records:read"
],
"plan": {
"id": "REDACTED",
"name": "Free Website",
"price": 0,
"currency": "USD",
"frequency": "",
"is_subscribed": false,
"can_subscribe": false,
"legacy_id": "free",
"legacy_discount": false,
"externally_managed": false
}
}
],
"result_info": {
"page": 1,
"per_page": 20,
"total_pages": 1,
"count": 1,
"total_count": 1
},
"success": true,
"errors": [],
"messages": []
}
i have internet on the host and in the container, tested with wget and
nslookup
wget www.cloudlfare.com
--2025-04-04 15:26:37-- http://www.cloudlfare.com/
Auflösen des Hostnamens www.cloudlfare.com (www.cloudlfare.com)… 15.197.148.33, 3.33.130.190
Verbindungsaufbau zu www.cloudlfare.com (www.cloudlfare.com)|15.197.148.33|:80 … verbunden.
HTTP-Anforderung gesendet, auf Antwort wird gewartet … 200 OK
nslookup www.cloudflare.com
Server: 10.0.30.1
Address: 10.0.30.1#53
Non-authoritative answer:
Name: www.cloudflare.com
Address: 104.16.123.96
Name: www.cloudflare.com
Address: 104.16.124.96
Name: www.cloudflare.com
Address: 2606:4700::6810:7b60
Name: www.cloudflare.com
Address: 2606:4700::6810:7c60
