1. Caddy version (caddy version):
v2.4.0-beta.1 h1:Ed/tIaN3p6z8M3pEiXWJL/T8JmCqV62FrSJCHKquW/I=
2. How I run Caddy:
I run caddy inside Ubuntu 18.04
a. System environment:
Ubuntu 18.04
b. Command:
caddy run
c. Service/unit/compose file:
N/A
d. My complete Caddyfile or JSON config:
*.stage.mydomain.com {
encode zstd gzip
tls {
dns cloudflare REDACTED
}
}
3. The problem I’m having:
After requesting a wildcard certificate for my subdomain, I see that caddy is unable to obtain a certificate from lets encrypt, it tries after with zerossl and successfully obtains the certificate. Is there a reason why it was not able to retrieve it from lets encrypt instead? I verified that there was in fact a TXT record for the domain. Could it possibly be a timing issue, as zerossl is able to obtain the certificate as it is tried second?
Thank you for your help!
4. Error messages and/or full log output:
Mar 23 22:32:51 intranet caddy[603]: {"level":"info","ts":1616538771.8101516,"logger":"tls.cache.maintenance","msg":"started background certificate maintenance","cache":"0xc00025e850"}
Mar 23 22:32:51 intranet caddy[603]: {"level":"info","ts":1616538771.8101516,"logger":"tls.cache.maintenance","msg":"started background certificate maintenance","cache":"0xc00025e850"}
Mar 23 22:32:55 intranet caddy[603]: {"level":"info","ts":1616538775.0949454,"logger":"http","msg":"enabling automatic TLS certificate management","domains":["*.internal.mydomain.com","*.stagings.mydomain.com","*.mydomain.com"]}
Mar 23 22:32:55 intranet caddy[603]: {"level":"info","ts":1616538775.1070056,"logger":"tls","msg":"cleaned up storage units"}
Mar 23 22:32:55 intranet caddy[603]: {"level":"info","ts":1616538775.1237586,"msg":"autosaved config","file":"/var/lib/caddy/.config/caddy/autosave.json"}
Mar 23 22:32:55 intranet caddy[603]: {"level":"info","ts":1616538775.1239414,"msg":"serving initial configuration"}
Mar 23 22:32:55 intranet caddy[603]: {"level":"info","ts":1616538775.12652,"logger":"tls.obtain","msg":"acquiring lock","identifier":"*.stagings.mydomain.com"}
Mar 23 22:32:55 intranet caddy[603]: {"level":"info","ts":1616538775.130257,"logger":"tls.obtain","msg":"lock acquired","identifier":"*.stagings.mydomain.com"}
Mar 23 22:32:55 intranet caddy[603]: {"level":"info","ts":1616538775.143203,"logger":"tls.issuance.acme","msg":"waiting on internal rate limiter","identifiers":["*.stagings.mydomain.com"]}
Mar 23 22:32:55 intranet caddy[603]: {"level":"info","ts":1616538775.1434176,"logger":"tls.issuance.acme","msg":"done waiting on internal rate limiter","identifiers":["*.stagings.mydomain.com"]}
Mar 23 22:32:55 intranet caddy[603]: {"level":"info","ts":1616538775.783211,"logger":"tls.issuance.acme.acme_client","msg":"trying to solve challenge","identifier":"*.stagings.mydomain.com","challenge_type":"dns-01","ca":"https://acme-v02.api.letsencrypt.org/directory"}
Mar 23 22:32:56 intranet caddy[603]: {"level":"error","ts":1616538776.698515,"logger":"tls.issuance.acme.acme_client","msg":"challenge failed","identifier":"*.stagings.mydomain.com","challenge_type":"dns-01","status_code":403,"problem_type":"urn:ietf:params:acme:error:unauthorized","error":"No TXT record found at _acme-challenge.stagings.mydomain.com"}
Mar 23 22:32:56 intranet caddy[603]: {"level":"error","ts":1616538776.698574,"logger":"tls.issuance.acme.acme_client","msg":"validating authorization","identifier":"*.stagings.mydomain.com","error":"authorization failed: HTTP 403 urn:ietf:params:acme:error:unauthorized - No TXT record found at _acme-challenge.stagings.mydomain.com","order":"https://acme-v02.api.letsencrypt.org/acme/order/REDACTED","attempt":1,"max_attempts":3}
Mar 23 22:32:57 intranet caddy[603]: {"level":"info","ts":1616538777.975016,"logger":"tls.issuance.acme","msg":"waiting on internal rate limiter","identifiers":["*.stagings.mydomain.com"]}
Mar 23 22:32:57 intranet caddy[603]: {"level":"info","ts":1616538777.9762406,"logger":"tls.issuance.acme","msg":"done waiting on internal rate limiter","identifiers":["*.stagings.mydomain.com"]}
Mar 23 22:32:58 intranet caddy[603]: {"level":"info","ts":1616538778.7990777,"logger":"tls.issuance.acme.acme_client","msg":"trying to solve challenge","identifier":"*.stagings.mydomain.com","challenge_type":"dns-01","ca":"https://acme.zerossl.com/v2/DV90"}
Mar 23 22:35:59 intranet caddy[603]: {"level":"info","ts":1616538959.3806121,"logger":"tls.issuance.acme.acme_client","msg":"validations succeeded; finalizing order","order":"https://acme.zerossl.com/v2/DV90/order/REDACTED"}
Mar 23 22:36:14 intranet caddy[603]: {"level":"info","ts":1616538974.7955675,"logger":"tls.issuance.acme.acme_client","msg":"successfully downloaded available certificate chains","count":1,"first_url":"https://acme.zerossl.com/v2/DV90/cert/REDACTED"}
Mar 23 22:36:14 intranet caddy[603]: {"level":"info","ts":1616538974.800866,"logger":"tls.obtain","msg":"certificate obtained successfully","identifier":"*.stagings.mydomain.com"}
Mar 23 22:36:14 intranet caddy[603]: {"level":"info","ts":1616538974.8008902,"logger":"tls.obtain","msg":"releasing lock","identifier":"*.stagings.mydomain.com"}
Mar 23 22:36:15 intranet caddy[603]: {"level":"warn","ts":1616538975.000993,"logger":"tls","msg":"stapling OCSP","error":"no OCSP stapling for [*.stagings.mydomain.com]: parsing OCSP response: ocsp: error from server: unauthorized"}
5. What I already tried:
I tried issuing a new API Token from cloudflare with very loose permissions to rule out that the API token was the problem, this did not fix it.
