Let's Encrypt 和 华为云的DNS 不大兼容啊

king51ccf

ccf 发表于 2020-10-21 12:31

我知道他这个机制，我都是写一个记录的，

但问题是，哪怕这个记录里面只有一行TXT，https://unboundtest ...
我说的不是一行，而是有其他的txt记录，你是不是有多个记录集

sky170

Let's Encrypt部分地区验证超时，还是算了吧

By小酷

By小酷 发表于 2020-10-21 13:42

我说的不是一行，而是有其他的txt记录，你是不是有多个记录集

不是，我只有一条  TXT 记录集

不管这个记录集合里面有几行，都不行

比如 _acme-challenge.abc.com 这个TXT记录集，以下两种 txt 都有问题

只有一行
“vsebvtrsbtresb"

或者两行
"veavrevasresvre"
"xresgvrwbvtreb"

应该不是记录的问题，而是华为DNS并不满足某些RFC标准

请叫我毛线

本帖最后由 ccf 于 2020-10-21 22:28 编辑

扫描了一下华为云的DNS，应该是不支持 echo capitalization 导致的

已发工单，需要对DNS服务器做调整，看看他们能否解决

[ol]

X        Fatal error: Nameserver doesn't support echo capitalization. That's critical if you want to create Letsencrypt certificates. Read https://tools.ietf.org/html/draft-vixie-dnsext-dns0x20-00 (2008). If a dns client asks "ExAmPlE.cOm", the name server must answer with the same name, not with "example.com". Creating Letsencrypt certificates isn't possible. Your name server provider must update the software.: ns1.huaweicloud-dns.cn / 43.254.0.68

X        Fatal error: Nameserver doesn't support echo capitalization. That's critical if you want to create Letsencrypt certificates. Read https://tools.ietf.org/html/draft-vixie-dnsext-dns0x20-00 (2008). If a dns client asks "ExAmPlE.cOm", the name server must answer with the same name, not with "example.com". Creating Letsencrypt certificates isn't possible. Your name server provider must update the software.: ns1.huaweicloud-dns.com / 114.115.192.11

X        Fatal error: Nameserver doesn't support echo capitalization. That's critical if you want to create Letsencrypt certificates. Read https://tools.ietf.org/html/draft-vixie-dnsext-dns0x20-00 (2008). If a dns client asks "ExAmPlE.cOm", the name server must answer with the same name, not with "example.com". Creating Letsencrypt certificates isn't possible. Your name server provider must update the software.: ns1.huaweicloud-dns.com / 139.9.224.17

X        Fatal error: Nameserver doesn't support echo capitalization. That's critical if you want to create Letsencrypt certificates. Read https://tools.ietf.org/html/draft-vixie-dnsext-dns0x20-00 (2008). If a dns client asks "ExAmPlE.cOm", the name server must answer with the same name, not with "example.com". Creating Letsencrypt certificates isn't possible. Your name server provider must update the software.: ns1.huaweicloud-dns.net / 159.138.76.159

X        Fatal error: Nameserver doesn't support echo capitalization. That's critical if you want to create Letsencrypt certificates. Read https://tools.ietf.org/html/draft-vixie-dnsext-dns0x20-00 (2008). If a dns client asks "ExAmPlE.cOm", the name server must answer with the same name, not with "example.com". Creating Letsencrypt certificates isn't possible. Your name server provider must update the software.: ns1.huaweicloud-dns.org

X        Fatal error: Nameserver doesn't support echo capitalization. That's critical if you want to create Letsencrypt certificates. Read https://tools.ietf.org/html/draft-vixie-dnsext-dns0x20-00 (2008). If a dns client asks "ExAmPlE.cOm", the name server must answer with the same name, not with "example.com". Creating Letsencrypt certificates isn't possible. Your name server provider must update the software.: ns1.huaweicloud-dns.org / 159.138.17.59

X        Fatal error: Nameserver doesn't support echo capitalization. That's critical if you want to create Letsencrypt certificates. Read https://tools.ietf.org/html/draft-vixie-dnsext-dns0x20-00 (2008). If a dns client asks "ExAmPlE.cOm", the name server must answer with the same name, not with "example.com". Creating Letsencrypt certificates isn't possible. Your name server provider must update the software.: ns1.huaweicloud-dns.org / 159.138.77.159[/ol]复制代码

ccf

Let's Encrypt  和 DNS.COM 的自定义路线也不兼容

MMP 我用了几天才发现  100多W百度蜘蛛变5000 真是牛P

ccf

华为……就这样吧，我反正不用

wermnb

@king51

华为的回复来了，我不知道之前是不是也是这么和你说的啊，如果是的话看来遥遥无期啊。。。

"

avada

用DigiCert免费证书貌似没有这个问题
VULLUV 发表于 2020-10-23 18:15

用DigiCert免费证书貌似没有这个问题
只针对 Let's 的泛域名证书，因为这货要求只能 DNS 验证，而且验证比较严格

ccf

ccf 发表于 2020-10-23 17:30

@king51

华为的回复来了，我不知道之前是不是也是这么和你说的啊，如果是的话看来遥遥无期啊。。。


没错，就是这样的，之前说9月就好了，估计是碰到问题了

VULLUVccf

king51 发表于 2020-10-23 21:51

没错，就是这样的，之前说9月就好了，估计是碰到问题了
果然被我猜中了，看来真的不靠谱