addons: DuckDNS Alias domain fails dns-01 challenge

Quote by wgrziwa ⬆

I originally suggested that the additional wildcard DNS entry for my alias domain solved the issue for me. Now after my certificate expired I have to report that it didn’t fix the issue but I have a workaround.

I believe the reason for the failure is that both - the duckdns AND the alias domain - point to the same IP address and there are two challenges to be fulfilled by letsencrypt the txt record of one of the challenges will be incorrect.

My workaround is a two step process which unfortunately won’t allow the automatic renewal when using the alias:

1. Remove the alias domain and just create the certificate for the duckdns domain. After a restart the challenge was successfully validated.

2. Add the alias domain and restart again. This only validated the alias domain and worked without a problem.
   This just confirmed the SSL certificate but I also needed to restart the server to activate the new certificate as someone previously mentioned.

Not sure who maintains the plugin but a possible software fix could be: If multiple challenges are required setup one TXT record for the first challenge and after successful validation do the same for the second challenge.

I hope this can help someone else in a similar situation.

You are definitely right! Your answer helped me a lot figuring out this issue. This seems to be a bug in the addon that should be fixed. After hours of fiddling around these following steps allowed me to set an alias for my duckdns.org domain:

Let us imagine the following:

You have a domain example.duckdns.org and you have the domain example.com and want to access your home assistant via home.example.com.

Short Guide

1. Set CNAME records for your domain: *.home and home pointing to example.duckdns.org
2. Install or Reinstall the DuckDNS Addon on your home assistant instance.
3. Set your addon config and leave out your alias for this step
4. Start the duckdns addon and watch the log for completion of certificate creation
5. Now add the alias to your config
6. Restart addon and watch the log for completion of certificate creation
7. Add http section to your configurations.yaml and set your alias domain as your base_url
8. Restart your home assistant

Detailled Guide

1. Set CNAME records for your domain

CNAME     *.home      example.duckdns.org
CNAME       home      example.duckdns.org

1. Install or Reinstall the DuckDNS Addon on your home assistant instance.
2. Set the following configuration in your addon configuration:

lets_encrypt:
  accept_terms: true
  certfile: fullchain.pem
  keyfile: privkey.pem
token: take-the-token-from-your-duckdns-account
domains:
  - example.duckdns.org
aliases: []
seconds: 300

1. Start your addon and let your addon create your keypairs (you can follow the process in the Logs tab)

Log output should be:

INFO: Renew certificate for domains: example.duckdns.org and aliases: 
# INFO: Using main config file /data/workdir/config
 + Creating chain cache directory /data/workdir/chains
Processing example.duckdns.org
 + Creating new directory /data/letsencrypt/example.duckdns.org ...
 + Signing domains...
 + Generating private key...
 + Generating signing request...
 + Requesting new certificate order from CA...
 + Received 1 authorizations URLs from the CA
 + Handling authorization for example.duckdns.org
 + 1 pending challenge(s)
 + Deploying challenge tokens...
OK + Responding to challenge for example.duckdns.org authorization...
 + Challenge is valid!
 + Cleaning challenge tokens...
OK + Requesting certificate...
 + Checking certificate...
 + Done!
 + Creating fullchain.pem...
 + Done!

1. Now after certificates has been created change your addon configuration to the following:

lets_encrypt:
  accept_terms: true
  certfile: fullchain.pem
  keyfile: privkey.pem
token: take-the-token-from-your-duckdns-account
domains:
  - example.duckdns.org
aliases:
  - domain: home.example.com
    alias: example.duckdns.org
seconds: 300

1. Restart your addon and follow process in the Log-tab

Log output should be:

INFO: Renew certificate for domains: example.duckdns.org and aliases: 
home.example.com
# INFO: Using main config file /data/workdir/config
Processing home.example.com with alternative names: example.duckdns.org
 + Signing domains...
 + Generating private key...
 + Generating signing request...
 + Requesting new certificate order from CA...
 + Received 2 authorizations URLs from the CA
 + Handling authorization for example.duckdns.org
 + Found valid authorization for example.duckdns.org
 + Handling authorization for home.example.com
 + 1 pending challenge(s)
 + Deploying challenge tokens...
OK + Responding to challenge for home.example.com authorization...
 + Challenge is valid!
 + Cleaning challenge tokens...
OK + Requesting certificate...
 + Checking certificate...
 + Done!
 + Creating fullchain.pem...
 + Done!

1. Add the following to your configurations.yaml file:

http:
  server_port: 8123
  base_url: home.example.com
  ssl_certificate: /ssl/fullchain.pem
  ssl_key: /ssl/privkey.pem

1. Restart your home assistant

These steps will definitely work with everybody!

Have fun 😄

P.S.: Don’t forget forwarding your local port 8123 to 443 in your router 👍

Source: https://gist.github.com/mansouryaacoubi/6774911fe2ffa60fac7738913aae34e2

I found a hacky work-around for this issue:

1. Create your DuckDNS account
2. Create two domains in DuckDNS:

• xxx.duckdns.org: This is the domain that will be used for the dns-01 challenge on your DuckDNS hostname. Its A record will point to your home IP.
• xxx-alias.duckdns.org: This is the domain that will be used for the dns-01 challenge on your custom alias. Its A record does not matter - you can manually set it to something like 127.0.0.1

1. In the DNS provider for your custom domain, create your desired CNAME record for accessing HomeAssistant, e.g.: home.yourdomain.com CNAME xxx.duckdns.org
2. In the DNS provider for your custom domain, create another CNAME record for the ACME challenge TXT record, e.g.: _acme-challenge.home.yourdomain.com CNAME xxx-alias.duckdns.org
3. Install the DuckDNS add-on, and configure it like this:

domains:
  - xxx.duckdns.org
aliases:
  - domain: home.yourdomain.com
    alias: xxx.duckdns.org
  - domain: home.yourdomain.com
    alias: xxx-alias.duckdns.org

1. Start DuckDNS
2. Rejoice. You should now have a certificate that is valid for both home.yourdomain.com and xxx.duckdns.org, and which will successfully auto-renew.

If you’re curious why this works, it’s because we are able to trick the add-on into using two independent TXT records for the two ACME challenges, rather than fighting over a single record: a) This code only processes aliases config that has a matching entry in the domains list. That is why we need the first entry in the aliases list, it serves no other purpose. b) This code is what actually maps your custom alias to a DuckDNS domain name, when updating the TXT record for the ACME challenge. It picks whatever the last matching entry is, so it maps home.yourdomain.com -> xxx-alias.duckdns.org, and updates that TXT record. This matches our earlier DNS configuration for _acme-challenge.home.yourdomain.com CNAME xxx-alias.duckdns.org.

Hopefully this workaround doesn’t get broken until we have another viable solution.

A cleaner solution might be to clear our the TXT records in hook.sh#startup_hook, and then append to them in hook.sh#deploy_challenge rather than overwriting them. If the maintainers are interested, I could have a go at preparing a PR, but there doesn’t seem to be much interest in fixing this…

I was struggling with this for a while on my home assistant instance which has been left offline for months.

mansouryaacoubi’s guide helped me. I already had everything working before, but kept getting the “invalid TXT” error. Replacing aliases with [], restarting, letting it generate the cert, and then adding my aliases back solved it. I think this is still a bug in DuckDNS. It should not have been necessary to remove and re-add aliases

I had the same problem and solved it by creating a CNAME entry not just for the subdomain I want to use ha.mydomain.com but also for *.ha.mydomain.com

I don’t know much about the inner workings of the let’s encrypt authentication but I assume a nameserver needs to be temporarily created that responds with the TXT entry for the challenge at a subdomain to the domain you want to use… Does this make sense?

Maybe the instructions could be updated to reflect that?

I’ve tried both of the solutions above, and the logs showed the Alias is successfully validated, but I had to reboot HA to get it to take (not just the addon for some reason).

See below for the config + DNS records that worked for me:

domains:  
  - myname.duckdns.org 
  - home.mydomain.com 
aliases:  
  - domain: home.mydomain.com
    alias: myname.duckdns.org

Still an issue in Current version: 1.15.0. Any chance this issue ticket can be reopened to bring attention back?

 + Received 2 authorizations URLs from the CA
 + Handling authorization for mydomain.duckdns.org
 + Handling authorization for myalias.domain.com
 + 2 pending challenge(s)
 + Deploying challenge tokens...
OKOK + Responding to challenge for mydomain.duckdns.org authorization...
 + Cleaning challenge tokens...
OKOK + Challenge validation has failed :(
ERROR: Challenge is invalid! (returned: invalid) (result: ["type"]	"dns-01"
["status"]	"invalid"
["error","type"]	"urn:ietf:params:acme:error:unauthorized"
["error","detail"]	"Incorrect TXT record \"ABC123REDACTED321CBA\" found at _acme-challenge.mydomain.duckdns.org"
["error","status"]	403
["error"]	{"type":"urn:ietf:params:acme:error:unauthorized","detail":"Incorrect TXT record \"ABC123REDACTED321CBA\" found at _acme-challenge.mydomain.duckdns.org","status":403}

I had the same problem and solved it by creating a CNAME entry not just for the subdomain I want to use ha.mydomain.com but also for *.ha.mydomain.com

I don’t know much about the inner workings of the let’s encrypt authentication but I assume a nameserver needs to be temporarily created that responds with the TXT entry for the challenge at a subdomain to the domain you want to use… Does this make sense?

Maybe the instructions could be updated to reflect that?

This is exactly what is missing from the documentation. Having two CNAME records is what is required to get the alias DNS challenge to work:

1. something ==> something.duckdns.org
2. *.something ==> something.duckdns.org

Thank you. Great find.

This issue needs to be reopened for a proper fix. By closing it we are accepting this solution which indeed works however is not an acceptable long term solution.

This remains an issue with DuckDNS 1.15.0

It’s to the point now where I’m unable to use my OWN domain and am just using the DuckDNS domain to access my site.

I’m at a loss as to why this issue with the alias domain remains a problem after having been around and so thoroughly documented for SO LONG.

I originally suggested that the additional wildcard DNS entry for my alias domain solved the issue for me. Now after my certificate expired I have to report that it didn’t fix the issue but I have a workaround.

I believe the reason for the failure is that both - the duckdns AND the alias domain - point to the same IP address and there are two challenges to be fulfilled by letsencrypt the txt record of one of the challenges will be incorrect.

My workaround is a two step process which unfortunately won’t allow the automatic renewal when using the alias:

1. Remove the alias domain and just create the certificate for the duckdns domain. After a restart the challenge was successfully validated.
2. Add the alias domain and restart again. This only validated the alias domain and worked without a problem. This just confirmed the SSL certificate but I also needed to restart the server to activate the new certificate as someone previously mentioned.

Not sure who maintains the plugin but a possible software fix could be: If multiple challenges are required setup one TXT record for the first challenge and after successful validation do the same for the second challenge.

I hope this can help someone else in a similar situation.

Just happened here on 2 HA servers running 1.15.0 of the DuckDNS Plugin.

Had to remove my alias, restart the plugin, and then re-add the alias.

Actually, CNAME *.mydomain.com -> mydomain.duckdns.org is enough. No need to create _acme-challenge. In addition to replies above, try to remove mydomain.duckdns.org from domains array:

domains:
  - home.mydomain.com 
aliases:  
  - domain: home.mydomain.com
    alias: myname.duckdns.org

Thanks, but when I try removing mydomain.duckdns.org it no longer works over SSL. I can’t find any way to have both domains supported.

I do have a workaround for this issue:

1. Remove all alias configs
2. Restart the addon
3. Add the alias config back
4. Restart the addon again

I tried that many times, but the issue remains.

@sigo 's configuration worked after I changed it to this:

CNAME _acme-challenge.<own-domain>    _acme-challenge.<domain>.duckdns.org
CNAME                 <own-domain>                    <domain>.duckdns.org

At least the challenge part that is.

Edit: now I can’t update duckdns anymore. Whenever I add my own domain to the domains section, it fails to update. My guess is that it tries to update the IP for my own domain as well, while it isn’t a known one for duckdns. Also, on my own domain I still get certificate errors.

I’ve experimented for few hours and I can confirm few things.

1. You shouldn’t remove <name>.duckdns.org entry from domains. It cause not updating IP address. So duckdns functionality changes from DynamicDNS (DDNS) to standard DNS.
2. Creating any TXT entry in your own domain DNS doesn’t help. You do not have token for Lets Encrypt ACME DNS-01 challange. This token is keept in duckdns DNS.
3. Domains order matter in config file. The first one will be main, second one will be additional (alternative main). You can check this details in generated certificate or in duckdns addon log:

Processing <first-domain> with alternative names: <second-domain>

Back to the issue: you need redirect Lets Encrypt to duckdns when challenging your domain.

You can read on https://letsencrypt.org/docs/challenge-types/#dns-01-challenge:

Since Let’s Encrypt follows the DNS standards when looking up TXT records for DNS-01 validation, you can use CNAME records or NS records to delegate answering the challenge to other DNS zones. This can be used to delegate the _acme-challenge subdomain to a validation-specific server or zone. It can also be used if your DNS provider is slow to update, and you want to delegate to a quicker-updating server.

So you can create CNAME wildcard or just simply create CNAME for _acme-challenge subdomain. So finally, addon config can looks this:

lets_encrypt:
  accept_terms: true
  certfile: fullchain.pem
  keyfile: privkey.pem
token: <duck-dns-token>
domains:
  - <own-domain>
  - <domain>.duckdns.org
aliases:
  - domain: <own-domain>
    alias: <domain>.duckdns.org
seconds: 300

And your DNS:

CNAME    _acme-challenge.<own-domain>    <domain>.duckdns.org
CNAME    <own-domain>    <domain>.duckdns.org

And this is sufficient.

Keep in mind: if your DNS provider support any proxying (like cloudflare) you must keep it disabled for _acme-challenge subdomain. It can be enabled only for domain.

Hope this helps and saves you some time.

@thomashogema

As I mentioned above, if you leave the duckdns domain out of the “domains:” part of the config, the renewal will be successful.

So if you want to use your own domain and dont really care about accessing the duckdns domain itself, this is a good workaround.

While I find this workaround works initially, it has the unintended effect of the addon no longer updating the IP address of the duckdns subdomain. So there is no fully working workaround purely within home assistant. To fully get around this you will need some other device to update your IP address in duckdns like your router (I use pfsense). What I really wish is that the let’s encrypt addon sans duckdns was more robust (I.E. included other services, Godaddy please) and then I wouldn’t need to use duckdns at all.

@thomashogema

As I mentioned above, if you leave the duckdns domain out of the “domains:” part of the config, the renewal will be successful.

So if you want to use your own domain and dont really care about accessing the duckdns domain itself, this is a good workaround.

Actually, CNAME *.mydomain.com -> mydomain.duckdns.org is enough. No need to create _acme-challenge. In addition to replies above, try to remove mydomain.duckdns.org from domains array:

domains:
  - home.mydomain.com 
aliases:  
  - domain: home.mydomain.com
    alias: myname.duckdns.org

Thanks, but when I try removing mydomain.duckdns.org it no longer works over SSL. I can’t find any way to have both domains supported.

It did work once for me, but afterwards I also got the Incorrect TXT record error So I had to switch back to the he lestencrypt addon 😦

@houbie & @mfncl99 The issue is the second duckdns domain. Simply leaving it out will result in a successful challenge. I agree that the duckdns addon seemingly sets the wrong txt record for the domain it is currently trying to validate. (i.e. for domain A while trying to validate domain B)

This worked for me:

domains:
  - ha.<REDACTED>.com
aliases:
  - domain: ha.<REDACTED>.com
    alias: <REDACTED>.duckdns.org

After removing ‘duckdns’ from domains it worked for me too! Thanks 👍

It did work once for me, but afterwards I also got the Incorrect TXT record error So I had to switch back to the he lestencrypt addon 😦

@houbie & @mfncl99 The issue is the second duckdns domain. Simply leaving it out will result in a successful challenge. I agree that the duckdns addon seemingly sets the wrong txt record for the domain it is currently trying to validate. (i.e. for domain A while trying to validate domain B)

This worked for me:

domains:
  - ha.<REDACTED>.com
aliases:
  - domain: ha.<REDACTED>.com
    alias: <REDACTED>.duckdns.org