addons: duckdns can't obtain cert after upgrade to 1.12.5

I changed the hook.sh to print some debug information, so I’m 100% sure.

1. Deploy TXT for ALIAS .dev
2. Deploy TXT for DOMAIN a.duckdns.org
3. Checking TXT for DOMAIN a.duckdns.org, failed becase is ALIAS .dev TXT on that system.

It’s easy to change to acme.sh or getssl (removing dehydrated) and complete fix this issue.

Nope, still broken.

Same as before, removing the aliases and then adding them back temporarily resolves the issue (until the next renewal)

I am also hitting this issue. What is happening is that the addon is requesting challenges for both the alias(es) as well as the domain(s). The second challenge is overwriting the first challenge before the challenge validation is taking place, thus resulting in a failed validation.

As a temporary workaround

1. Remove all the aliases from the config and let it just validate the Duckdns domains. This completes successfully.
2. Put back the aliases into the config and let it re-validate all the domains. As the Duckdns domains are already validated, it will only deploy challenges to the Alias domains. This time it will complete successfully (if your alias domains point to different duckdns domains! In case more than one Alias point to the same Duckdns domain, you need to split step 2 into multiple steps and let it only validate one of the duplicate aliases at a time).

Edit: One downside of the current configuration design is that all the duckdns domains will be part of the certificate where previously I only had the domains in the Domain section as well as the Aliases on the certificate.

i can confirm the issue is still present as of today: dns-01 challenge fails if you have aliases configured right from the first start of the extension.

The issue still persists with DuckDNS 1.14.0

I found the root cause: The upgrade of the dependency dehydrated.

Since dehydrated 0.6.0, dehydrated change the domain validation strategy. Until that version, they was validation in sequential, and change to validate in parallel.

Now they, deploy all TXT for all the domains, and validate all the domains. This fails because when dehydrated starts to validate we only have the last TXT record in duckdns.org

dehydrated doesn’t allow to change to the old strategy: https://github.com/dehydrated-io/dehydrated/blob/master/docs/troubleshooting.md#dns-invalid-challenge-since-dehydrated-060--why-are-dns-challenges-deployed-first-and-verified-later

Still an issue.

Still an issue

Still not solved

@rruizGit sure, but the configs isn’t rocket science. I’ll provide quick guide. Config details depends on DNS provider (Supported DNS providers).

Let’s Encrypt documentation. It is a bit lengthy due to many supported DNS providers. Worth reading.

1. Have Duck DNS and Let's Encrypt plugin installed.
2. Have only one DNS rule - CNAME <your-domain> -> <domain>.duckdns.org. Can be proxied on Cloudflare. You can safely delete any other created for DuckDNS.
3. DuckDNS config

lets_encrypt:
  accept_terms: false
  certfile: fullchain.pem
  keyfile: privkey.pem
token: <SECRET>
domains:
  - <SECRET>.duckdns.org
aliases: []
seconds: 300

1. Let's Encrypt config mostly depends on DNS provider. I use Cloudflare with DNS challange (it doesn’t require any open ports, but require Cloudflare API token with Zone.DNS permission).

email: <SECRET>
domains:
  - <SECRET>
certfile: fullchain.pem
keyfile: privkey.pem
challenge: dns
dns:
  provider: dns-cloudflare
  cloudflare_api_token: <SECRET>

Let's Encrypt will create temporary DNS entry for challenging while recreating certificate in this configuration.

As a bonus point, you should create some scheduled job for recreating certificate. Renew process is run only on Let's Encrypt plugin start. Example solution.

3 years issue 😄

Still an issue

Any other ideas?

Is it not also possible to install DuckDNS with:

lets encrypt: accept_terms: false

AND install the let’s encrypt add-in to handle the cert? I read somewhere that let’s encrypt add-in doesn’t have this same problem.

Now my certs expired and DuckDNS 1.14.0 didn’t renew because of the alias, once again… It has not worked a single time. Fix from @Veldkornet doesn’t work on 1.14.0. It fetches the cert after removing aliases but after adding the alias back and restarting the addon it doesn’t fetch due to “Skipping renew!”.

Update: Restarting home assistant resolved the issue. Even though /ssl/fullchain.pem and /ssl/privkey.pem was updated they were not applied until after restart. Old cert cached somewhere?