lego bin as external dns provider

[hrolofs]

Can lego call as external dns provider a lego binary directly with all the needed parameter or it needs wrapper scripts?

The background of my question is, i use traefik for my containers and it works well. But at the moment there is a problem with one dns provider (ionos) that are fixed in the actual lego version. But it needs time till traefik update the lego version.

My idea is now to use the actual lego binary as external dns provider inside traefik till traefik are updated to the new lego version.

If there are a simple way to do this?

Regards

[ldez]

Can lego call as external dns provider a lego binary directly with all the needed parameter or it needs wrapper scripts?

My idea is now to use the actual lego binary as external dns provider inside traefik till traefik are updated to the new lego version.

Traefik and lego are written in Go, it's a compiled language, so dependencies are not executable (it's not Python).
Lego cannot be used as proxy, because lego is not an ACME server, it's just an ACME client.

The only way to update lego inside Traefik is to update the dependencies inside Traefik and compile Traefik.

But it needs time till traefik update the lego version.

When I will release the next version of lego, I will update Traefik too.
I hope to be able to do it at the beginning of February (maybe before).

For now, you "just" have to clean the extra TXT records manually.

[hrolofs]

For now, you "just" have to clean the extra TXT records manually.

I have already done this. But it looks like Traefik will not renew the certificates, so they will expire. There was already a corresponding email from letsencrypt.

Hence my idea to use internally "External program" (exec) as DNS provider in Traefik and use a current "standalone" lego binary that worked with ionos.

When I will release the next version of lego, I will update Traefik too.
I hope to be able to do it at the beginning of February (maybe before).

Thanks :-)

[ldez]

I have already done this. But it looks like Traefik will not renew the certificates, so they will expire. There was already a corresponding email from letsencrypt.

Traefik uses lego: there is no relation between old TXT records and the renewal.
The email has no impact on the renewal.
You don't need the lego fix to renew your certificates, it will work without any problems.

Hence my idea to use internally "External program" (exec) as DNS provider in Traefik and use a current "standalone" lego binary that worked with ionos.

You cannot "send" to lego the information about a challenge, this is not the way that lego and Traefik work.

[hrolofs]

I have this in traefik debug log.
"Traefik version 2.10.7 built on 2023-12-06T15:54:59Z"

The wildcard certificate will expire in a few days and the renewal process does not seem to be working.
(domain name changed)

time="2024-01-24T15:40:20Z" level=info msg="Renewing certificate from LE : {Main:*.example.com SANs:[]}" ACME CA="https://acme-v02.api.letsencrypt.org/directory" providerName=letsencrypt.acme
time="2024-01-24T15:40:20Z" level=debug msg="legolog: [INFO] [*.example.com] acme: Trying renewal with 161 hours remaining"
time="2024-01-24T15:40:20Z" level=debug msg="legolog: [INFO] [*.example.com] acme: Obtaining bundled SAN certificate"
time="2024-01-24T15:40:21Z" level=debug msg="legolog: [INFO] [*.example.com] AuthURL: https://acme-v02.api.letsencrypt.org/acme/authz-v3/307669878536"
time="2024-01-24T15:40:21Z" level=debug msg="legolog: [INFO] [*.example.com] acme: use dns-01 solver"
time="2024-01-24T15:40:21Z" level=debug msg="legolog: [INFO] [*.example.com] acme: Preparing to solve DNS-01"
time="2024-01-24T15:40:22Z" level=debug msg="legolog: [INFO] [*.example.com] acme: Cleaning DNS-01 challenge"
time="2024-01-24T15:40:23Z" level=debug msg="legolog: [WARN] [*.example.com] acme: cleaning up failed: ionos: failed to get records (zone=d941c9db-cdee-11eb-934a-0a5864443f8d): failed to call API: 400: INVALID_REQUEST: Invalid 'suffix' request parameter. "
time="2024-01-24T15:40:24Z" level=error msg="Error renewing certificate from LE: {*.example.com []}" providerName=letsencrypt.acme ACME CA="https://acme-v02.api.letsencrypt.org/directory" error="error: one or more domains had a problem:\n[*.example.com] [*.example.com] acme: error presenting token: ionos: failed to get records (zone=d941c9db-cdee-11eb-934a-0a5864443f8d): failed to call API: 400: INVALID_REQUEST: Invalid 'suffix' request parameter.\n"
time="2024-01-25T15:40:24Z" level=info msg="Renewing certificate from LE : {Main:*.example.com SANs:[]}" ACME CA="https://acme-v02.api.letsencrypt.org/directory" providerName=letsencrypt.acme
time="2024-01-25T15:40:24Z" level=debug msg="legolog: [INFO] [*.example.com] acme: Trying renewal with 137 hours remaining"
time="2024-01-25T15:40:24Z" level=debug msg="legolog: [INFO] [*.example.com] acme: Obtaining bundled SAN certificate"
time="2024-01-25T15:40:24Z" level=error msg="Error renewing certificate from LE: {*.example.com []}" ACME CA="https://acme-v02.api.letsencrypt.org/directory" providerName=letsencrypt.acme error="failed to post JWS message: failed to sign content: failed to sign content: go-jose/go-jose: Error generating nonce: failed to get nonce from HTTP HEAD: Head \"https://acme-v02.api.letsencrypt.org/acme/new-nonce\": dial tcp: lookup acme-v02.api.letsencrypt.org on 127.0.0.11:53: server misbehaving"

[ldez]

It's not related to the current fix, as you can see in your logs you have 2 problems, and those problems seem related to your environment.

cleaning up failed: ionos: failed to get records (zone=d941c9db-cdee-11eb-934a-0a5864443f8d): failed to call API: 400: INVALID_REQUEST: Invalid 'suffix' request parameter. "

I think it's related to a CNAME record.

dial tcp: lookup acme-v02.api.letsencrypt.org on 127.0.0.11:53: server misbehaving

This is related to your local DNS resolver or a firewall.

[hrolofs]

I found all the acme records on the ionos DNS server that were not deleted and thought that might be the problem with the certificate not being renewed.

Thank you for your suggestions. I will check the points you mentioned.