Bug report + Extra variable request about getssl

[agusdomin]

Hi, same problem here

[tlhackque]

Using the IP address to select views for updates is inadvisable due to forgery issues. Using TSIG is strongly preferred. See the bind documentation.

It appears that you are using dns_scripts/dns_{add,del}_nsupdate. It supports DNS_NSUPDATE_KEYFILE and DNS_NSUPDATE_GETKEY for the TSIG use case.

However, for those who "can't" use TSIG, here's a patch that adds DNS_NSUPDATE_LOCALIP. It takes an IP adddress or IP address & port (space separated). I'll add this to my current PR. You can apply the patch, or use https://github.com/tlhackque/getssl

Note that these variables must be declared with export - e.g. export DNS_NSUPDATE_LOCALIP="192.168.254.123".

nsupdate_localip.patch

With respect to left-over challenge tokens: There are many error exit paths that can cause this.

https://github.com/tlhackque/certtools contains acme_challenge_check, which handles cleanup of a zone. I have a cron job that runs it periodically. You want to schedule it at a time that getssl isn't running. You need to permit acme_challenge_check to do zone transfers (by TSIG or IP address).