Using ALL DNS client during `get_auth_dns()` function (may be other locations too) about getssl

[timkimber]

Hi @loganmzz

get_auth_dns() tries each of the DNS clients that are installed until it finds the authoritative DNS server for the domain.

It tries in this order:

• dig/drill
• host
• nslookup

This check is one of the most complicated parts of the code, but it's useful as it ensures that everything is working before we ask LetsEncrypt to do a similar check and produce the certificate.

If you attach the debug output here I can help, or if you can point out which log statements are confusing I can re-write them to be better.

[loganmzz]

Ok, I haven't seen return statements.

Not sure, it's the best place to debug my case.

Still, here the relevant debug output (sorry for anonymized data :( ):

getssl version: 2.48

Using dig +noedns  CNAME _acme-challenge.app.company.com

Checking if CNAME result contains NS records

Domain is a CNAME, actual domain is xxxxx.acme.company.com

Using dig +noedns  NS xxxxx.acme.company.com to find primary nameserver

Using host -t NS to find primary name server for _acme-challenge.app.company.com
host: couldn't get address for '-t': not found

Using nslookup +noedns -debug -type=soa -type=ns _acme-challenge.app.company.com  to find primary name server
nslookup: couldn't get address for '_acme-challenge.app.company.com': not found
nslookup: couldn't get address for '_acme-challenge.app.company.com': not found
Warning: Couldn't find primary DNS server - please set PUBLIC_DNS_SERVER or AUTH_DNS_SERVER in config
This means getssl cannot check the DNS entry has been updated

Using dig +noedns  CNAME *.app.company.com

Checking if CNAME result contains NS records

Using dig +noedns  NS *.app.company.com to find primary nameserver

Using host -t NS to find primary name server for *.app.company.com
host: couldn't get address for '-t': not found

Using nslookup +noedns -debug -type=soa -type=ns *.app.company.com  to find primary name server
nslookup: couldn't get address for '*.app.company.com': not found
nslookup: couldn't get address for '*.app.company.com': not found
Warning: Couldn't find primary DNS server - please set PUBLIC_DNS_SERVER or AUTH_DNS_SERVER in config
This means getssl cannot check the DNS entry has been updated

I'm little bit surprise to not see: Using "$HAS_DIG_OR_DRILL $DNS_CHECK_OPTIONS ${gad_s} SOA +trace +nocomments ${gad_d}" to find primary nameserver
(EDIT: Just check my config and it was disabled with _TEST_SKIP_SOA_CALL="1")

[github-actions]

This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 30 days.