Enormous copies of TXT _acme-challenge records

[ceremeo]

Hi,

I was trying to issue a wildcard LetsEncrypt certificate for my domain parked on Cloudflare DNS servers (evangeline, hayes). I had some problems with timeouts and had to repeat the process few times - with new values _acme-challenge TXT records, so I was editing those that I have entered.

At some point Letsencrypt said “No TXT record found at _acme-challenge.ceremeo.com”. That was odd, so I checked the record and… there are tens of those! I checked DNS panel at Cloudflare, but there were only two entries. Even when I removed them - it didn’t change a thing. No matter what I do, I have 85 TXT entries for _acme-challenge.ceremeo.com

One day has passed and still nothing changes. When I add an entry, I have 86. After I delete it - I have 85…

Any ideas what to do?

Greetings,

Jacek

[ceremeo]

Hi,

there is no script that could add these records - I didn’t get to this point (and didn’t even want to

As you can see, now there are completely no TXT entries for _acme-challenge.ceremeo.com

Greetings,

Jacek

[wouter]

Having looked at your zone, it does seem there are more _acme-challenge records configured than I’d expect.

I’ve brought this to the attention of the SSL team. I’ll keep you informed.

[wouter]

Yes. And in this case also hidden from the user (which is expected for this type of records)

[kovspace]

I have the same issue at kovspace.ru

[nader.eloshaiker]

I have the similar issue but in my case I have a incorrect hidden _acme-challenge TXT record

[ziggy471]

Same problem as well, however I’m showing 174 _acme-challenge records all hidden and can’t remove using the API either.

[ziggy471]

Figured it out, I moved one of my domains to Cloudflare about the same time I setup certbot to generate certificates for it. The way I found to work around it was to Disable Universal SSL under Edge Certificates. This removed the 174 _acme-challenge records that I was unable to see in the console or api. This also allowed me to renew using certbot locally.

[restle]

@ziggy471

Disable Universal SSL under Edge Certificates

It works!

[restle]

Lookup (host -t txt, dig txt) shows multiple TXT records for _acme-challenge and let’s encrypt can not issue certificate for domain. In the dashboard interface there are no such records.