I’m trying to setup a wildcard certificate with the ACME plugin on my pfSense machine. However, I get the following error when trying to issue the certificate.
MyCert
Renewing certificate
account: Cert
server: letsencrypt-staging-2
/usr/local/pkg/acme/acme.sh --issue -d '*.mydomain.com' --dns 'dns_cf' --home '/tmp/acme/MyCert/' --accountconf '/tmp/acme/MyCert/accountconf.conf' --force --reloadCmd '/tmp/acme/MyCert/reloadcmd.sh' --log-level 3 --log '/tmp/acme/MyCert/acme_issuecert.log'
Array
(
[path] => /etc:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin/
[PATH] => /etc:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin/
[CF_Key] => my_global_API_key
[CF_Email] => my_cloudflare_email
[CF_Token] => my_token
[CF_Account_ID] => my_account_id_key
[CF_Zone_ID] => my_zone_id_key
)
[Tue Apr 28 19:20:10 CEST 2020] Single domain='*.mydomain.com'
[Tue Apr 28 19:20:10 CEST 2020] Getting domain auth token for each domain
[Tue Apr 28 19:20:13 CEST 2020] Getting webroot for domain='*.mydomain.com'
[Tue Apr 28 19:20:13 CEST 2020] Adding txt value: nHGgDV4uI6z3e7iI7pIP9_Kedo78EXM82LaWFJn6u9A for domain: _acme-challenge.mydomain.com
[Tue Apr 28 19:20:14 CEST 2020] Error
[Tue Apr 28 19:20:14 CEST 2020] Error add txt for domain:_acme-challenge.mydomain.com
[Tue Apr 28 19:20:14 CEST 2020] Please check log file for more details: /tmp/acme/MyCert/acme_issuecert.log
In the acme_issuecert.log I get the following lines:
[Tue Apr 28 18:18:56 CEST 2020] Single domain=’*.mydomain.com’
[Tue Apr 28 18:18:56 CEST 2020] Getting domain auth token for each domain
[Tue Apr 28 18:19:12 CEST 2020] Please refer to https://curl.haxx.se/libcurl/c/libcurl-errors.html for error code: 35
[Tue Apr 28 18:19:12 CEST 2020] Create new order error. Le_OrderFinalize not found.
[Tue Apr 28 18:19:12 CEST 2020] Please check log file for more details: /tmp/acme/MyCert/acme_issuecert.log
I don’t know if it is relevant but I have two domains on my CF account but I’m only using the DNS service.
The settings of the token is:
Permissions
Zone:Zone:Read
Zone:DNS:Edit
Zone Ressources
Include:Specific Zone:mydomain.com
IP Address filering:
This is not set
TTL:
This is not set
I have successfully validated the token from my terminal.
In pfSense I have filled out all the credentials for CF (Global API key, Email, token key, Zone Id, Zccount Id). When I click save the certificate is marked as last renewed at 01 Jan 1970 (see screen dump)
.
When I click the renew button I get the error above.
ACME don’t create/modify any DNS records and there are no activity in the Auditlog except for me creating the token.
I’m running the lastest version of pfSense (2.4.5) and the most recent acme plugin (0.6.7).
Please let me know if you need additional information. Any help is highly appreciated.