acmesh-official / acmesh-official/acme.sh
[Bug Report] Aliyun signature is not matched with calculation with IDN domain
- Langage dominant
- Shell
- Étoiles
- 47.6k
- Forks
- 5.7k
- Merge moyen
- 7 j 1 h
- PR mergées (30 j)
- 16
Description
Steps to reproduce
------------------
I am using a Chinese IDN domain name for my website, and using acme.sh build-in dns_ali to verify my domain for issuing certificate. Of course, I am using the latest version of acme.sh docker.
I got "Specified signature is not matched with our calculation." error in my Aliyun console all the time, thus, nothing changes in my IDN domain. Domain Verifying failed. But I tried my another total ascii domain name, it worked fine.
I noticed acme.sh had already supported readable domain name input for IDN domain, and also, I knew IDN domain name could be transformed to punycode. I am not so good at encryption technology. I reviewed Aliyun's documentation and I found its dns api using punycode to generate signature, using original encoding as one of its field instead. So, I think that this is why it doesn't work.
[Aliyun Document](https://help.aliyun.com/zh/dws/developer-reference/domain-name-validity)
And, forgive my poor English. This is my first issue.
Debug log
-----------------
```
/ # acme.sh --issue -d '[MY_CHINESE_DOMAIN]' --dns dns_ali --server https://acme-staging-v02.api.letsencrypt.org/directory
[Sat Aug 12 14:29:34 UTC 2023] Using CA: https://acme-staging-v02.api.letsencrypt.org/directory
[Sat Aug 12 14:29:34 UTC 2023] Single domain='[MY_CHINESE_DOMAIN]'
[Sat Aug 12 14:29:34 UTC 2023] Getting domain auth token for each domain
[Sat Aug 12 14:29:37 UTC 2023] Getting webroot for domain='[MY_CHINESE_DOMAIN]'
[Sat Aug 12 14:29:38 UTC 2023] Adding txt value: DbixukzZAJZY1snz9OQwsdFjlm4uSH_vEBARyWxxsbk for domain: _acme-challenge.[MY_CHINESE_DOMAIN]
[Sat Aug 12 14:29:39 UTC 2023] Error add txt for domain:_acme-challenge.[MY_CHINESE_DOMAIN]
[Sat Aug 12 14:29:39 UTC 2023] Please add '--debug' or '--log' to check more details.
[Sat Aug 12 14:29:39 UTC 2023] See: https://github.com/acmesh-official/acme.sh/wiki/How-to-debug-acme.sh
/ # acme.sh --issue -d '[MY_ASCII_DOMAIN]' --dns dns_ali --server https://acme-staging-v02.api.letsencrypt.org/directory
[Sat Aug 12 14:29:56 UTC 2023] Using CA: https://acme-staging-v02.api.letsencrypt.org/directory
[Sat Aug 12 14:29:56 UTC 2023] Single domain='[MY_ASCII_DOMAIN]'
[Sat Aug 12 14:29:56 UTC 2023] Getting domain auth token for each domain
[Sat Aug 12 14:30:00 UTC 2023] Getting webroot for domain='[MY_ASCII_DOMAIN]'
[Sat Aug 12 14:30:00 UTC 2023] Adding txt value: kGlW6CVFYmRE9gSM2DteiD0e1iyZWZeRSeCFR6cLwqw for domain: _acme-challenge.[MY_ASCII_DOMAIN]
[Sat Aug 12 14:30:01 UTC 2023] The txt record is added: Success.
[Sat Aug 12 14:30:01 UTC 2023] Let's check each DNS record now. Sleep 20 seconds first.
[Sat Aug 12 14:30:23 UTC 2023] You can use '--dnssleep' to disable public dns checks.
[Sat Aug 12 14:30:23 UTC 2023] See: https://github.com/acmesh-official/acme.sh/wiki/dnscheck
[Sat Aug 12 14:30:23 UTC 2023] Checking [MY_ASCII_DOMAIN] for _acme-challenge.[MY_ASCII_DOMAIN]
[Sat Aug 12 14:30:23 UTC 2023] Please refer to https://curl.haxx.se/libcurl/c/libcurl-errors.html for error code: 35
[Sat Aug 12 14:30:33 UTC 2023] Please refer to https://curl.haxx.se/libcurl/c/libcurl-errors.html for error code: 28
[Sat Aug 12 14:30:33 UTC 2023] Domain [MY_ASCII_DOMAIN] '_acme-challenge.[MY_ASCII_DOMAIN]' success.
[Sat Aug 12 14:30:33 UTC 2023] All success, let's return
```
Guide de contribution
Ouvrir le guide de contribution
Évaluation
Cette issue n'a pas encore été évaluée.