acmesh-official / acmesh-official/acme.sh

[Bug Report] Aliyun signature is not matched with calculation with IDN domain

Offen Anfängerfreundlich
#4,733 6 Kommentare 3 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen
Vorherrschende Sprache
Shell
Sterne
47.6k
Forks
5.7k
Ø Merge
6 T. 5 Std.
Gemergte PRs (30 T.)
15

Beschreibung

Steps to reproduce
------------------
I am using a Chinese IDN domain name for my website, and using acme.sh build-in dns_ali to verify my domain for issuing certificate. Of course, I am using the latest version of acme.sh docker.
I got "Specified signature is not matched with our calculation." error in my Aliyun console all the time, thus, nothing changes in my IDN domain. Domain Verifying failed. But I tried my another total ascii domain name, it worked fine.

I noticed acme.sh had already supported readable domain name input for IDN domain, and also, I knew IDN domain name could be transformed to punycode. I am not so good at encryption technology. I reviewed Aliyun's documentation and I found its dns api using punycode to generate signature, using original encoding as one of its field instead. So, I think that this is why it doesn't work.
[Aliyun Document](https://help.aliyun.com/zh/dws/developer-reference/domain-name-validity)

And, forgive my poor English. This is my first issue.

Debug log
-----------------

```
/ # acme.sh --issue -d '[MY_CHINESE_DOMAIN]' --dns dns_ali --server https://acme-staging-v02.api.letsencrypt.org/directory
[Sat Aug 12 14:29:34 UTC 2023] Using CA: https://acme-staging-v02.api.letsencrypt.org/directory
[Sat Aug 12 14:29:34 UTC 2023] Single domain='[MY_CHINESE_DOMAIN]'
[Sat Aug 12 14:29:34 UTC 2023] Getting domain auth token for each domain
[Sat Aug 12 14:29:37 UTC 2023] Getting webroot for domain='[MY_CHINESE_DOMAIN]'
[Sat Aug 12 14:29:38 UTC 2023] Adding txt value: DbixukzZAJZY1snz9OQwsdFjlm4uSH_vEBARyWxxsbk for domain: _acme-challenge.[MY_CHINESE_DOMAIN]
[Sat Aug 12 14:29:39 UTC 2023] Error add txt for domain:_acme-challenge.[MY_CHINESE_DOMAIN]
[Sat Aug 12 14:29:39 UTC 2023] Please add '--debug' or '--log' to check more details.
[Sat Aug 12 14:29:39 UTC 2023] See: https://github.com/acmesh-official/acme.sh/wiki/How-to-debug-acme.sh
/ # acme.sh --issue -d '[MY_ASCII_DOMAIN]' --dns dns_ali --server https://acme-staging-v02.api.letsencrypt.org/directory
[Sat Aug 12 14:29:56 UTC 2023] Using CA: https://acme-staging-v02.api.letsencrypt.org/directory
[Sat Aug 12 14:29:56 UTC 2023] Single domain='[MY_ASCII_DOMAIN]'
[Sat Aug 12 14:29:56 UTC 2023] Getting domain auth token for each domain
[Sat Aug 12 14:30:00 UTC 2023] Getting webroot for domain='[MY_ASCII_DOMAIN]'
[Sat Aug 12 14:30:00 UTC 2023] Adding txt value: kGlW6CVFYmRE9gSM2DteiD0e1iyZWZeRSeCFR6cLwqw for domain: _acme-challenge.[MY_ASCII_DOMAIN]
[Sat Aug 12 14:30:01 UTC 2023] The txt record is added: Success.
[Sat Aug 12 14:30:01 UTC 2023] Let's check each DNS record now. Sleep 20 seconds first.
[Sat Aug 12 14:30:23 UTC 2023] You can use '--dnssleep' to disable public dns checks.
[Sat Aug 12 14:30:23 UTC 2023] See: https://github.com/acmesh-official/acme.sh/wiki/dnscheck
[Sat Aug 12 14:30:23 UTC 2023] Checking [MY_ASCII_DOMAIN] for _acme-challenge.[MY_ASCII_DOMAIN]
[Sat Aug 12 14:30:23 UTC 2023] Please refer to https://curl.haxx.se/libcurl/c/libcurl-errors.html for error code: 35
[Sat Aug 12 14:30:33 UTC 2023] Please refer to https://curl.haxx.se/libcurl/c/libcurl-errors.html for error code: 28
[Sat Aug 12 14:30:33 UTC 2023] Domain [MY_ASCII_DOMAIN] '_acme-challenge.[MY_ASCII_DOMAIN]' success.
[Sat Aug 12 14:30:33 UTC 2023] All success, let's return
```

Beitragsleitfaden

Beitragsleitfaden öffnen

Rechercherichtung

Reproduce with the provided command `acme.sh --issue ... --dns dns_ali ...` using both an IDN domain and an ASCII domain. Start by locating the dns_ali provider script used by that option (typically under `dnsapi/`, e.g., `dnsapi/dns_ali.sh`) and inspect request signing/parameter construction. Check whether domain encoding is converted to punycode at the point the signature is generated. Done when an IDN domain reaches the same successful TXT add/validation flow as the ASCII domain without Aliyun signature mismatch.

Vom Indexierungsmodell aus dem Issue-Text verfasst.

Bewertung

Tech-Stack
bash, shell
Bereich
cli, tooling
Issue-Typ
Bug
Schwierigkeit
2/5
Geschätzter Aufwand
1-3 Stunden
Aktivitätsstatus
Ruhig
Klarheit
Klar beschrieben
Anfängerfreundlichkeit
72/100

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.