acmesh-official / acmesh-official/acme.sh

[Bug Report] Aliyun signature is not matched with calculation with IDN domain

Open Beginner friendly
#4,733 6 comments 3 reactions 0 assignees View on GitHub
Dominant language
Shell
Stars
47.6k
Forks
5.7k
Avg merge
6d 5h
Merged PRs (30d)
15

Description

Steps to reproduce
------------------
I am using a Chinese IDN domain name for my website, and using acme.sh build-in dns_ali to verify my domain for issuing certificate. Of course, I am using the latest version of acme.sh docker.
I got "Specified signature is not matched with our calculation." error in my Aliyun console all the time, thus, nothing changes in my IDN domain. Domain Verifying failed. But I tried my another total ascii domain name, it worked fine.

I noticed acme.sh had already supported readable domain name input for IDN domain, and also, I knew IDN domain name could be transformed to punycode. I am not so good at encryption technology. I reviewed Aliyun's documentation and I found its dns api using punycode to generate signature, using original encoding as one of its field instead. So, I think that this is why it doesn't work.
[Aliyun Document](https://help.aliyun.com/zh/dws/developer-reference/domain-name-validity)

And, forgive my poor English. This is my first issue.

Debug log
-----------------

```
/ # acme.sh --issue -d '[MY_CHINESE_DOMAIN]' --dns dns_ali --server https://acme-staging-v02.api.letsencrypt.org/directory
[Sat Aug 12 14:29:34 UTC 2023] Using CA: https://acme-staging-v02.api.letsencrypt.org/directory
[Sat Aug 12 14:29:34 UTC 2023] Single domain='[MY_CHINESE_DOMAIN]'
[Sat Aug 12 14:29:34 UTC 2023] Getting domain auth token for each domain
[Sat Aug 12 14:29:37 UTC 2023] Getting webroot for domain='[MY_CHINESE_DOMAIN]'
[Sat Aug 12 14:29:38 UTC 2023] Adding txt value: DbixukzZAJZY1snz9OQwsdFjlm4uSH_vEBARyWxxsbk for domain: _acme-challenge.[MY_CHINESE_DOMAIN]
[Sat Aug 12 14:29:39 UTC 2023] Error add txt for domain:_acme-challenge.[MY_CHINESE_DOMAIN]
[Sat Aug 12 14:29:39 UTC 2023] Please add '--debug' or '--log' to check more details.
[Sat Aug 12 14:29:39 UTC 2023] See: https://github.com/acmesh-official/acme.sh/wiki/How-to-debug-acme.sh
/ # acme.sh --issue -d '[MY_ASCII_DOMAIN]' --dns dns_ali --server https://acme-staging-v02.api.letsencrypt.org/directory
[Sat Aug 12 14:29:56 UTC 2023] Using CA: https://acme-staging-v02.api.letsencrypt.org/directory
[Sat Aug 12 14:29:56 UTC 2023] Single domain='[MY_ASCII_DOMAIN]'
[Sat Aug 12 14:29:56 UTC 2023] Getting domain auth token for each domain
[Sat Aug 12 14:30:00 UTC 2023] Getting webroot for domain='[MY_ASCII_DOMAIN]'
[Sat Aug 12 14:30:00 UTC 2023] Adding txt value: kGlW6CVFYmRE9gSM2DteiD0e1iyZWZeRSeCFR6cLwqw for domain: _acme-challenge.[MY_ASCII_DOMAIN]
[Sat Aug 12 14:30:01 UTC 2023] The txt record is added: Success.
[Sat Aug 12 14:30:01 UTC 2023] Let's check each DNS record now. Sleep 20 seconds first.
[Sat Aug 12 14:30:23 UTC 2023] You can use '--dnssleep' to disable public dns checks.
[Sat Aug 12 14:30:23 UTC 2023] See: https://github.com/acmesh-official/acme.sh/wiki/dnscheck
[Sat Aug 12 14:30:23 UTC 2023] Checking [MY_ASCII_DOMAIN] for _acme-challenge.[MY_ASCII_DOMAIN]
[Sat Aug 12 14:30:23 UTC 2023] Please refer to https://curl.haxx.se/libcurl/c/libcurl-errors.html for error code: 35
[Sat Aug 12 14:30:33 UTC 2023] Please refer to https://curl.haxx.se/libcurl/c/libcurl-errors.html for error code: 28
[Sat Aug 12 14:30:33 UTC 2023] Domain [MY_ASCII_DOMAIN] '_acme-challenge.[MY_ASCII_DOMAIN]' success.
[Sat Aug 12 14:30:33 UTC 2023] All success, let's return
```

Contributor guide

Open the contributing guide

Research direction

Reproduce with the provided command `acme.sh --issue ... --dns dns_ali ...` using both an IDN domain and an ASCII domain. Start by locating the dns_ali provider script used by that option (typically under `dnsapi/`, e.g., `dnsapi/dns_ali.sh`) and inspect request signing/parameter construction. Check whether domain encoding is converted to punycode at the point the signature is generated. Done when an IDN domain reaches the same successful TXT add/validation flow as the ASCII domain without Aliyun signature mismatch.

Written by the indexing model from the issue text.

Assessment

Tech stack
bash, shell
Domain
cli, tooling
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
72/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.