acmesh-official / acmesh-official/acme.sh

[Bug Report] Aliyun signature is not matched with calculation with IDN domain

Abierto Apto para principiantes
#4,733 6 comentarios 3 reacciones 0 asignados Ver en GitHub
Lenguaje dominante
Shell
Estrellas
47.6k
Forks
5.7k
Merge medio
6 d 5 h
PR fusionados (30 d)
15

Descripción

Steps to reproduce
------------------
I am using a Chinese IDN domain name for my website, and using acme.sh build-in dns_ali to verify my domain for issuing certificate. Of course, I am using the latest version of acme.sh docker.
I got "Specified signature is not matched with our calculation." error in my Aliyun console all the time, thus, nothing changes in my IDN domain. Domain Verifying failed. But I tried my another total ascii domain name, it worked fine.

I noticed acme.sh had already supported readable domain name input for IDN domain, and also, I knew IDN domain name could be transformed to punycode. I am not so good at encryption technology. I reviewed Aliyun's documentation and I found its dns api using punycode to generate signature, using original encoding as one of its field instead. So, I think that this is why it doesn't work.
[Aliyun Document](https://help.aliyun.com/zh/dws/developer-reference/domain-name-validity)

And, forgive my poor English. This is my first issue.

Debug log
-----------------

```
/ # acme.sh --issue -d '[MY_CHINESE_DOMAIN]' --dns dns_ali --server https://acme-staging-v02.api.letsencrypt.org/directory
[Sat Aug 12 14:29:34 UTC 2023] Using CA: https://acme-staging-v02.api.letsencrypt.org/directory
[Sat Aug 12 14:29:34 UTC 2023] Single domain='[MY_CHINESE_DOMAIN]'
[Sat Aug 12 14:29:34 UTC 2023] Getting domain auth token for each domain
[Sat Aug 12 14:29:37 UTC 2023] Getting webroot for domain='[MY_CHINESE_DOMAIN]'
[Sat Aug 12 14:29:38 UTC 2023] Adding txt value: DbixukzZAJZY1snz9OQwsdFjlm4uSH_vEBARyWxxsbk for domain: _acme-challenge.[MY_CHINESE_DOMAIN]
[Sat Aug 12 14:29:39 UTC 2023] Error add txt for domain:_acme-challenge.[MY_CHINESE_DOMAIN]
[Sat Aug 12 14:29:39 UTC 2023] Please add '--debug' or '--log' to check more details.
[Sat Aug 12 14:29:39 UTC 2023] See: https://github.com/acmesh-official/acme.sh/wiki/How-to-debug-acme.sh
/ # acme.sh --issue -d '[MY_ASCII_DOMAIN]' --dns dns_ali --server https://acme-staging-v02.api.letsencrypt.org/directory
[Sat Aug 12 14:29:56 UTC 2023] Using CA: https://acme-staging-v02.api.letsencrypt.org/directory
[Sat Aug 12 14:29:56 UTC 2023] Single domain='[MY_ASCII_DOMAIN]'
[Sat Aug 12 14:29:56 UTC 2023] Getting domain auth token for each domain
[Sat Aug 12 14:30:00 UTC 2023] Getting webroot for domain='[MY_ASCII_DOMAIN]'
[Sat Aug 12 14:30:00 UTC 2023] Adding txt value: kGlW6CVFYmRE9gSM2DteiD0e1iyZWZeRSeCFR6cLwqw for domain: _acme-challenge.[MY_ASCII_DOMAIN]
[Sat Aug 12 14:30:01 UTC 2023] The txt record is added: Success.
[Sat Aug 12 14:30:01 UTC 2023] Let's check each DNS record now. Sleep 20 seconds first.
[Sat Aug 12 14:30:23 UTC 2023] You can use '--dnssleep' to disable public dns checks.
[Sat Aug 12 14:30:23 UTC 2023] See: https://github.com/acmesh-official/acme.sh/wiki/dnscheck
[Sat Aug 12 14:30:23 UTC 2023] Checking [MY_ASCII_DOMAIN] for _acme-challenge.[MY_ASCII_DOMAIN]
[Sat Aug 12 14:30:23 UTC 2023] Please refer to https://curl.haxx.se/libcurl/c/libcurl-errors.html for error code: 35
[Sat Aug 12 14:30:33 UTC 2023] Please refer to https://curl.haxx.se/libcurl/c/libcurl-errors.html for error code: 28
[Sat Aug 12 14:30:33 UTC 2023] Domain [MY_ASCII_DOMAIN] '_acme-challenge.[MY_ASCII_DOMAIN]' success.
[Sat Aug 12 14:30:33 UTC 2023] All success, let's return
```

Guía de contribución

Abrir la guía de contribución

Línea de trabajo

Reproduce with the provided command `acme.sh --issue ... --dns dns_ali ...` using both an IDN domain and an ASCII domain. Start by locating the dns_ali provider script used by that option (typically under `dnsapi/`, e.g., `dnsapi/dns_ali.sh`) and inspect request signing/parameter construction. Check whether domain encoding is converted to punycode at the point the signature is generated. Done when an IDN domain reaches the same successful TXT add/validation flow as the ASCII domain without Aliyun signature mismatch.

Escrito por el modelo de indexación a partir del texto del issue.

Evaluación

Stack tecnológico
bash, shell
Área
cli, tooling
Tipo de issue
Error
Dificultad
2/5
Tiempo estimado
1-3 horas
Estado de actividad
Tranquilo
Claridad
Bien especificado
Aptitud para principiantes
72/100

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.