acmesh-official / acmesh-official/acme.sh
post-validation cleanup fails every time, leaving an orphaned `_acme-challenge` TXT record with dns_efficientip.sh
- 主要语言
- Shell
- 星标
- 47.6k
- 派生
- 5.7k
- 平均合并
- 7 天 1 小时
- 30 天内合并 PR
- 16
描述
**Issue: post-validation cleanup fails every time, leaving an orphaned `_acme-challenge` TXT record:**
**Root cause and fix for the `dns_efficientip` cleanup failure**
I dug into this and traced the cause. Posting it here since I'm preparing a PR.
**Symptom:** issuance succeeds, but the post-validation cleanup fails every time, leaving an orphaned `_acme-challenge` TXT record:
```
Removing txt: for domain: _acme-challenge.
Using EfficientIP API
DELETE
_post_url='.../dns_rr_delete?rr_type=TXT&rr_name=_acme-challenge.&rr_value1=&dns_name='
Error deleting DNS record
{"connected":false}
```
The `dns_rr_add` call just seconds earlier — same `dns_name`, same credentials — succeeds. So it isn't auth or connectivity.
**Cause:** `dns_efficientip_rm` deletes by `rr_name` + `rr_value1`. On a SOLIDserver smart architecture, the appliance stores the FQDN in `rr_full_name`, with the relative label in `rr_glue`. You can see this in a `dns_rr_list` response for the challenge record:
```
"rr_full_name":"_acme-challenge.host.example.com",
"rr_glue":"_acme-challenge.host",
"rr_name_id": ...,
"rr_id":"58337702"
```
A delete keyed on `rr_name=` doesn't resolve to a unique record, so the API no-ops and returns `{"connected":false}` — which isn't a documented SOLIDserver error shape, hence the unhelpful message.
Deleting by `rr_id` works cleanly. Manually confirmed against the same appliance:
```
GET /rest/dns_rr_list?WHERE=rr_full_name='_acme-challenge.host.example.com' and rr_type='TXT'
→ [{... "rr_id":"58337702" ...}]
DELETE /rest/dns_rr_delete?rr_id=58337702
→ [{"ret_oid":"58337702"}] (HTTP 200)
```
This matches the vendor's own documented delete example (REST API Reference, Example 36.4), which deletes by `rr_id`.
**Fix (PR incoming):** change `dns_efficientip_rm` to do the documented two-step:
1. `dns_rr_list` filtered on `rr_full_name` + `rr_type='TXT'` + `value1=''` to resolve the `rr_id`.
2. `dns_rr_delete?rr_id=`.
I've tested this end-to-end on a production smart architecture (`dns_type: vdns`, no view) against LE staging — full add → verify → remove cycle completes with no orphan left behind, where the stock plugin failed on every removal. PR to follow against `dev`.
贡献指南
评估
这个 Issue 还没有评估数据。