openwrt / openwrt/packages

acme-acmesh + acme-acmesh-dnsapi + luci-app-acme, can't use dns authentication method.

Open
#21,938 9 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

release/23.05
Dominant language
Makefile
Stars
4.6k
Forks
4k
Avg merge
3d 12h
Merged PRs (30d)
134

Description

Maintainer: @\tohojo
Environment: ARMv7 Processor rev 5 (v7l), AVM FRITZ!Box 7530, pq40xx/generic, OpenWrt 23.05.0-rc3

Description:
If I attempt to create an ACME configuration with dns authentication, it seems to be ignored and acme.sh is launched without necessary parameters:

With luci interface I generated following config file:

config acme
	option account_email 'notify@example.com'
	option debug '1'

config cert 'Router'
	option enabled '1'
	option staging '1'
	option use_staging '0'
	option keylength '2048'
	option update_uhttpd '1'
	option validation_method 'dns'
	option dns 'dns_ovh'
	list credentials 'OVH_AK="xxxxxxxxxx"'
	list credentials 'OVH_AS="xxxxxxxxxx"'
	list credentials 'OVH_CK="xxxxxxxxxx"'
	list domains 'domain.example.com'

options validation_method and dns seems to be consistent with acme package documentation https://openwrt.org/docs/guide-user/services/tls/acmesh .

By launching /etc/init.d/acme start I obtain:

acme-acmesh: Running ACME for avm.comunifvg.ovh
acme-acmesh: /usr/lib/acme/client/acme.sh --debug --renew --home /etc/acme -d domain.example.com

If I launch acme.sh manually with correct parameters, as for example

#!/bin/bash
export OVH_AK="xxxxxxxxxx"
export OVH_AS="xxxxxxxxxx"
export OVH_CK="xxxxxxxxxx"
/usr/lib/acme/client/acme.sh --issue -i -d domain.example.com --dns dns_ovh --server letsencrypt

certificates are created correctly.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the ACME configuration shown in the issue and inspect /etc/init.d/acme, focusing on how validation_method, dns, and credentials are translated into the /usr/lib/acme/client/acme.sh invocation. Compare the generated command with the working manual command; done means DNS authentication parameters are passed when the configuration uses validation_method 'dns' and dns 'dns_ovh'.

Written by the indexing model from the issue text.

Assessment

Tech stack
shell
Domain
devops, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.