opnsense / opnsense/plugins

ACME - Cert renewal fails after 180 to 360 days

Open
#5,497 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

support
Dominant language
PHP
Stars
1.2k
Forks
863
Avg merge
2d 6h
Merged PRs (30d)
10

Description

Important notices
Before you add a new report, we ask you kindly to acknowledge the following:

Describe the bug
Every 180 to 320 days, acme becomes unable to renew certificates

What a coincidence that just today after 180 days, my previous bug report has been closed while just today the same happened again. My previous post where other people mentioned they have the same issue:
https://github.com/opnsense/plugins/issues/5086

To Reproduce
Steps to reproduce the behavior:

  1. Go to Services > ACME Client
  2. Setup Provider Tokens with at least 1 year to no expiring date.
  3. Add challange type for your domain
  4. Use Challange type DNS-01 or as I heard from others HTTPS-01
  5. Wait 180 days

Expected behavior
Cert renewal as long as the token is valid

Screenshots

Image

Relevant log files

2026-06-12T00:00:07
config
AcmeClient: issue/renewal not required for certificate: heimdall.my.domain
2026-06-12T00:00:07
opnsense
AcmeClient: validation for certificate failed: *.my.domain
2026-06-12T00:00:07
opnsense
AcmeClient: domain validation failed (dns01)
2026-06-12T00:00:07
opnsense
AcmeClient: AcmeClient: The shell command returned exit code '1': '/usr/local/sbin/acme.sh --renew --syslog 9 --debug 3 --server 'letsencrypt' --dns 'dns_cf' --home '/var/etc/acme-client/home' --cert-home '/var/etc/acme-client/cert-home/663c8f91807395.13102793' --certpath '/var/etc/acme-client/certs/663c8f91807395.13102793/cert.pem' --keypath '/var/etc/acme-client/keys/663c8f91807395.13102793/private.key' --capath '/var/etc/acme-client/certs/663c8f91807395.13102793/chain.pem' --fullchainpath '/var/etc/acme-client/certs/663c8f91807395.13102793/fullchain.pem' --domain '*.my.domain' --domain-alias 'my.domain' --days '47' --keylength '4096' --accountconf '/var/etc/acme-client/accounts/663c7ffbd1e245.46438822_prod/account.conf''
2026-06-12T00:00:01
opnsense
AcmeClient: running acme.sh command: /usr/local/sbin/acme.sh --renew --syslog 9 --debug 3 --server 'letsencrypt' --dns 'dns_cf' --home '/var/etc/acme-client/home' --cert-home '/var/etc/acme-client/cert-home/663c8f91807395.13102793' --certpath '/var/etc/acme-client/certs/663c8f91807395.13102793/cert.pem' --keypath '/var/etc/acme-client/keys/663c8f91807395.13102793/private.key' --capath '/var/etc/acme-client/certs/663c8f91807395.13102793/chain.pem' --fullchainpath '/var/etc/acme-client/certs/663c8f91807395.13102793/fullchain.pem' --domain '*.my.domain' --domain-alias 'my.domain' --days '47' --keylength '4096' --accountconf '/var/etc/acme-client/accounts/663c7ffbd1e245.46438822_prod/account.conf'
2026-06-12T00:00:01
opnsense
AcmeClient: using challenge type: Cloudflare API Token
2026-06-12T00:00:00
opnsense
AcmeClient: account config is valid (CERT_HOME): Cloudflare
2026-06-12T00:00:00
opnsense
AcmeClient: account is registered: Cloudflare
2026-06-12T00:00:00
opnsense
AcmeClient: using CA: letsencrypt
2026-06-12T00:00:00
opnsense
AcmeClient: renew certificate: *.my.domain
2026-06-12T00:00:00
opnsense
AcmeClient: certificate must be issued/renewed: *.my.domain
If applicable, information from log files supporting your claim.

Further acme.log:


2026-06-12T00:00:07
acme.sh
[Fri Jun 12 00:00:07 CEST 2026] Skipping dns.
2026-06-12T00:00:07
acme.sh
[Fri Jun 12 00:00:07 CEST 2026] dns_entries
2026-06-12T00:00:07
acme.sh
[Fri Jun 12 00:00:07 CEST 2026] _clearupdns
2026-06-12T00:00:07
acme.sh
[Fri Jun 12 00:00:07 CEST 2026] No need to restore nginx config, skipping.
2026-06-12T00:00:07
acme.sh
[Fri Jun 12 00:00:07 CEST 2026] pid
configure arguments: --prefix=/usr/local/etc/nginx --with-cc-opt='-I /usr/local/include' --conf-path=/usr/local/etc/nginx/nginx.conf --sbin-path=/usr/local/sbin/nginx --pid-path=/var/run/nginx.pid --error-log-path=/var/log/nginx/error.log --user=www --group=www --with-compat --with-pcre --modules-path=/usr/local/libexec/nginx --with-file-aio --http-client-body-temp-path=/var/tmp/nginx/client_body_temp --http-fastcgi-temp-path=/var/tmp/nginx/fastcgi_temp --http-proxy-temp-path=/var/tmp/nginx/proxy_temp --http-scgi-temp-path=/var/tmp/nginx/scgi_temp --http-uwsgi-temp-path=/var/tmp/nginx/uwsgi_temp --http-log-path=/var/log/nginx/access.log --with-http_v2_module --with-http_v3_module --with-http_addition_module --with-http_auth_request_module --with-http_dav_module --with-http_flv_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_mp4_module --with-http_random_index_module --with-http_realip_module --with-http_secure_link_module --with-http_slice_module --with-http_ssl_module --with-http_stub_status_module --with-http_sub_module --without-mail_smtp_module --with-mail_ssl_module --with-stream --with-stream_realip_module --with-stream_ssl_module --with-stream_ssl_preread_module --with-threads --with-mail=dynamic --with-stream=dynamic --add-dynamic-module=/usr/obj/usr/ports/www/nginx/work/ngx_brotli-a71f931 --add-dynamic-module=/usr/obj/usr/ports/www/nginx/work/headers-more-nginx-module-06dc0be --add-dynamic-module=/usr/obj/usr/ports/www/nginx/work/naxsi-1.6/naxsi_src --add-dynamic-module=/usr/obj/usr/ports/www/nginx/work/njs-0.9.9/nginx --add-dynamic-module=/usr/obj/usr/ports/www/nginx/work/nginx-module-vts-bf64dbf --with-ld-opt='-L /usr/local/li
TLS SNI support enabled
built with OpenSSL 3.0.20 7 Apr 2026
built by clang 19.1.7 (https://github.com/llvm/llvm-project.git llvmorg-19.1.7-0-gcd708029e0b2)
nginx version: nginx/1.30.2
nginx:
Apache doesn't exist.
Apache:
OpenSSL 3.0.20 7 Apr 2026 (Library: OpenSSL 3.0.20 7 Apr 2026)
openssl:openssl
2026-06-12T00:00:07
acme.sh
[Fri Jun 12 00:00:07 CEST 2026] Diagnosis versions:
2026-06-12T00:00:07
acme.sh
[Fri Jun 12 00:00:07 CEST 2026] socat exists=0
2026-06-12T00:00:07
acme.sh
[Fri Jun 12 00:00:07 CEST 2026] nginx exists=0
2026-06-12T00:00:07
acme.sh
[Fri Jun 12 00:00:07 CEST 2026] openssl exists=0
2026-06-12T00:00:07
acme.sh
[Fri Jun 12 00:00:07 CEST 2026] 'dns_cf' does not contain 'dns'
2026-06-12T00:00:07
acme.sh
[Fri Jun 12 00:00:07 CEST 2026] response='{"type":"dns-01","url":"https://acme-v02.api.letsencrypt.org/acme/chall/2877401856/720321672056/3BSdyQ","status":"pending","token":"dmdmeiJtN6WIyHKBeOS6YaJdqgLY_b-kjnj4LgZfJqM"}'
}'
"token": "dmdmeiJtN6WIyHKBeOS6YaJdqgLY_b-kjnj4LgZfJqM"
"status": "pending",
"url": "https://acme-v02.api.letsencrypt.org/acme/chall/2877401856/720321672056/3BSdyQ",
"type": "dns-01",
2026-06-12T00:00:07
acme.sh
[Fri Jun 12 00:00:07 CEST 2026] _j_str='{
2026-06-12T00:00:07
acme.sh
[Fri Jun 12 00:00:07 CEST 2026] _json_decode
}'
"token": "dmdmeiJtN6WIyHKBeOS6YaJdqgLY_b-kjnj4LgZfJqM"
"status": "pending",
"url": "https://acme-v02.api.letsencrypt.org/acme/chall/2877401856/720321672056/3BSdyQ",
"type": "dns-01",
2026-06-12T00:00:07
acme.sh
[Fri Jun 12 00:00:07 CEST 2026] original='{
2026-06-12T00:00:07
acme.sh
[Fri Jun 12 00:00:07 CEST 2026] code='200'
'
strict-transport-security: max-age=604800
x-frame-options: DENY
replay-nonce: vaeQGwu6pK0xF80hgVdooMuVcRRbnxNHMr6AYk9vxDT-R57xpdw
location: https://acme-v02.api.letsencrypt.org/acme/chall/2877401856/720321672056/3BSdyQ
link: <https://acme-v02.api.letsencrypt.org/acme/authz/2877401856/720321672056>;rel="up"
link: <https://acme-v02.api.letsencrypt.org/directory>;rel="index"
cache-control: public, max-age=0, no-cache
boulder-requester: 2877401856
content-length: 194
content-type: application/json
date: Thu, 11 Jun 2026 22:00:06 GMT
server: nginx
2026-06-12T00:00:07
acme.sh
[Fri Jun 12 00:00:07 CEST 2026] responseHeaders='HTTP/2 200
2026-06-12T00:00:07
acme.sh
[Fri Jun 12 00:00:07 CEST 2026] _ret='0'
2026-06-12T00:00:06
acme.sh
[Fri Jun 12 00:00:06 CEST 2026] _CURL='curl --silent --dump-header /var/etc/acme-client/home/http.header -L --trace-ascii /tmp/tmp.VH71SBhVlM -g '
2026-06-12T00:00:06
acme.sh
[Fri Jun 12 00:00:06 CEST 2026] Http already initialized.
2026-06-12T00:00:06
acme.sh
[Fri Jun 12 00:00:06 CEST 2026] _postContentType='application/jose+json'
2026-06-12T00:00:06
acme.sh
[Fri Jun 12 00:00:06 CEST 2026] body='{"protected": "ekgnekjanu32aSAGEA0JFaEw4MXZtdVhrbFkzX2FELXROZjhDREgwUDVac0k5Q1ZDeDBYYnlKb085aGsiLCAidXJsIjogImh0dHBzOi8vYWNtZS12MDIuYXBpLmxldHNlbmNyeXB0Lm9yZy9hY21lL2NoYWxsLzI4Nzc0MDE4NTYvNzIwMzIxNjcyMDU2LzNCU2R5USIsICJhbGciOiAiUlMyNTYiLCAia2lkIjogImh0dHBzOi8vYWNtZS12MDIuYXBpLmxldHNlbmNyeXB0Lm9yZy9hY21lL2FjY3QvMjg3NzQwMTg1NiJ9", "payload": "e30", "signature": "T70TBsQgpDvFB6gPzrEV6f24frErF8oS4eLJGiwfnh-t8BFD3SfOqWnqQrhvCdN-ytKcsaCDArmS71FSFbmGzO8pPIaxi4Xt45cZFPwmTnlkmJFmkvJBVVwDAnT-G9qJ5UMMHZcOmkeWhU0w0_-sbkZQO2hifZbNjokkcAxSD8RYR7NyuHt3U4oXCK0l7DSwMh0-9YQOWIFlXysr8KK5AQPjo8J9AEdlS8medAXexHZrwfk1M36goMkVUVNnllPj6tDG4TUwAEFQBrz9m-x8-EO-b6mXZpNnTCgneaoUj7enZlGlNJzuOhtj9PHYdIbQ6bsbgSIetjz8crNoVB2t__h9gWjPvHbfLmNdM6bEJHnmiqqvimiF0Ykn73TSH0bRA7zS7pm2bI-Oq5_a6Zw4CU3aXBr0C1ub4ML6cWnWewjxm86DgTAhaW9ZL9J2ETADWz6IFnrArkF-33nGkT3fnHT3VuIWSUArjxn3VZ-7C4IrzTxGUfGnl1HIrzpm_A4L4_sb2o6hUd0k1jsH5xUAeyw1XakF_gT7BhiVPJEqXGXtkicW2swun34YKGzf0-P38FnG-g8Q_Dvu1lH1YZF27PpGh2UwO7-gaAPWvDWFqonF6_Wg2mXT21Fgo0FHht1WofgXJ51ACSrMp8GGY-TqNdZVubeKUni3JpY_0aLsfEI"}'
2026-06-12T00:00:06
acme.sh
[Fri Jun 12 00:00:06 CEST 2026] _post_url='https://acme-v02.api.letsencrypt.org/acme/chall/2877401856/720321672056/3BSdyQ'
2026-06-12T00:00:06
acme.sh
[Fri Jun 12 00:00:06 CEST 2026] POST
2026-06-12T00:00:06
acme.sh
[Fri Jun 12 00:00:06 CEST 2026] body='{"protected": "ekgnekjanu32aSAGEA0JFaEw4MXZtdVhrbFkzX2FELXROZjhDREgwUDVac0k5Q1ZDeDBYYnlKb085aGsiLCAidXJsIjogImh0dHBzOi8vYWNtZS12MDIuYXBpLmxldHNlbmNyeXB0Lm9yZy9hY21lL2NoYWxsLzI4Nzc0MDE4NTYvNzIwMzIxNjcyMDU2LzNCU2R5USIsICJhbGciOiAiUlMyNTYiLCAia2lkIjogImh0dHBzOi8vYWNtZS12MDIuYXBpLmxldHNlbmNyeXB0Lm9yZy9hY21lL2FjY3QvMjg3NzQwMTg1NiJ9", "payload": "e30", "signature": "T70TBsQgpDvFB6gPzrEV6f24frErF8oS4eLJGiwfnh-t8BFD3SfOqWnqQrhvCdN-ytKcsaCDArmS71FSFbmGzO8pPIaxi4Xt45cZFPwmTnlkmJFmkvJBVVwDAnT-G9qJ5UMMHZcOmkeWhU0w0_-sbkZQO2hifZbNjokkcAxSD8RYR7NyuHt3U4oXCK0l7DSwMh0-9YQOWIFlXysr8KK5AQPjo8J9AEdlS8medAXexHZrwfk1M36goMkVUVNnllPj6tDG4TUwAEFQBrz9m-x8-EO-b6mXZpNnTCgneaoUj7enZlGlNJzuOhtj9PHYdIbQ6bsbgSIetjz8crNoVB2t__h9gWjPvHbfLmNdM6bEJHnmiqqvimiF0Ykn73TSH0bRA7zS7pm2bI-Oq5_a6Zw4CU3aXBr0C1ub4ML6cWnWewjxm86DgTAhaW9ZL9J2ETADWz6IFnrArkF-33nGkT3fnHT3VuIWSUArjxn3VZ-7C4IrzTxGUfGnl1HIrzpm_A4L4_sb2o6hUd0k1jsH5xUAeyw1XakF_gT7BhiVPJEqXGXtkicW2swun34YKGzf0-P38FnG-g8Q_Dvu1lH1YZF27PpGh2UwO7-gaAPWvDWFqonF6_Wg2mXT21Fgo0FHht1WofgXJ51ACSrMp8GGY-TqNdZVubeKUni3JpY_0aLsfEI"}'
2026-06-12T00:00:06
acme.sh
[Fri Jun 12 00:00:06 CEST 2026] sig='T70TBsQgpDvFB6gPzrEV6f24frErF8oS4eLJGiwfnh-t8BFD3SfOqWnqQrhvCdN-ytKcsaCDArmS71FSFbmGzO8pPIaxi4Xt45cZFPwmTnlkmJFmkvJBVVwDAnT-G9qJ5UMMHZcOmkeWhU0w0_-sbkZQO2hifZbNjokkcAxSD8RYR7NyuHt3U4oXCK0l7DSwMh0-9YQOWIFlXysr8KK5AQPjo8J9AEdlS8medAXexHZrwfk1M36goMkVUVNnllPj6tDG4TUwAEFQBrz9m-x8-EO-b6mXZpNnTCgneaoUj7enZlGlNJzuOhtj9PHYdIbQ6bsbgSIetjz8crNoVB2t__h9gWjPvHbfLmNdM6bEJHnmiqqvimiF0Ykn73TSH0bRA7zS7pm2bI-Oq5_a6Zw4CU3aXBr0C1ub4ML6cWnWewjxm86DgTAhaW9ZL9J2ETADWz6IFnrArkF-33nGkT3fnHT3VuIWSUArjxn3VZ-7C4IrzTxGUfGnl1HIrzpm_A4L4_sb2o6hUd0k1jsH5xUAeyw1XakF_gT7BhiVPJEqXGXtkicW2swun34YKGzf0-P38FnG-g8Q_Dvu1lH1YZF27PpGh2UwO7-gaAPWvDWFqonF6_Wg2mXT21Fgo0FHht1WofgXJ51ACSrMp8GGY-TqNdZVubeKUni3JpY_0aLsfEI'
2026-06-12T00:00:06
acme.sh
[Fri Jun 12 00:00:06 CEST 2026] _sig_t='T70TBsQgpDvFB6gPzrEV6f24frErF8oS4eLJGiwfnh+t8BFD3SfOqWnqQrhvCdN+ytKcsaCDArmS71FSFbmGzO8pPIaxi4Xt45cZFPwmTnlkmJFmkvJBVVwDAnT+G9qJ5UMMHZcOmkeWhU0w0/+sbkZQO2hifZbNjokkcAxSD8RYR7NyuHt3U4oXCK0l7DSwMh0+9YQOWIFlXysr8KK5AQPjo8J9AEdlS8medAXexHZrwfk1M36goMkVUVNnllPj6tDG4TUwAEFQBrz9m+x8+EO+b6mXZpNnTCgneaoUj7enZlGlNJzuOhtj9PHYdIbQ6bsbgSIetjz8crNoVB2t//h9gWjPvHbfLmNdM6bEJHnmiqqvimiF0Ykn73TSH0bRA7zS7pm2bI+Oq5/a6Zw4CU3aXBr0C1ub4ML6cWnWewjxm86DgTAhaW9ZL9J2ETADWz6IFnrArkF+33nGkT3fnHT3VuIWSUArjxn3VZ+7C4IrzTxGUfGnl1HIrzpm/A4L4/sb2o6hUd0k1jsH5xUAeyw1XakF/gT7BhiVPJEqXGXtkicW2swun34YKGzf0+P38FnG+g8Q/Dvu1lH1YZF27PpGh2UwO7+gaAPWvDWFqonF6/Wg2mXT21Fgo0FHht1WofgXJ51ACSrMp8GGY+TqNdZVubeKUni3JpY/0aLsfEI='
2026-06-12T00:00:06
acme.sh
[Fri Jun 12 00:00:06 CEST 2026] base64 single line.
2026-06-12T00:00:06
acme.sh
[Fri Jun 12 00:00:06 CEST 2026] protected64='ekgnekjanu32aSAGEA0JFaEw4MXZtdVhrbFkzX2FELXROZjhDREgwUDVac0k5Q1ZDeDBYYnlKb085aGsiLCAidXJsIjogImh0dHBzOi8vYWNtZS12MDIuYXBpLmxldHNlbmNyeXB0Lm9yZy9hY21lL2NoYWxsLzI4Nzc0MDE4NTYvNzIwMzIxNjcyMDU2LzNCU2R5USIsICJhbGciOiAiUlMyNTYiLCAia2lkIjogImh0dHBzOi8vYWNtZS12MDIuYXBpLmxldHNlbmNyeXB0Lm9yZy9hY21lL2FjY3QvMjg3NzQwMTg1NiJ9'
2026-06-12T00:00:06
acme.sh
[Fri Jun 12 00:00:06 CEST 2026] base64 single line.
2026-06-12T00:00:06
acme.sh
[Fri Jun 12 00:00:06 CEST 2026] protected='{"nonce": "bDcHKBEhL81vmuXklY3_aD-tNf8CDH0P5ZsI9CVCx0XbyJoO9hk", "url": "https://acme-v02.api.letsencrypt.org/acme/chall/2877401856/720321672056/3BSdyQ", "alg": "RS256", "kid": "https://acme-v02.api.letsencrypt.org/acme/acct/2877401856"}'
2026-06-12T00:00:06
acme.sh
[Fri Jun 12 00:00:06 CEST 2026] nonce='bDcHKBEhL81vmuXklY3_aD-tNf8CDH0P5ZsI9CVCx0XbyJoO9hk'
2026-06-12T00:00:06
acme.sh
[Fri Jun 12 00:00:06 CEST 2026] Use _CACHED_NONCE='bDcHKBEhL81vmuXklY3_aD-tNf8CDH0P5ZsI9CVCx0XbyJoO9hk'
2026-06-12T00:00:06
acme.sh
[Fri Jun 12 00:00:06 CEST 2026] _request_retry_times='1'
2026-06-12T00:00:06
acme.sh
[Fri Jun 12 00:00:06 CEST 2026] payload64='e30'
2026-06-12T00:00:06
acme.sh
[Fri Jun 12 00:00:06 CEST 2026] base64 single line.
2026-06-12T00:00:06
acme.sh
[Fri Jun 12 00:00:06 CEST 2026] Use cached jwk for file: /var/etc/acme-client/accounts/663c7ffbd1e245.46438822_prod/account.key
2026-06-12T00:00:06
acme.sh
[Fri Jun 12 00:00:06 CEST 2026] payload='{}'
2026-06-12T00:00:06
acme.sh
[Fri Jun 12 00:00:06 CEST 2026] url='https://acme-v02.api.letsencrypt.org/acme/chall/2877401856/720321672056/3BSdyQ'
2026-06-12T00:00:06
acme.sh
[Fri Jun 12 00:00:06 CEST 2026] =======Sending Signed Request=======
2026-06-12T00:00:06
acme.sh
[Fri Jun 12 00:00:06 CEST 2026] _t_vtype
2026-06-12T00:00:06
acme.sh
[Fri Jun 12 00:00:06 CEST 2026] _t_key_authz='dmdmeiJtN6WIyHKBeOS6YaJdqgLY_b-kjnj4LgZfJqM.Kg40Apx66il6cLWEg_W5cG5XoDgRmcWoSy10ohHmzt8'
2026-06-12T00:00:06
acme.sh
[Fri Jun 12 00:00:06 CEST 2026] _t_url='https://acme-v02.api.letsencrypt.org/acme/chall/2877401856/720321672056/3BSdyQ'
2026-06-12T00:00:06
acme.sh
[Fri Jun 12 00:00:06 CEST 2026] Trigger domain validation.
2026-06-12T00:00:06
acme.sh
[Fri Jun 12 00:00:06 CEST 2026] start to deactivate authz
2026-06-12T00:00:06
acme.sh
[Fri Jun 12 00:00:06 CEST 2026] _chk_vlist='*.my.domain#dmdmeiJtN6WIyHKBeOS6YaJdqgLY_b-kjnj4LgZfJqM.Kg40Apx66il6cLWEg_W5cG5XoDgRmcWoSy10ohHmzt8#https://acme-v02.api.letsencrypt.org/acme/chall/2877401856/720321672056/3BSdyQ#dns-01#dns_cf#https://acme-v02.api.letsencrypt.org/acme/authz/2877401856/720321672056,'
2026-06-12T00:00:06
acme.sh
[Fri Jun 12 00:00:06 CEST 2026] See: https://github.com/acmesh-official/acme.sh/wiki/How-to-debug-acme.sh
2026-06-12T00:00:06
acme.sh
[Fri Jun 12 00:00:06 CEST 2026] Please add '--debug' or '--log' to see more information.
2026-06-12T00:00:06
acme.sh
[Fri Jun 12 00:00:06 CEST 2026] _on_issue_err
2026-06-12T00:00:06
acme.sh
[Fri Jun 12 00:00:06 CEST 2026] Error adding TXT record to domain: _acme-challenge.my.domain
2026-06-12T00:00:06
acme.sh
[Fri Jun 12 00:00:06 CEST 2026] invalid domain
2026-06-12T00:00:06
acme.sh
[Fri Jun 12 00:00:06 CEST 2026] response='{"success":false,"errors":[{"code":9109,"message":"Invalid access token"}],"messages":[],"result":null}'
2026-06-12T00:00:06
acme.sh
[Fri Jun 12 00:00:06 CEST 2026] ret='0'
2026-06-12T00:00:05
acme.sh
[Fri Jun 12 00:00:05 CEST 2026] _CURL='curl --silent --dump-header /var/etc/acme-client/home/http.header -L --trace-ascii /tmp/tmp.VH71SBhVlM -g '
2026-06-12T00:00:05
acme.sh
[Fri Jun 12 00:00:05 CEST 2026] Http already initialized.
2026-06-12T00:00:05
acme.sh
[Fri Jun 12 00:00:05 CEST 2026] timeout=
2026-06-12T00:00:05
acme.sh
[Fri Jun 12 00:00:05 CEST 2026] url='https://api.cloudflare.com/client/v4/zones/<redacted>'
2026-06-12T00:00:05
acme.sh
[Fri Jun 12 00:00:05 CEST 2026] GET
2026-06-12T00:00:05
acme.sh
[Fri Jun 12 00:00:05 CEST 2026] zones/<redacted>
2026-06-12T00:00:05
acme.sh
[Fri Jun 12 00:00:05 CEST 2026] First detect the root zone
2026-06-12T00:00:05
acme.sh
[Fri Jun 12 00:00:05 CEST 2026] 12:CF_Zone_ID='<redacted>'
2026-06-12T00:00:05
acme.sh
[Fri Jun 12 00:00:05 CEST 2026] OK
2026-06-12T00:00:05
acme.sh
[Fri Jun 12 00:00:05 CEST 2026] 11:CF_Account_ID='f6e2754d3db7739c59cc3af4bdc9e2a6'
2026-06-12T00:00:05
acme.sh
[Fri Jun 12 00:00:05 CEST 2026] OK
2026-06-12T00:00:05
acme.sh
[Fri Jun 12 00:00:05 CEST 2026] 10:CF_Token='vKwafsACjXA5KQ50gg_CCfyMkWhp-Vbvb46lItSm'
2026-06-12T00:00:05
acme.sh
[Fri Jun 12 00:00:05 CEST 2026] OK
2026-06-12T00:00:05
acme.sh
[Fri Jun 12 00:00:05 CEST 2026] Adding TXT value: KFEAGDSAkZZHMvBOHZnD7NULN7Pa9bMmV1NAeUrE4 for domain: _acme-challenge.my.domain
2026-06-12T00:00:05
acme.sh
[Fri Jun 12 00:00:05 CEST 2026] dns_cf_add exists=0
2026-06-12T00:00:05
acme.sh
[Fri Jun 12 00:00:05 CEST 2026] Found domain API file: /usr/local/share/examples/acme.sh/dnsapi/dns_cf.sh
2026-06-12T00:00:05
acme.sh
[Fri Jun 12 00:00:05 CEST 2026] dns_entry='my.domain,_acme-challenge.my.domain,,dns_cf,KFEAGDSAkZZHMvBOHZnD7NULN7Pa9bMmV1NAeUrE4,/usr/local/share/examples/acme.sh/dnsapi/dns_cf.sh'
2026-06-12T00:00:05
acme.sh
[Fri Jun 12 00:00:05 CEST 2026] d_api='/usr/local/share/examples/acme.sh/dnsapi/dns_cf.sh'
2026-06-12T00:00:05
acme.sh
[Fri Jun 12 00:00:05 CEST 2026] txt='KFEAGDSAkZZHMvBOHZnD7NULN7Pa9bMmV1NAeUrE4'
2026-06-12T00:00:05
acme.sh
[Fri Jun 12 00:00:05 CEST 2026] base64 single line.
2026-06-12T00:00:05
acme.sh
[Fri Jun 12 00:00:05 CEST 2026] txtdomain='_acme-challenge.my.domain'
2026-06-12T00:00:05
acme.sh
[Fri Jun 12 00:00:05 CEST 2026] _d_alias
2026-06-12T00:00:05
acme.sh
[Fri Jun 12 00:00:05 CEST 2026] d='*.my.domain'
2026-06-12T00:00:05
acme.sh
[Fri Jun 12 00:00:05 CEST 2026] vlist='*.my.domain#dmdmeiJtN6WIyHKBeOS6YaJdqgLY_b-kjnj4LgZfJqM.Kg40Apx66il6cLWEg_W5cG5XoDgRmcWoSy10ohHmzt8#https://acme-v02.api.letsencrypt.org/acme/chall/2877401856/720321672056/3BSdyQ#dns-01#dns_cf#https://acme-v02.api.letsencrypt.org/acme/authz/2877401856/720321672056,'
2026-06-12T00:00:05
acme.sh
[Fri Jun 12 00:00:05 CEST 2026] d
2026-06-12T00:00:05
acme.sh
[Fri Jun 12 00:00:05 CEST 2026] dvlist='*.my.domain#dmdmeiJtN6WIyHKBeOS6YaJdqgLY_b-kjnj4LgZfJqM.Kg40Apx66il6cLWEg_W5cG5XoDgRmcWoSy10ohHmzt8#https://acme-v02.api.letsencrypt.org/acme/chall/2877401856/720321672056/3BSdyQ#dns-01#dns_cf#https://acme-v02.api.letsencrypt.org/acme/authz/2877401856/720321672056'
2026-06-12T00:00:05
acme.sh
[Fri Jun 12 00:00:05 CEST 2026] keyauthorization='dmdmeiJtN6WIyHKBeOS6YaJdqgLY_b-kjnj4LgZfJqM.Kg40Apx66il6cLWEg_W5cG5XoDgRmcWoSy10ohHmzt8'
2026-06-12T00:00:05
acme.sh
[Fri Jun 12 00:00:05 CEST 2026] uri='https://acme-v02.api.letsencrypt.org/acme/chall/2877401856/720321672056/3BSdyQ'
2026-06-12T00:00:05
acme.sh
[Fri Jun 12 00:00:05 CEST 2026] token='dmdmeiJtN6WIyHKBeOS6YaJdqgLY_b-kjnj4LgZfJqM'
2026-06-12T00:00:05
acme.sh
[Fri Jun 12 00:00:05 CEST 2026] entry='"type":"dns-01","url":"https://acme-v02.api.letsencrypt.org/acme/chall/2877401856/720321672056/3BSdyQ","status":"pending","token":"dmdmeiJtN6WIyHKBeOS6YaJdqgLY_b-kjnj4LgZfJqM"'
2026-06-12T00:00:05
acme.sh
[Fri Jun 12 00:00:05 CEST 2026] base64 single line.
2026-06-12T00:00:05
acme.sh
[Fri Jun 12 00:00:05 CEST 2026] _authz_url='https://acme-v02.api.letsencrypt.org/acme/authz/2877401856/720321672056'
2026-06-12T00:00:05
acme.sh
[Fri Jun 12 00:00:05 CEST 2026] response='{"identifier":{"type":"dns","value":"my.domain"},"status":"pending","expires":"2026-06-18T22:00:04Z","challenges":[{"type":"dns-01","url":"https://acme-v02.api.letsencrypt.org/acme/chall/2877401856/720321672056/3BSdyQ","status":"pending","token":"dmdmeiJtN6WIyHKBeOS6YaJdqgLY_b-kjnj4LgZfJqM"}],"wildcard": true}#https://acme-v02.api.letsencrypt.org/acme/authz/2877401856/720321672056'
2026-06-12T00:00:05
acme.sh
[Fri Jun 12 00:00:05 CEST 2026] _candidates='*.my.domain,{"identifier":{"type":"dns","value":"my.domain"},"status":"pending","expires":"2026-06-18T22:00:04Z","challenges":[{"type":"dns-01","url":"https://acme-v02.api.letsencrypt.org/acme/chall/2877401856/720321672056/3BSdyQ","status":"pending","token":"dmdmeiJtN6WIyHKBeOS6YaJdqgLY_b-kjnj4LgZfJqM"}],"wildcard": true}#https://acme-v02.api.letsencrypt.org/acme/authz/2877401856/720321672056'
2026-06-12T00:00:05
acme.sh
[Fri Jun 12 00:00:05 CEST 2026] _idn_temp
2026-06-12T00:00:05
acme.sh
[Fri Jun 12 00:00:05 CEST 2026] _is_idn_d='*.my.domain'
2026-06-12T00:00:05
acme.sh
[Fri Jun 12 00:00:05 CEST 2026] _currentRoot='dns_cf'
2026-06-12T00:00:05
acme.sh
[Fri Jun 12 00:00:05 CEST 2026] _w='dns_cf'
2026-06-12T00:00:05
acme.sh
[Fri Jun 12 00:00:05 CEST 2026] Getting webroot for domain='*.my.domain'
2026-06-12T00:00:05
acme.sh
[Fri Jun 12 00:00:05 CEST 2026] d='*.my.domain'
'
2026-06-12T00:00:05
acme.sh
[Fri Jun 12 00:00:05 CEST 2026] _authorizations_map='*.my.domain,{"identifier":{"type":"dns","value":"my.domain"},"status":"pending","expires":"2026-06-18T22:00:04Z","challenges":[{"type":"dns-01","url":"https://acme-v02.api.letsencrypt.org/acme/chall/2877401856/720321672056/3BSdyQ","status":"pending","token":"dmdmeiJtN6WIyHKBeOS6YaJdqgLY_b-kjnj4LgZfJqM"}],"wildcard": true}#https://acme-v02.api.letsencrypt.org/acme/authz/2877401856/720321672056
2026-06-12T00:00:05
acme.sh
[Fri Jun 12 00:00:05 CEST 2026] _d='*.my.domain'
2026-06-12T00:00:05
acme.sh
[Fri Jun 12 00:00:05 CEST 2026] response='{"identifier":{"type":"dns","value":"my.domain"},"status":"pending","expires":"2026-06-18T22:00:04Z","challenges":[{"type":"dns-01","url":"https://acme-v02.api.letsencrypt.org/acme/chall/2877401856/720321672056/3BSdyQ","status":"pending","token":"dmdmeiJtN6WIyHKBeOS6YaJdqgLY_b-kjnj4LgZfJqM"}],"wildcard": true}'
2026-06-12T00:00:05
acme.sh
[Fri Jun 12 00:00:05 CEST 2026] response='{"identifier":{"type":"dns","value":"my.domain"},"status":"pending","expires":"2026-06-18T22:00:04Z","challenges":[{"type":"dns-01","url":"https://acme-v02.api.letsencrypt.org/acme/chall/2877401856/720321672056/3BSdyQ","status":"pending","token":"dmdmeiJtN6WIyHKBeOS6YaJdqgLY_b-kjnj4LgZfJqM"}],"wildcard": true}'
}'
"wildcard": true

Additional context
This happens every year for as long as I use OPNsense

My workaround for that issue:
Push the "Reset ACME Client" button

Environment
Just ACME Client Plugin

OPNsense 26.1.9-amd64
FreeBSD 14.3-RELEASE-p14
OpenSSL 3.0.20

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at the Services > ACME Client renewal flow and inspect the /usr/local/sbin/acme.sh command shown in the logs, including the DNS-01 validation response. Reproduce the failure after the reported renewal interval and compare the ACME Client and acme.sh logs. Done means certificates renew successfully with the configured provider token and validation no longer fails.

Written by the indexing model from the issue text.

Assessment

Tech stack
nginx, php
Domain
backend, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.