Articles in this section

See more

Cannot issue wildcard Let's Encrypt certificate in Plesk: DNS problem: NXDOMAIN looking up TXT for _acme-challenge.example.com

Avatar
Taras Ermoshin
Updated
Follow

Applicable to:

  • Plesk for Linux
  • Plesk for Windows

Symptoms

  • Issuing a wildcard Let's Encrypt certificate in Plesk in Domains > example.com > Let's Encrypt (or in Domains > example.com > SSL/TLS Certificates if the extension SSL It! is installed) fails with the error:

    PLESK_ERROR: Error: Could not issue a Let's Encrypt SSL/TLS certificate for example.com. Authorization for the domain failed.
    Details
    Invalid response from https://acme-v02.api.letsencrypt.org/acme/authz/zEHPSbB4eUyIomzu9qynFouNGrIgiUlJZ755z_Kx4kY.
    Details:
    Type: urn:ietf:params:acme:error:dns
    Status: 400
    Detail: DNS problem: NXDOMAIN looking up TXT for _acme-challenge.example.com

  • The TXT DNS record for the hostname _acme-challenge.example.com is not available globally:

    # nslookup -type=TXT _acme-challenge.example.com
    Server: 8.8.8.8
    Address: 8.8.8.8#53

    ** server can't find _acme-challenge.example.com: NXDOMAIN

  • The same DNS record is present in Plesk in Domains > example.com > DNS Settings and is returned by Plesk's DNS server:

    # nslookup -type=TXT _acme-challenge.example.com example.com
    Server: example.com
    Address: 203.0.113.2#53

    _acme-challenge.example.com text = "yFHaUBDo0THtVyjdmtwmJkgEAmPDemtITjpftHrN9Wg"

Cause

The TXT DNS record for the hostname _acme-challenge.example.com is not available globally.

Resolution

DNS zone of the domain is hosted on the Plesk server

  1. Wait until the DNS propagation is completed and the required record is available globally. The propagation can take up to 72 hours. Check of the record's availability can be done on resources like https://dnschecker.org/.

  2. Issue Let's Encrypt certificate again in Plesk in Domains > example.com > Let's Encrypt (or in Domains > example.com > SSL/TLS Certificates).

DNS zone of the domain is hosted on external DNS hosting

  1. On the external DNS hosting, add the TXT record for the hostname _acme-challenge.example.com. The value for the record can be obtained in Plesk in Domains > example.com > DNS Settings.

  2. Issue Let's Encrypt certificate again in Plesk in Domains > example.com > Let's Encrypt (or in Domains > example.com > SSL/TLS Certificates).

Comments

0 comments

Please sign in to leave a comment.

Have more questions? Submit a request

Related articles