Applicable to:
- Plesk for Linux
- Plesk for Windows
Symptoms
-
Issuing a wildcard Let's Encrypt certificate in Plesk in Domains > example.com > Let's Encrypt (or in Domains > example.com > SSL/TLS Certificates if the extension SSL It! is installed) fails with the error:
PLESK_ERROR: Error: Could not issue a Let's Encrypt SSL/TLS certificate for example.com. Authorization for the domain failed.
Details
Invalid response from https://acme-v02.api.letsencrypt.org/acme/authz/zEHPSbB4eUyIomzu9qynFouNGrIgiUlJZ755z_Kx4kY.
Details:
Type: urn:ietf:params:acme:error:dns
Status: 400
Detail: DNS problem: NXDOMAIN looking up TXT for _acme-challenge.example.com -
The TXT DNS record for the hostname _acme-challenge.example.com is not available globally:
# nslookup -type=TXT _acme-challenge.example.com
Server: 8.8.8.8
Address: 8.8.8.8#53
** server can't find _acme-challenge.example.com: NXDOMAIN -
The same DNS record is present in Plesk in Domains > example.com > DNS Settings and is returned by Plesk's DNS server:
# nslookup -type=TXT _acme-challenge.example.com example.com
Server: example.com
Address: 203.0.113.2#53
_acme-challenge.example.com text = "yFHaUBDo0THtVyjdmtwmJkgEAmPDemtITjpftHrN9Wg"
Cause
The TXT DNS record for the hostname _acme-challenge.example.com is not available globally.
Resolution
-
Wait until the DNS propagation is completed and the required record is available globally. The propagation can take up to 72 hours. Check of the record's availability can be done on resources like https://dnschecker.org/.
-
Issue Let's Encrypt certificate again in Plesk in Domains > example.com > Let's Encrypt (or in Domains > example.com > SSL/TLS Certificates).
-
On the external DNS hosting, add the TXT record for the hostname _acme-challenge.example.com. The value for the record can be obtained in Plesk in Domains > example.com > DNS Settings.
-
Issue Let's Encrypt certificate again in Plesk in Domains > example.com > Let's Encrypt (or in Domains > example.com > SSL/TLS Certificates).
Comments
3 comments
Having to specifiy the TXT content on the external Name Server each time a renew is required is absolutely impossible, too long, so not a solution.
We definitely NEED an option in Plesk Obsidian Windows to be able to choose if :
- Option A : Plesk Let's Encrypt extension will use the method of adding a TXT record in the Plesk DNS Zone
- Option B : Plesk Let's Encrypt extension will use the method of creating a /.well-known/ file under the domain root. This option will be useful for all the people not using Plesk as their Name Server.
Yes, your technical support solved the situation. In fact, for those who come to this page, you must know that, to issue certificates, Let's Encrypt servers use two types of challenges:
More information are available at this page https://letsencrypt.org/docs/challenge-types/
I wish that this information would be more clearly displayed inside Plesk, or on the SSL-related Plesk Documentation pages.
@Alex Laforge As I can see it was figured out in the ticket.
Please sign in to leave a comment.