Overview
This article addresses the "400 urn:ietf:params:acme:error:dns" error encountered when running the checkallsslcerts script. This error indicates a problem with DNS validation for SSL certificates, often due to misconfigured DNS settings. Follow the steps below to troubleshoot and resolve the issue.
Pre-requirements
- Access to the server where the
checkallsslcertsscript is running. - Root or sudo privileges to modify DNS settings.
- Knowledge of the domain name and its associated IP address.
Understanding the Error
The error message indicates that the system failed to validate domain control using the DNS DCV method. Specifically, it states:
The system failed to validate domain control for the domain “host.domain.tld” using the “DNS” DCV method: 400 urn:ietf:params:acme:error:dns (There was a problem with a DNS query) (DNS problem: SERVFAIL looking up CAA for domain.tld - the domain's nameservers may be malfunctioning)This usually occurs when the DNS for the domain is pointed to the server but is not properly configured.
Steps to Resolve the Issue
| Step | Description |
|---|---|
| 1 | Log into your server via SSH with root or sudo privileges. |
| 2 | Run the following command to add a DNS zone for the primary domain: |
|
|
| 3 | Replace $DOMAIN with your domain name and $IP with the desired IP address. |
| 4 | Verify that the DNS zone has been created and is configured correctly. |
| 5 | Re-run the checkallsslcerts script to ensure the error is resolved. |
Linux CLI Command for Adding DNS Zone
To add a DNS zone, use the following command:
/scripts/adddns --domain yourdomain.com --ip 192.0.2.1Gotchas to Avoid
- DNS Propagation: Changes to DNS settings may take time to propagate. Be patient and check back after a few minutes.
- Domain Ownership: Ensure you have the necessary permissions to modify DNS settings for the domain in question.
- Server Configuration: Verify that your server's nameservers are functioning correctly before making changes.
Resolving the "400 urn:ietf:params:acme:error:dns" error is crucial for successfully validating SSL certificates. By following the steps outlined in this article, you can configure your DNS settings correctly and eliminate this error. Always ensure proper DNS management practices to maintain your server's integrity.
