PDNS: Incompatibility with PowerDNS(-Admin), wrong BaseURL

[cleverer]

Hi

Opening a discussion here, since I'm not directly using lego, but rather traefik. I can gladly open a GitHub Issue if necessary.

It seems that version v4.9.1 introduced a bug (which I have noticed before i believe). I'm using powerdns-admin to manage my powerdns installation and manage multiple powerdns api keys (powerdns-admin acts as a proxy).

I did not change anything on the PowerDNS installation, but when upgrading traefik from v2.9.5 to v2.9.6 the auto-renewal of the certs broke. According to the release notes and git commits, traefik updated lego from v4.9.0 to v4.9.1 in that release.

This now leads to Traefik trying to do a dns challenge on the wrong PDNS API url. Instead of using a correct url like https://<domain>/api/v1/servers/localhost/zones… it misses the /api/v1 part (eg. https://<domain>/servers/localhost/zones…). This is with the PDNS_API_URL=https://<domain>

When I set the PDNS_API_URL=https://<domain>/api/v1, lego doubles the /api/v1 part resulting urls like this: https://<domain>/api/v1/api/v1/servers/localhost/zones…

Is anyone else experiencing this problem? Any idea how to solve this?

[ldez]

Hello,

do you have a wildcard CNAME?

[cleverer]

Yes, I actually do for one subdomain.

However, I'm getting the same error message for all subdomains:

They all look like this:
time="2023-02-05T22:37:12Z" level=error msg="Error renewing certificate from LE: {foo.bar.tld []}" providerName=letsencrypt.acme error="error: one or more domains had a problem:\n[foo.bar.tld] [foo.bar.tld] acme: error presenting token: pdns: unexpected HTTP status code 404 when GETing 'https://powerdns.bar.tld/servers/localhost/zones/bar.tld.'\n" ACME CA="https://acme-v02.api.letsencrypt.org/directory"

[ldez]

can you try to set the env var LEGO_DISABLE_CNAME_SUPPORT to true?

[cleverer]

Tried that, still the same error.

[ldez]

Maybe it's related to that #1780

there is no change between v4.9.0 and v4.9.1 about powerDNS v4.9.0...v4.9.1

and there is no change with PDNS_API_URL for 2 years.

[cleverer]

hm it most probably has to do with #1780, as mentioned by @ldez. I updated to traefik v2.9.7 (which updates go-acme/lego to v4.10.0) and it seems to be working now.

From my limited go knowledge it should not have changed anything, but hey it works 🤷‍♂️

Thanks @ldez for the support!

[rptaylor]

Having the same problem but it is not fixed in 2.9.8
traefik/traefik#9726