propagation: time limit exceeded: last error: DNS call error

[ook]

Hi, as follow up to #2259 , here the next step:

Now Gandi timeout set at 120s, it seems to go forward, but still fails while checking propagation, it seems still related to a timeout linked to Gandi again. The gandi dns record reference (here ns-38-c.gandi.net) change at each iteration.

time="2024-09-04T15:13:14Z" level=debug msg="Adding route for mysub.mydomain.tld with TLS options default" entryPointName=websecure
time="2024-09-04T15:13:14Z" level=debug msg="Trying to challenge certificate for domain [mysub.mydomain.tld] found in HostSNI rule" providerName=legandi.acme ACME CA="https://acme-v02.api.letsencrypt.org/directory" rule="Host(`mysub.mydomain.tld`)" routerName=default-zerobin-6ed46bcdee1a52127ed8@kubernetescrd
time="2024-09-04T15:13:14Z" level=debug msg="Looking for provided certificate(s) to validate [\"mysub.mydomain.tld\"]..." routerName=default-zerobin-6ed46bcdee1a52127ed8@kubernetescrd providerName=legandi.acme ACME CA="https://acme-v02.api.letsencrypt.org/directory" rule="Host(`mysub.mydomain.tld`)"
time="2024-09-04T15:13:14Z" level=debug msg="Domains [\"mysub.mydomain.tld\"] need ACME certificates generation for domains \"mysub.mydomain.tld\"." rule="Host(`mysub.mydomain.tld`)" routerName=default-zerobin-6ed46bcdee1a52127ed8@kubernetescrd providerName=legandi.acme ACME CA="https://acme-v02.api.letsencrypt.org/directory"
time="2024-09-04T15:13:14Z" level=debug msg="Loading ACME certificates [mysub.mydomain.tld]..." providerName=legandi.acme ACME CA="https://acme-v02.api.letsencrypt.org/directory" rule="Host(`mysub.mydomain.tld`)" routerName=default-zerobin-6ed46bcdee1a52127ed8@kubernetescrd
time="2024-09-04T15:13:24Z" level=debug msg="legolog: [INFO] [mysub.mydomain.tld] acme: Obtaining bundled SAN certificate"
time="2024-09-04T15:13:25Z" level=debug msg="legolog: [INFO] [mysub.mydomain.tld] AuthURL: https://acme-v02.api.letsencrypt.org/acme/authz-v3/399283564976"
time="2024-09-04T15:13:25Z" level=debug msg="legolog: [INFO] [mysub.mydomain.tld] acme: Could not find solver for: tls-alpn-01"
time="2024-09-04T15:13:25Z" level=debug msg="legolog: [INFO] [mysub.mydomain.tld] acme: Could not find solver for: http-01"
time="2024-09-04T15:13:25Z" level=debug msg="legolog: [INFO] [mysub.mydomain.tld] acme: use dns-01 solver"
time="2024-09-04T15:13:25Z" level=debug msg="legolog: [INFO] [mysub.mydomain.tld] acme: Preparing to solve DNS-01"
time="2024-09-04T15:13:35Z" level=debug msg="legolog: [INFO] [mysub.mydomain.tld] acme: Trying to solve DNS-01"
time="2024-09-04T15:13:35Z" level=debug msg="legolog: [INFO] [mysub.mydomain.tld] acme: Checking DNS record propagation. [nameservers=173.246.100.15:53]"
time="2024-09-04T15:14:05Z" level=debug msg="legolog: [INFO] [mysub.mydomain.tld] acme: Waiting for DNS record propagation."
<snip>
time="2024-09-04T15:15:35Z" level=debug msg="legolog: [INFO] [mysub.mydomain.tld] acme: Waiting for DNS record propagation."
time="2024-09-04T15:33:42Z" level=debug msg="Adding route for mysub.mydomain.tld with TLS options default" entryPointName=websecure
time="2024-09-04T15:33:42Z" level=debug msg="Trying to challenge certificate for domain [mysub.mydomain.tld] found in HostSNI rule" routerName=default-zerobin-6ed46bcdee1a52127ed8@kubernetescrd rule="Host(`mysub.mydomain.tld`)" providerName=legandi.acme ACME CA="https://acme-v02.api.letsencrypt.org/directory"
time="2024-09-04T15:33:42Z" level=debug msg="Looking for provided certificate(s) to validate [\"mysub.mydomain.tld\"]..." ACME CA="https://acme-v02.api.letsencrypt.org/directory" routerName=default-zerobin-6ed46bcdee1a52127ed8@kubernetescrd rule="Host(`mysub.mydomain.tld`)" providerName=legandi.acme
time="2024-09-04T15:33:42Z" level=debug msg="No ACME certificate generation required for domains [\"mysub.mydomain.tld\"]." providerName=legandi.acme ACME CA="https://acme-v02.api.letsencrypt.org/directory" routerName=default-zerobin-6ed46bcdee1a52127ed8@kubernetescrd rule="Host(`mysub.mydomain.tld`)"
time="2024-09-04T15:33:56Z" level=debug msg="legolog: [INFO] [mysub.mydomain.tld] acme: Cleaning DNS-01 challenge"
time="2024-09-04T15:34:17Z" level=error msg="Unable to obtain ACME certificate for domains \"mysub.mydomain.tld\": unable to generate a certificate for the domains [mysub.mydomain.tld]: error: one or more domains had a problem:\n[mysub.mydomain.tld] propagation: time limit exceeded: last error: DNS call error: dial udp: lookup ns-38-c.gandi.net.: i/o timeout [ns=ns-38-c.gandi.net.:53, question='_acme-challenge.mysub.mydomain.tld. IN  TXT']\n" providerName=legandi.acme ACME CA="https://acme-v02.api.letsencrypt.org/directory" rule="Host(`mysub.mydomain.tld`)" routerName=default-zerobin-6ed46bcdee1a52127ed8@kubernetescrd

I even set the acme resolver to a Gandi DNS, no luck.

Any advise?

Thank you.

[ldez]

DNS call error: dial udp: lookup ns-38-c.gandi.net.: i/o timeout [ns=ns-38-c.gandi.net.:53, question='_acme-challenge.mysub.mydomain.tld. IN TXT']

During the propagation, lego checks the TXT record propagation to name servers (NS) of your domain.
The timeout happens because one (at least) of the NS (ns-38-c.gandi.net.) didn't answer in time at a DNS call to get the TXT records.

So the problem is with Gandi NSs, either one (at least) is not working or one (at least) is in difficulties (and so very slow).

[ook]

Damn, you never sleep! Thank you again @ldez , it looks like Gandi QoS is awnful for a whole year at least. I mark this as answer, and I’ll give up on Gandi as DNS challenge resolver for now.

Thank you again for your impressives prompt responses.

[ldez]

You can sustain my "impressives prompt responses" 😄 by giving me a tip https://github.com/sponsors/ldez

[ook]

You’re right. That’s only a sandwich this time, but eh, that’s my first on Github ^^