From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <pbs-devel-bounces@lists.proxmox.com>
Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68])
	by lore.proxmox.com (Postfix) with ESMTPS id 12D761FF15D
	for <inbox@lore.proxmox.com>; Thu, 19 Sep 2024 15:29:30 +0200 (CEST)
Received: from firstgate.proxmox.com (localhost [127.0.0.1])
	by firstgate.proxmox.com (Proxmox) with ESMTP id 9B1211688E;
	Thu, 19 Sep 2024 15:29:38 +0200 (CEST)
Message-ID: <f6cf436a-0a9d-41a5-8de0-a19adae9bdea@proxmox.com>
Date: Thu, 19 Sep 2024 15:29:33 +0200
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
From: Christian Ebner <c.ebner@proxmox.com>
To: Proxmox Backup Server development discussion
 <pbs-devel@lists.proxmox.com>, Gabriel Goller <g.goller@proxmox.com>
References: <20240918120641.308844-1-g.goller@proxmox.com>
 <a2fd54a6-e820-4de8-a88a-1493a4031cba@proxmox.com>
 <f82bd095-6d74-4798-a080-c8c5e7178c62@proxmox.com>
Content-Language: en-US, de-DE
In-Reply-To: <f82bd095-6d74-4798-a080-c8c5e7178c62@proxmox.com>
X-SPAM-LEVEL: Spam detection results:  0
 AWL 0.024 Adjusted score from AWL reputation of From: address
 BAYES_00                 -1.9 Bayes spam probability is 0 to 1%
 DMARC_MISSING             0.1 Missing DMARC policy
 KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment
 SPF_HELO_NONE           0.001 SPF: HELO does not publish an SPF Record
 SPF_PASS               -0.001 SPF: sender matches SPF record
Subject: Re: [pbs-devel] [PATCH proxmox-backup v2] config: check if acme
 domain with wildcard uses dns challenge
X-BeenThere: pbs-devel@lists.proxmox.com
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Proxmox Backup Server development discussion
 <pbs-devel.lists.proxmox.com>
List-Unsubscribe: <https://lists.proxmox.com/cgi-bin/mailman/options/pbs-devel>, 
 <mailto:pbs-devel-request@lists.proxmox.com?subject=unsubscribe>
List-Archive: <http://lists.proxmox.com/pipermail/pbs-devel/>
List-Post: <mailto:pbs-devel@lists.proxmox.com>
List-Help: <mailto:pbs-devel-request@lists.proxmox.com?subject=help>
List-Subscribe: <https://lists.proxmox.com/cgi-bin/mailman/listinfo/pbs-devel>, 
 <mailto:pbs-devel-request@lists.proxmox.com?subject=subscribe>
Reply-To: Proxmox Backup Server development discussion
 <pbs-devel@lists.proxmox.com>
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset="us-ascii"; Format="flowed"
Errors-To: pbs-devel-bounces@lists.proxmox.com
Sender: "pbs-devel" <pbs-devel-bounces@lists.proxmox.com>

On 9/19/24 15:07, Christian Ebner wrote:
> Just tested again, with an DNS api token which has full zone access, but 
> still get a `failed - status: Invalid` so something might still not be 
> right here. The TXT record is published with name 
> `_acme-challenge.*.domain.tld` when trying for `*.domain.tld` so that 
> should be fine?

No, it should be named `_acme-challenge.domain.tld` according to the 
article [0] linked to by [1] so that is why it does not get validated.

[0] 
https://www.eff.org/deeplinks/2018/02/technical-deep-dive-securing-automation-acme-dns-challenge-validation
[1] https://letsencrypt.org/docs/challenge-types/#dns-01-challenge


_______________________________________________
pbs-devel mailing list
pbs-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pbs-devel