I have provisioned an SSL certificate to be obtained from Let's Encrypt. I have manually entered the ACME challenge as records on the name server. Unfortunately, as the expiration date is now within thirty days, the cron task is failing to renew automatically. Below is the output generated by the cron task. As seen, it is failing to utilize the existing DNS records for approval in the ACME challenge. Domain Subject:【*.mydomain.xyz】There is a Wildcard Domain Name, and only the DNS Verification Method can be Used for Renewal! Domain Subject:【*.mydomain.xyz】is not found the dns-api info, try to apply, please wait... Domain Subject:【*.mydomain.xyz】try to apply result: auth info is not support or not found... if(window.hljsLoader && !document.currentScript.parentNode.hasAttribute('data-s9e-livepreview-onupdate')) { window.hljsLoader.highlightBlocks(document.currentScript.parentNode); } How can I accomplish automated renewal of the certificates?

aaPanel_Kern Manual renewal also fails. A message is show as... Error: The wildcard domain name can only be verified by DNS. if(window.hljsLoader && !document.currentScript.parentNode.hasAttribute('data-s9e-livepreview-onupdate')) { window.hljsLoader.highlightBlocks(document.currentScript.parentNode); } It seems manual entry has many problems. Is any workaround available, at least to renew successfully, even if it is not by automation through the cron job?

Auto SSL renewal failing for wildcard certificate with manual records in DNS

aaPanel_Kern

Hello, automatic renewal of SSL uses DNS verification, only supports adding records using DNS API

brainchild

aaPanel_Kern

Is there any particular reason that automation is not allowed for certificates using manual entry of challenge keys in the name server?

aaPanel_Kern

Are you talking about DNS manager?
Currently only DNS API is available

brainchild

aaPanel_Kern

Manual entry is also allowed (i.e. no API).

aaPanel_Kern

Manually added txt records do not support automatic renewal of SSL

brainchild

aaPanel_Kern

I am trying to understand the design of the system overall, for best maintenance of hosts, and curious to know of any reason automation is not supported for all the cases.

brainchild

aaPanel_Kern

Manual renewal also fails.

A message is show as...

Error: The wildcard domain name can only be verified by DNS.

It seems manual entry has many problems.

Is any workaround available, at least to renew successfully, even if it is not by automation through the cron job?

aaPanel_Kern

Thank you for your feedback, it is recommended that you close the SSL certificate first and then apply. We will optimize here later

brainchild

aaPanel_Kern

Do you mean that I should remove the existing certificate, and apply for a new one, with a new ACME challenge?

aaPanel_Kern

brainchild
Yes

brainchild

aaPanel_Kern

It would be best if manual renewal were possible without changing or adding records in the name server, and if similar automatic renewal were also supported through the cron job.

aaPanel_Kern

Use DNS to verify the verification method, you must add relevant txt records for verification. If you are automatically renewing SSL, please use the DNS API.

brainchild

aaPanel_Kern

For small deployments, DNS-API is not necessary or always even feasible.

It would be helpful to support renewals also for the case of the manual management of records.