From 2019 I have working some auto certificates renewal.
I’m starting receiving Let’s Encrypt certificate expiration notices by email but none “Let’s Encrypt certificate renewal compete” anymore.
Trying to do it manually from Server Configuration → SSL Certificate → Let’s Encrypt I got errors like those:
Detail: DNS problem: NXDOMAIN looking up TXT for
_acme-challenge.mail.domain.com - check that a DNS record
exists for this domain
I never had to add those DNS records to get the certs renewed.
It seems the issue is only for domains having a login default page.
This cert I want to renew has 4 domains, two with login default pages, the 2 displaying errors (sql* and mail*)
Anyway I have other certs that don’t renew automatically now but they do successfully manually
Thanks
EDIT 1: I was able to create separate certs for each of both subdomains
This TXT record fix has worked for me before under various circumstances with and without Virtualmin being involved. I’ve never noticed a pattern as to why it’s sometimes necessary although I’ve never really looked into it as closely as you have. I hope a lot of people see and take note of your post if they see this particular error.
Sorry, I thought you already fixed it and I completely forgot about the token.
I was using certbot for wildcards when I first had this problem. I’ve also seen it using Virtualmin’s LE plugin. Apparently this article helped out with certbot, but I’m fairly certain I was using Virtualmin when I found the token buried somewhere in a mess of errors.
According to my notes a portion of the fail error looked like this:
Domain: domain.tld
Type: unauthorized
Detail: Incorrect TXT record
"43-character_token_was_here_xxxxxxxxxxxxxxx" found at _acme-challenge.domain.tld
Despite the wording in the error, I think the token in this example is actually the correct one to use for the record value, and it’s the TXT record itself that’s missing and therefore “incorrect”. If I’m wrong about that then it’s time to update my crappy notes.
As for auto-renewals not working, there’s chatter about that lately and there may be a fix in the works. I noticed it too but manual renewals are working.