Could not obtain certificates. Time limit exceeded

[happysalada]

Hi, I am using the Cloudflare dns provider and I keep on getting this error

nable to obtain ACME certificate for domains \\\"mydomain.com,*.mydomain.com\\\" : unable to generate a certificate for the domains [mydomain.com *.mydomain.com]: acme: Error -> One or more domains had a problem:\\n[*.mydomain.com] time limit exceeded: last error: read udp 172.18.0.7:38653->173.245.59.125:53: i/o timeout\\n[mydomain.com] time limit exceeded: last error: read udp 172.18.0.7:55889->173.245.58.211:53: i/o timeout\\n\" providerName=dns-cloudflare.acme

(of course, mydomain is replaced by my actual domain)

This sometimes works, but I get about 10 errors per hour. Not really sure what to do here

[theodoracheng]

@happysalada did you ever figure this out?

[happysalada]

no I still have intermittent failures. It's not critical so I'm just ignoring the errors

[businessbean]

I have the same problem, but with the Designate DNS provider. I think the root cause is the (most likely) unnecessary communication with the authoritative master name servers for the zone.

It happens if i run lego in the company network that forbids communication with external DNS servers. Our internal DNS servers are able to lookup also external domains. Why does lego need to talk to the zone master directly? Querying the TXT records for the acme challenge is possible using any recursive name server.

• https://github.com/go-acme/lego/blob/master/challenge/dns01/nameserver.go#L97
• https://github.com/go-acme/lego/blob/master/challenge/dns01/precheck.go#L75