panic: runtime error by CNAME validation

[hrolofs]

Hi related to my post

#1792

I try to use an CNAME entry for the DNS validation. I have a domain1.dedyn.io and a domain2.dedyn.io. On domain1 is a CNAME entry _acme-challenge that points to domain2.dedyn.io.

Like i understood the validation for domain1.dedyn.io will be done on domain2.dedyn.io by creating a TXT record.

If i try to request a certificate for domain1.dedyn.io i got this error:

2022/12/29 18:54:52 [INFO] [domain1.dedyn.io] acme: Obtaining bundled SAN certificate
2022/12/29 18:54:52 [INFO] [domain1.dedyn.io] AuthURL: https://acme-staging-v02.api.letsencrypt.org/acme/authz-v3/4777392893
2022/12/29 18:54:52 [INFO] [domain1.dedyn.io] acme: Could not find solver for: tls-alpn-01
2022/12/29 18:54:52 [INFO] [domain1.dedyn.io] acme: Could not find solver for: http-01
2022/12/29 18:54:52 [INFO] [domain1.dedyn.io] acme: use dns-01 solver
2022/12/29 18:54:52 [INFO] [domain1.dedyn.io] acme: Preparing to solve DNS-01
2022/12/29 18:54:52 [INFO] Found CNAME entry for "_acme-challenge.domain1.dedyn.io.": "domain2.dedyn.io."
panic: runtime error: slice bounds out of range [:-1]

goroutine 1 [running]:
github.com/go-acme/lego/v4/providers/dns/desec.getRecordName(...)
        github.com/go-acme/lego/v4/providers/dns/desec/desec.go:184
github.com/go-acme/lego/v4/providers/dns/desec.(*DNSProvider).Present(0xccf08b8, {0xcf562d0, 0x13}, {0xcf083f0, 0x2b}, {0xcce45a0, 0x57})
        github.com/go-acme/lego/v4/providers/dns/desec/desec.go:112 +0x80a
github.com/go-acme/lego/v4/challenge/dns01.(*Challenge).PreSolve(0xced43e0, {{0xd141253, 0x7}, {0x0, 0xedb4905ec, 0x0}, {{0xd141250, 0x3}, {0xcf562d0, 0x13}}, ...})
        github.com/go-acme/lego/v4/challenge/dns01/dns_challenge.go:94 +0x28b
github.com/go-acme/lego/v4/challenge/resolver.parallelSolve({0xccf1188, 0x1, 0x2}, 0xced49c0)
        github.com/go-acme/lego/v4/challenge/resolver/prober.go:135 +0xb2
github.com/go-acme/lego/v4/challenge/resolver.(*Prober).Solve(0xccf0640, {0xd053000, 0x1, 0x1})
        github.com/go-acme/lego/v4/challenge/resolver/prober.go:84 +0x96
github.com/go-acme/lego/v4/certificate.(*Certifier).Obtain(0xced41a0, {{0xccf1208, 0x1, 0x1}, 0x1, {0x0, 0x0}, 0x0, {0x0, 0x0}, ...})
        github.com/go-acme/lego/v4/certificate/certificates.go:132 +0x386
github.com/go-acme/lego/v4/cmd.obtainCertificate(0xced4100, 0xcd19d00)
        github.com/go-acme/lego/v4/cmd/cmd_run.go:176 +0x2d7
github.com/go-acme/lego/v4/cmd.run(0xced4100)
        github.com/go-acme/lego/v4/cmd/cmd_run.go:92 +0x29b
github.com/urfave/cli/v2.(*Command).Run(0xcc02b40, 0xd14df80)
        github.com/urfave/cli/v2@v2.14.0/command.go:173 +0x695
github.com/urfave/cli/v2.(*App).RunContext(0xccb5dc0, {0xa35f340, 0xcc48080}, {0xcc44150, 0xe, 0xe})
        github.com/urfave/cli/v2@v2.14.0/app.go:384 +0xffb
github.com/urfave/cli/v2.(*App).Run(...)
        github.com/urfave/cli/v2@v2.14.0/app.go:253
main.main()
        ./main.go:42 +0x21b
``

Any idea what im making wrong?

Its no problem to request a certificate for domain2.dedyn.io, that means the token that im using are works for domain2.

Regards, Henry

[hrolofs]

I figured out the problem. It was the CNAME entry on domain1
( CNAME entry _acme-challenge that points to domain2.dedyn.io.)

It needs to point to a "subname" of domain2 and not to the domain2 itself

CNAME entry on domain1 _acme-challenge that points to whatever.domain2.dedyn.io.

if i want to validate different domains, i have to use unique CNAMES otherwisei got sometimes error "Incorrect TXT record"

validate domain1 and domain2 with domain3

domain1
CNAME: _acme-challenge.domain1. => _acme-challenge_domain1.domain3.

domain2
CNAME: _acme-challenge.domain2. => _acme-challenge_domain2.domain3.

Regards, Henry