<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Hi,<div class=""><br class=""></div><div class="">Not sure how it will look in plain text, so for nice formatting check <a href="https://bbs.archlinux.org/viewtopic.php?id=240847" class="">https://bbs.archlinux.org/viewtopic.php?id=240847</a></div><div class=""><br class=""></div><div class="">Here it goes:</div><div class=""><br class="">I'm trying to set up automatic wildcard Let's Encrypt certificate renewal using PowerDNS and certbot.<br class="">I've followed these guides/resources:<br class="">- <a href="https://doc.powerdns.com/authoritative/" class="">https://doc.powerdns.com/authoritative/</a> … w-it-works<br class="">- <a href="https://wiki.archlinux.org/index.php/Certbot" class="">https://wiki.archlinux.org/index.php/Certbot</a><br class="">- https://certbot-dns-rfc2136.readthedocs.io/en/latest/<br class="">What I did:<br class="">mysql -h localhost -u powerdns -pmypass powerdns -e "select * from tsigkeys"<br class=""><div class="">+----+--------+-------------+----------+</div><div class="">| id | name | algorithm | secret |</div><div class="">+----+--------+-------------+----------+</div><div class="">| 1 | cerbot | hmac-sha512 | mysecret |</div><div class="">+----+--------+-------------+----------+</div><br class="">mysql -h localhost -u powerdns -pmypass powerdns -e "select * from domainmetadata"<br class=""><div class="">+----+-----------+----------------------+-----------+</div><div class="">| id | domain_id | kind | content |</div><div class="">+----+-----------+----------------------+-----------+</div><div class="">| 1 | 1 | ALLOW-AXFR-FROM | AUTO-NS |</div><div class="">| 2 | 1 | TSIG-ALLOW-AXFR | certbot |</div><div class="">| 3 | 1 | ALLOW-DNSUPDATE-FROM | 0.0.0.0/0 |</div><div class="">| 4 | 1 | TSIG-ALLOW-DNSUPDATE | certbot |</div><div class="">| 5 | 1 | NOTIFY-DNSUPDATE | 1 |</div><div class="">+----+-----------+----------------------+-----------+</div><br class="">Testing it with:<br class=""><div class="">nsupdate -y hmac-sha512:certbot:secret</div><div class="">> server 127.0.0.1</div><div class="">> zone myzone.com</div><div class="">> update add _test.mysite.com. 60 IN TXT "test"</div><div class="">> send</div><div class="">; TSIG error with server: expected a TSIG or SIG(0)</div><div class="">update failed: REFUSED</div><div class="">> quit</div><br class="">PowerDNS log says:<br class="">Packet for domain 'mysite.com' denied: can't find TSIG key with name 'certbot' and algorithm 'hmac-sha512'<br class="">If any other info is needed, let me know.</div><div class=""><br class="">Thanks</div></body></html>