Uuuhh. I need to do some DNS things today.
24
Replies
·
0
Boosts
DNS things: I have two certs I renew using the dns-01 challenge, because there is no http involved, and the server needing the cert is mot public facing.
I like the dns challenge, and will likely switch the rest of my infra to use it too.
But!
Up until a week or two ago, the domains the certs are for had their nameservers at Hetzner. My tooling hits the Hetzner API.
The domains are now served by my self-hosted nameserver, so I need to update things.
❯ systemctl status acme-renew-chat.csillger.hu.timer
● acme-renew-chat.csillger.hu.timer - Renew ACME Certificate for chat.csillger.hu
Loaded: loaded (/etc/systemd/system/acme-renew-chat.csillger.hu.timer; enabled; preset: ignored)
Active: active (waiting) since Wed 2026-06-17 22:56:36 CEST; 1 month 0 days ago
Invocation: 497e99b0ceef4fd99618b0382cf7b5fa
Trigger: Sat 2026-07-18 22:30:28 CEST; 12h left
Uhuhuhh! Just about in time I fix this. It'd try to renew via Hetzner, yet, my domain's on my PowerDNS now.
Lovely. switch-to-configuration appears to be stuck. Maybe I'll reboot.
Reboot helped, but... something weird is going on with PowerDNS. I have SOA-EDIT set to INCREMENT-EPOCH, but... oh. I may have to manually edit the record's SOA first, I suppose?
Nah, I need INCEPTION-INCREMENT. Tha.... seems to have done something.
Looks like PDNS is doing the right thing, I can query the challenge. For some reason it fails to propagate to the secondary.
Increasing the loglevel, I see:
Jul 18 11:22:06 eru pdns_server[6814]: Queued also-notification of domain 'csillger.hu' to 204.87.183.53:53
So it allegedly is notifying ns-global.zone, but I'm not sure that's happening?
I do see stuff like...
Jul 18 11:23:09 eru pdns_server[6814]: IXFR-out zone '174070135.xyz', client '204.87.183.53:39761', transfer initiated with serial 2026062906
But that's not the zone I want to notify about.
@algernon rfc2136 baby - sad there's nothing more modern and support is not consistent across retail providers.
Also ICYMI there's a new ACME challenge thing that's coming that should help with having to ship and manage secrets for self - registration - DNS-PERSIST I think it is
@arichtman yup, looking forward to dns-persist (or w/e it is called, I too, forgot).
