I am encountering an issue generating and renewing Let's Encrypt certificates that specifically only manifests when using slave DNS servers with Virtualmin (as in the 'DNS Slave Auto-configuration" document found at https://www.virtualmin.com/documentation/dns/slave-configuration).
Right now I have a cluster of 4 production Web servers, one of which runs Virtualmin and acts as the primary BIND DNS server, and the other 3 run Webmin and act as slave DNS servers. All three slaves are set up in the Webmin Servers Index module and they are also set up as cluster slave servers in the BIND DNS module. They are all working properly, responding to requests for records, etc.; no issues exist with the master or slave zones and when I edit a DNS record in Virtualmin it is quickly deployed to all the slaves without issue. Also, all slaves can request transfers from the other slaves and the master without issue as well.
But it's not all sunshine and roses, as Let's Encrypt certificates fail to be generated or renewed after I set up slave DNS servers, but the output gives no indication as to what could be wrong. For reference, I have a development/staging server that runs Virtualmin and BIND, and does not have any slave servers, and Let's Encrypt works just fine by way of the DNS challenge type on that server.
All servers are running CentOS Linux 7.7, Virtualmin 6.08 Pro (or Webmin 1.932 in the case of the DNS slaves), and the most recent versions of BIND and Certbot available for my platform. Here is the output from one of my renewal attempts earlier this evening:
Requesting SSL certificate for je-marketingsolutions.com www.je-marketingsolutions.com je-digitalmarketing.com www.je-digitalmarketing.com .. .. failed : DNS-based validation failed : Saving debug log to /var/log/letsencrypt/letsencrypt.log Plugins selected: Authenticator manual, Installer None Starting new HTTPS connection (1): acme-v02.api.letsencrypt.org Obtaining a new certificate Performing the following challenges: dns-01 challenge for www.je-digitalmarketing.com Running manual-auth-hook command: /etc/webmin/webmin/letsencrypt-dns.pl Waiting for verification... Challenge failed for domain www.je-digitalmarketing.com dns-01 challenge for www.je-digitalmarketing.com Cleaning up challenges Running manual-cleanup-hook command: /etc/webmin/webmin/letsencrypt-cleanup.pl Some challenges have failed. IMPORTANT NOTES: - The following errors were reported by the server:
Any assistance in this matter would be greatly appreciated. I've set Virtualmin to automatically attempt to renew SSL certificates one month before they are set to expire (so 2 months into the 3-month Let's Encrypt certificate lifetime), so my sites are in no immediate danger of becoming insecure, but there does exist the possibility of launching a new site that can now no longer be secured because of this issue.