Fix dns manual ssl wildcard #11642
Fix dns manual ssl wildcard #11642
Conversation
|
Adding the "do-not-merge/release-note-label-needed" label because no release-note block was detected, please follow our release note process to remove it. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
Thanks for the PR! There are some merge conflicts at the moment. Could you please resolve them and update the PR? |
This fix addresses three bugs in the DNS Manual SSL certificate flow: 1. **Order caching fails when Expires is zero**: ACME orders often have zero Expires initially. The condition `!Expires.IsZero()` caused valid cached orders to be deleted and recreated with different TXT values. Fixed by checking `Expires.IsZero() || Expires.After(now)`. 2. **Wildcard and base domain TXT records overwrite each other**: When requesting SSL for both `example.com` and `*.example.com`, both authorizations have identifier `example.com`, causing one TXT value to overwrite the other. Fixed by using `*.domain` as the map key. 3. **Only first TXT record checked**: When multiple TXT records exist, only the first was checked. Fixed by returning all TXT values and checking if expected value exists in any of them. ```release-note Fix DNS Manual SSL certificate issues for wildcard domains ``` Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
c02816c to
bccfa53
Compare
Summary
This PR fixes three bugs in the DNS Manual SSL certificate flow:
Bug 1: Order caching fails when Expires is zero
ACME orders often have zero
Expiresinitially. The condition!Expires.IsZero()caused valid cachedorders to be deleted and recreated with different TXT values, making verification fail.
Fix: Check
Expires.IsZero() || Expires.After(now)Bug 2: Wildcard and base domain TXT records overwrite each other
When requesting SSL for both
example.comand*.example.com, both authorizations have identifierexample.com, causing one TXT value to overwrite the other in the map. Users only saw 1 TXT recordinstead of 2.
Fix: Use
*.domainas the map key for wildcard authorizationsBug 3: Only first TXT record checked
When multiple TXT records exist (required for domain + wildcard), only the first DNS result was
checked. If the order of DNS responses varied, verification failed.
Fix: Return all TXT values and check if expected value exists in any of them
Test Plan