Skip to content

--allow-subset-of-names does not work when CAA record present for one of the provided domains #9251

@JamesBalazs

Description

@JamesBalazs

My operating system is (include version):

Fedora 32

I installed Certbot with (snap, OS package manager, pip, certbot-auto, etc):

dnf (OS package manager)

I ran this command and it produced this output:

        certbot certonly \
        --force-renew \
        --manual \
        --manual-public-ip-logging-ok \
        --allow-subset-of-names --text \
        --non-interactive \
        --keep-until-expiring \
        --debug \
        --expand \
        --no-self-upgrade \
        --agree-tos \
        --config-dir "/mnt/efs/letsencrypt/config" \
        --work-dir "/mnt/efs/letsencrypt/work" \
        --logs-dir "/mnt/efs/letsencrypt/logs" \
        #{domains}
Traceback (most recent call last):
  File "/usr/bin/certbot", line 11, in <module>
    load_entry_point('certbot==1.14.0', 'console_scripts', 'certbot')()
  File "/usr/lib/python3.8/site-packages/certbot/main.py", line 15, in main
    return internal_main.main(cli_args)
  File "/usr/lib/python3.8/site-packages/certbot/_internal/main.py", line 1435, in main
    return config.func(config, plugins)
  File "/usr/lib/python3.8/site-packages/certbot/_internal/main.py", line 1304, in certonly
    lineage = _get_and_save_cert(le_client, config, domains, certname, lineage)
  File "/usr/lib/python3.8/site-packages/certbot/_internal/main.py", line 129, in _get_and_save_cert
    renewal.renew_cert(config, domains, le_client, lineage)
  File "/usr/lib/python3.8/site-packages/certbot/_internal/renewal.py", line 341, in renew_cert
    new_cert, new_chain, new_key, _ = le_client.obtain_certificate(domains, new_key)
  File "/usr/lib/python3.8/site-packages/certbot/_internal/client.py", line 390, in obtain_certificate
    cert, chain = self.obtain_certificate_from_csr(csr, orderr)
  File "/usr/lib/python3.8/site-packages/certbot/_internal/client.py", line 291, in obtain_certificate_from_csr
    orderr = self.acme.finalize_order(orderr, deadline,
  File "/usr/lib/python3.8/site-packages/acme/client.py", line 920, in finalize_order
    return cast(ClientV2, self.client).finalize_order(
  File "/usr/lib/python3.8/site-packages/acme/client.py", line 742, in finalize_order
    self._post(orderr.body.finalize, wrapped_csr)
  File "/usr/lib/python3.8/site-packages/acme/client.py", line 86, in _post
    return self.net.post(*args, **kwargs)
  File "/usr/lib/python3.8/site-packages/acme/client.py", line 1198, in post
    return self._post_once(*args, **kwargs)
  File "/usr/lib/python3.8/site-packages/acme/client.py", line 1211, in _post_once
    response = self._check_response(response, content_type=content_type)
  File "/usr/lib/python3.8/site-packages/acme/client.py", line 1068, in _check_response
    raise messages.Error.from_json(jobj)
acme.messages.Error: urn:ietf:params:acme:error:caa :: Certification Authority Authorization (CAA) records forbid the CA from issuing a certificate :: Error finalizing order :: Rechecking CAA for "xxxxx.xxxx.xx" and 1 more identifiers failed. Refer to sub-problems for more information

Certbot's behavior differed from what I expected because:

When using --allow-subset-of-names I expect certbot to issue a certificate for any names that do not have errors, even if some do have errors.

Instead, Certbot panics when it finds CAA records that forbid the CA from issuing a certificate for one of the names, and does not continue to issue a certificate for the rest of the names.

Metadata

Metadata

Assignees

No one assigned

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions