Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

DNS provider incorrectly inherited from verified domains in multi-provider setup #6092

Open
ferranbonas opened this issue Nov 11, 2024 · 1 comment

Comments

@ferranbonas
Copy link

Issue Description:
When using multiple DNS providers (e.g. GoDaddy and Cloudflare) in a single certificate request, if the first domain is already verified, its DNS provider incorrectly "cascades" to the next unverified domain.

Steps to reproduce:

  1. Have a valid cert with multiple domains using different DNS providers:

    • domain1.com using dns_gd (GoDaddy)
    • domain2.com using dns_cf (Cloudflare)
      [etc]
  2. When the cert is renewed:

    • domain1.com is marked as "verified_ok"
    • The code skips validation for domain1.com
    • But domain2.com incorrectly inherits dns_gd provider instead of using its dns_cf

Current behavior:

  • DNS provider from verified domains "cascades" to next unverified domain
  • Results in validation failures as wrong DNS provider is used

Expected behavior:

  • Each domain should maintain its own DNS provider mapping
  • Skipping verified domains should not affect DNS provider assignment for remaining domains

Suggested fixes:

  1. Maintain DNS provider mapping separately from verification state

  2. Don't increment alias_index when skipping verified domains

@acmesh-official acmesh-official deleted a comment from saudiqbal Nov 12, 2024
@acmesh-official acmesh-official deleted a comment from github-actions bot Nov 12, 2024
@Neilpang
Copy link
Member

I tried with 2 of my domains with 2 different dns providers, but it works for me as expected.

Can you please provide with --debug 2 log?

first generate a cert with 2 domains:

acme.sh --issue  -d domain1.com  --dns dns_1   -d domain2.com  --dns dns_2  

second generate a cert with the second domain only:

acme.sh --issue -d  domain2.com  --dns dns_2

It should be passing without any validation, because the domain2.com was just verified.

third deacivate the second domain, so that the second domain will be verified next time.

acme.sh --deactivae  -d domain2.com

OK, renew the first cert:

acme.sh  --renew -d domain1.com  --force  --debug 2

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants