Score:0

Server

Certbot error - DNSSEC: DNSKEY Missing

Malako

7/29/24, 5:38 PM

I moved my domain to Route53 and am now getting problems with Certbot renewal. Certbot has been running great for 4 years, but is now failing to renew.

When running sudo certbot renew --apache i get this error:

   Type:   None
   Detail: DNS problem: looking up A for somedomain.com: DNSSEC:
   DNSKEY Missing; DNS problem: looking up AAAA for
   somedomain.com: DNSSEC: DNSKEY Missing

DNSSEC is not, and hasn't ever been enabled for that domain in Route53, so not sure why Certbot fails.

I am at a loss here and would really like to use Route53 instead of the old domain manager.

EDIT: It looks like DNSSEC was activated by default for .se domains in the old domain manager (Loopia).

This is what i see under Registered domains in Route 53:

Using Ubuntu/Apache/python3-certbot-apache

UPDATE: I removed the record in Route53 Registered domains, but now i'm getting this error instead:

   Detail: DNS problem: looking up A for somedomain.com: DNSSEC:
   DNSKEY Missing; DNS problem: looking up AAAA for
   somedomain.com: DNSSEC: Bogus

224

1 + 2

ubuntu

dnssec

apache-2.2

amazon-route53

certbot

Jaromanda X

7/30/24, 4:47 AM

`DNSSEC is not, and hasn't ever been enabled for that domain in Route53` - did you used to have DNSSEC set up?

Malako

7/30/24, 2:58 PM

In the old domain manager it looks like DNSSEC was enabled by default. I just did a domain transfer to Route53, copied all the DNS records and changed name servers and thought that was it. Any help is really appreciated.

Score:1

Server

Håkan Lindqvist

7/30/24, 3:26 PM

It looks like DNSSEC was activated by default for .se domains in the old domain manager (Loopia).

It sounds like you need to either remove the DS record if you don't want to have the zone signed, or otherwise sign the zone and update the DS record to reflect the current DNSKEY.

The DS record is part of the delegation (parent zone) and is managed through your registrar.

+ 5

Malako

7/30/24, 3:42 PM

I added a screenshot to the question just to make sure I am on the right track. I should delete this record right? I don't want to enable DNSSEC for now.

Håkan Lindqvist

7/30/24, 4:19 PM

@Malako Looks reasonable to me, if this is in the registrar section of Route53.

Malako

7/30/24, 7:50 PM

I deleted the record but nom i'm getting another error - question updated. Thanks a lot for your taking your time Håkan, I really appreciate it!

Håkan Lindqvist

7/30/24, 8:14 PM

@Malako That looks like the same error, no? It could just be a caching problem, but hard to tell from my end. Maybe see what dnsviz.net says?

Malako

7/31/24, 5:54 AM

Hi Håkan. For A record it's the same, for AAAA it's different. I will try again this evening.

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: Certbot error - DNSSEC: DNSKEY Missing

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.