Add 'wait time before validate' after creating dns record - #50
Open
BasConijn wants to merge 4 commits into
Open
Conversation
…ight after the dns records is created
n3wt0n
reviewed
Jul 6, 2023
Co-authored-by: Davide Benvegnù aka CoderDave <davide.benvegnu@outlook.com>
Author
|
I used a TimeSpan because the TimeBeforeExpiryToRenew was also a TimeSpan. |
kaskamal
added a commit
to campusnutrition/campusnutrition-sslmanager
that referenced
this pull request
Aug 1, 2023
n3wt0n
approved these changes
Aug 16, 2023
TomTyack
added a commit
to TomTyack/AzureWebAppSSLManager
that referenced
this pull request
Aug 25, 2026
- NeedsNewCertificateAsync() filtered existing certs by issuer containing "Let's Encrypt Authority" (the pre-2021 intermediate name). Current certs are issued by R11/R12/R13/YR1 etc., so the filter never matched, existingCert was always null, and the tool requested a brand-new certificate on every scheduled run instead of honoring TimeBeforeExpiryToRenew. Upstream's own fix for this (n3wt0n#30) just hardcoded "R3" instead, which is equally stale today. Dropped the issuer filter entirely - ExistingCertificates is already scoped to the target hostname. - GetCertificateAsync() called dnsChallenge.Validate() immediately after creating the DNS TXT record, before Azure DNS had time to propagate it. A premature check fails the challenge and flips the authorization out of "pending", so the retry loop's subsequent Validate() calls error with "authorization must be pending" instead of actually retrying. Matches upstream issue n3wt0n#48/n3wt0n#50. Added a configurable delay (default 15s, WaitTimeBeforeValidateInSeconds) before the first validation attempt.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
At out company we had some issues that the certificates were no longer renewed.
After some trail and error I reduced the problem to creating the TXT record and LetsEncrypt using this value.
Without any delay the you will receive an AcmeException from the Validate function. Because of the exception the retry logic 90 seconds does not work either.