Issue [Let's Encrypt] Cannot renew the certs of wildcard domains which DNS are managed by CloudFlare.

[Brownsugar]

This problem has affected me for a long time.
I have some domains that use the DNS managed by CloudFlare, so Let's Encrypt extension can't modify the TXT record when renewing the wildcard certs.
Any solution for this? Thanks.

 

[gOOvER]

I have the same Problem. Plesk is not able to renew Certs when Cloudflare is activated

 

[SteveC]

Same issue with us

 

[killmoon]

This problem has affected me for a long time.
I have some domains that use the DNS managed by CloudFlare, so Let's Encrypt extension can't modify the TXT record when renewing the wildcard certs.
Any solution for this? Thanks.

Some Plesk services cannot work if DNS is not managed locally, like the local mail system with SpamAssassin, etc...

For Let's Encrypt there is a setting to switch from ACME protocol version 2 back to version 1 (Documented here: Managing Let’s Encrypt Settings at the end of the page).

Basically you can set "acme-protocol-version" to "acme-v01" in panel.ini and Let's Encrypt will use the old challenge that uses a file in a vhost directory instead a TXT value in the DNS.

Unfortunately ACME v1 does not support wildcard domains. But maybe it could be a workaround for your situation.


Until a few months ago was possible to use Plesk Let's Encrypt with wildcard support (ACME v2) and CloudFlare via the so called CNAME flattening, but then CloudFlare decided to remove the CNAME flattening from free accounts, forcing users to use CloudFlare DNS instead the local one with CNAME to cache only the "www" or other subdomain.

 

[Brownsugar]

I hope there will be a feature to connect Plesk with CloudFlare, let Plesk able to directly change the DNS record via CF api.

 

[mr-wolf]

When you create an NS-record for acme-challenge.<domain> which you point to the Plesk server then Plesk is able to change the TXT-record for that domain.

I have no Cloudflare, but I do have a separate DNS-server for all my domains and have this setup working for a year now.
You do need to run Plesk's DNS service on the webserver, though.
It then only manages the acme-challenge.<domain>.

I don't know how Letsencrypt handles the A-record not pointing to the Plesk-server. Maybe it doesn't check for that when using Cloudflare.

Question - Wildcard SSL Certificates with DNS API how?!

Hello, since Plesk cannot use Wildcard SSL certs via Webinterface WITHOUT using own nameserver , I need a solution... I can generate valide wildcard certs with acme.sh and an external nameserver which supports dns api. But the renewal is a pain in the ***... I have to assign the new cert to...

talk.plesk.com

 

[Brownsugar]

When you create an NS-record for acme-challenge.<domain> which you point to the Plesk server then Plesk is able to change the TXT-record for that domain.

I have no Cloudflare, but I do have a separate DNS-server for all my domains and have this setup working for a year now.
You do need to run Plesk's DNS service on the webserver, though.
It then only manages the acme-challenge.<domain>.

I don't know how Letsencrypt handles the A-record not pointing to the Plesk-server. Maybe it doesn't check for that when using Cloudflare.

Question - Wildcard SSL Certificates with DNS API how?!

Hello, since Plesk cannot use Wildcard SSL certs via Webinterface WITHOUT using own nameserver , I need a solution... I can generate valide wildcard certs with acme.sh and an external nameserver which supports dns api. But the renewal is a pain in the ***... I have to assign the new cert to...

talk.plesk.com

This works. This should be noted in the extension description.

Just add a NS record in CloudFlare (remember to delete existing "_acme-challenge" TXT record first), then solve the problem.

 

[sweetp]

This works. This should be noted in the extension description.

Just add a NS record in CloudFlare (remember to delete existing "_acme-challenge" TXT record first), then solve the problem.
View attachment 19123

this isn't working for me...

 

[mow]

I don't know how Letsencrypt handles the A-record not pointing to the Plesk-server. Maybe it doesn't check for that when using Cloudflare.

It doesn't need to check the host when using dns-based verification. Control of DNS trumps control of host when it comes to proving ownership of the domain.

 

[twebhosting]

This is already old thread, but the issue is still present for many users who land here.
There is a very detailed solution, step by step guide for Plesk (2024), at Plesk Let's Encrypt Wildcard SSL Certificate Cloudflare DNS