Issue wildcard SSL/TLS certificate from Let's Encrypt issue - txt has to be updated

[fabieng]

Hello
I have a problem with wildcard renewals. Plesk is requesting new TXT record when we try to renew the certificate (or maybe to each 2/3 renewals, not sure about it). So this is blocking at some point the automatic renewals. I have to go on domain, modify the txt entry, and then re issue on plesk the certificate.
how can we bypass it ?! this is a real loss of time when we have various domains to manage.
Do we have any trick to avoid that ?!
thx for your lights !

 

[Kaspar]

Let’s Encrypt wildcard certificates require verification trough a DNS TXT record. There is no other verification methode available if you require a wildcard certificate.

If you manage your DNS externally (and it seems like you do) than this posses a bit of a challenge. Because, as you've discovered, every time a wildcard certificate has to be renewed you'll have to manually update the DNS. However, Plesk adds/updates the required TXT record to the local DNS zone of the domain. So you could consider using Plesk as the authoritative DNS for the domain. Or synchronizing the local DNS zone with your external DNS.

 

[fabieng]

ok this is what I was afraid. I do not want to use plesk as authoritative DNS as centralizing to many services on a single point is not safe and consuming ressources which should be allowed to web applications.
I did not see that we can sync local dns with external DNS, how can we manage that ? external remains as primary, and we only "push" from plesk the dns entries ?

 

[mow]

That depends entirely on the provider and what kind of API they offer.

 

[fabieng]

ok so no other option to upodate the txt manually bad luck.

 

[Kaspar]

It all depends on what options your external DNS provider offers to synchronize. Could be an API or other protocol (such as AXFR transfers).

There are several Plesk Extensions available for seamless integration with major Cloud providers. Such as AWS Route 53, DigitalOcean DNS and Microsoft Azure DNS. There is also an Extensions for DNS providers who support Domain Connect. And the Plesk Slave DNS Manager for synchronizing your own secondary name servers on Linux servers.

 

[nkomarov]

I wish there were a warning when the wildcard checkbox is checked, saying "think twice because you will have to renew the certificate manually". I actually thought I will have to do it manually anyway. It's good to know I could uncheck it and make it easier but I wish I discovered it not here but on the settings panel.

 

[mow]

I wish there were a warning when the wildcard checkbox is checked, saying "think twice because you will have to renew the certificate manually".

rather "To renew automatically, Plesk needs to be the authoritative name server" or something

 

[nkomarov]

Yes, or something like that. For me it's "wildcard on - go confirm manually every 3 months, wildcard off - fully automatic". Always checked "wildcard" and had no idea it makes so much difference.