Duck DNS addon throws an error during challenge validation while starting

Configuration
1

Hi,

I have been trying to setup up Duck DNS with let’s encrypt to remotely access my home assistant without luck today.

Starting the Duck DNS add on throws an error during token validation:

# INFO: Using main config file /data/workdir/config
+ Account already registered!
[19:29:49] WARNING: 
# INFO: Using main config file /data/workdir/config
Processing xxx.duckdns.org
 + Signing domains...
 + Generating private key...
 + Generating signing request...
 + Requesting new certificate order from CA...
 + Received 1 authorizations URLs from the CA
 + Handling authorization for xxx.duckdns.org
 + 1 pending challenge(s)
 + Deploying challenge tokens...
OK + Responding to challenge for xxx.duckdns.org authorization...
 + Cleaning challenge tokens...
OK + Challenge validation has failed :(
ERROR: Challenge is invalid! (returned: invalid) (result: {
  "type": "dns-01",
  "status": "invalid",
  "error": {
    "type": "urn:ietf:params:acme:error:dns",
    "detail": "DNS problem: SERVFAIL looking up TXT for _acme-challenge.xxx.duckdns.org - the domain's nameservers may be malfunctioning",
    "status": 400
  },
  "url": "https://acme-v02.api.letsencrypt.org/acme/chall-v3/3879570269/mX0-_g",
  "token": "xyz"
})

Duck DNS configuration:

lets_encrypt:
  accept_terms: true
  certfile: fullchain.pem
  keyfile: privkey.pem
token: xyz
domains:
  - xxx.duckdns.org
seconds: 300

In configuration.yaml I have not yet setup the http setting with the base_url. The block is commented out.

#http:
  #base_url: xxx.duckdns.org
  #ssl_certificate: /ssl/fullchain.pem
  #ssl_key: /ssl/privkey.pem

Home assistant has a static IP address. I have setup the following port forwarding rules on my router:

port_forwarding

Accessing the home assistant login page via http://xxx.duckdns.org:8123/ works fine.

What am I missing? - Why does the token validation fail?

1 Like
2

I solved it by disabling the samba share add-on. Then I restarted the Duck DNS add-on and the challenge was valid. No errors in log anymore. Afterwards, I enabled samba share again.

I have cleared up my port forwarding rules: only on rule is left which points public port 443 to internal port 8123. Furthermore, I added the following lines to configuration.yaml

http:
  base_url: https://xxx.duckdns.org
  ssl_certificate: /ssl/fullchain.pem
  ssl_key: /ssl/privkey.pem

:smiley:

1 Like
4

Thanks for upadting the post with the fix