LetsEncrypt in DuckDNS - Fails with Incorrect TXT

[tigersoul]

Now tried waiting and redoing it all, nothing helps. Any idea what to do?

[Kitkat (Amanda)]

Hi,

Same here, every 3 months I have cert renewal problems, but I have found a procedure that has worked twice in a row now…

Let's Encrypt quit working?

And exactly 3 months later autorenewal failed again. But this time less messing about… Remove aliases, just replace with aliases: []. Restart the addon Assuming it renewed ok, add the aliases back in Restart the addon Boom!!! Back in business.

Just been through it again and its just worked again fine.

Good luck.

[tigersoul]

I found the same solution just now. FINALLY. It’s a shitty solution as it kills automatic renewal, but at least we get it working.

[andreasc (andreas)]

but removing the aliases definition renews the certificate for the duckdns not the custom domain right?

[Thomas_Geens]

Edit:

---

Due to the lack of updates and unstable working of this add-on I have recently moved to an alternative add-on offered by the HomeAssistant Community Nginx Proxy Manager. Works like a charm and combines the Let’s Encrypt certificate requests and the DuckDNS updates as well into one tool!

Original post:

---

After struggling as well with this every 3 months, here’s my current set-up and process for manually renewing the certificates.

1. Add-on Duck DNS (Let’s Encrypt support)

domains:
- ha-customdomain.duckdns.org
token: *******-****-****-************
aliases:
- domain: ha.customdomain.eu
  alias: ha-customdomain.duckdns.org
lets_encrypt:
accept_terms: true
algo: secp384r1
certfile: fullchain.pem
keyfile: privkey.pem
seconds: 300

2. Add-on NGINX Home Assistant SSL proxy

domain: ha.customdomain.eu
hsts: ""
certfile: fullchain.pem
keyfile: privkey.pem
cloudflare: false
customize:
active: true
default: nginx_proxy_default*.conf
servers: nginx_proxy/*.conf

3. configuration.yaml

Make sure you include the below options within your homeassistant configuration file. Note that the use of http\base_url is deprecated. (article)

...
homeassistant:
  external_url: https://ha.customdomain.eu  # Set external vhost
  internal_url: http://[local_ip]:8123 # Replace with your local ip

# HTTP listeners configuration
http:
  # base_url: http://[local_ip]:8123
  #  ssl_certificate: /ssl/fullchain.pem
  #  ssl_key: /ssl/privkey.pem
  ip_ban_enabled: true
  login_attempts_threshold: 3
  use_x_forwarded_for: true
  trusted_proxies:
    - 172.30.33.0/24
...

4. DNS Zone customdomain.eu

*.ha.customdomain.eu.           CNAME   ha-customdomain.duckdns.org.   #ttl 60
ha.customdomain.eu.             CNAME   ha-customdomain.duckdns.org.   #ttl 60

5. Firewall Inbound Destination NAT

public_ip:443 TRANSLATES_TO internal_ip:443

6. Procedure to renew SSL certificate

• Modify the configuration of add-on Duck DNS by clearing the aliases

  domains:
  - ha-customdomain.duckdns.org
  token: *******-****-****-************
  aliases: []
  lets_encrypt:
  accept_terms: true
  algo: secp384r1
  certfile: fullchain.pem
  keyfile: privkey.pem
  seconds: 300
  

• Restart the addon and wait for the certificate to renew for your *.duckdns.org domain

• Recover your original configuration of add-on Duck DNS by setting the aliases again for your custom domain:

  domains:
  - ha-customdomain.duckdns.org
  token: *******-****-****-************
  aliases:
  - domain: ha.customdomain.eu
    alias: ha-customdomain.duckdns.org
  lets_encrypt:
  accept_terms: true
  algo: secp384r1
  certfile: fullchain.pem
  keyfile: privkey.pem
  seconds: 300
  

• Try renewing your certificate again, whilst including your custom domain as a SAN. This might take upto 3 times before being effective.

• Once the certificate has been renewed you will need to restart the add-on NGINX Home Assistant SSL proxy, so it can pick up the new certificate from /ssl/fullchain.pem as well.

[Thomas_Geens]

Awaiting fix which is ready to merge:

Fix DuckDNS Lets Encrypt certificate creation/renewal failing with “Incorrect TXT record” error by lildude · Pull Request #2662 · home-assistant/addons (github.com)

[diamant-x]

Wonderful news.
The PR is already approved. What would be the next steps so that is merged and released as an update for the addon?
My renew is near and would be great to have it a run to confirm it’s fixed.
Thanks!

[Thomas_Geens]

You could wait for the repository owner on Github to finally merge it. I have no idea why it is taking this long, maybe he is working on his own fix for it…

If you don’t want to wait you could always fork his repo and migrate/port the add-on to HACS so you can implement your own version with the fix in place already.

[Thomas_Geens]

Unfortunately the proposed fix raises other issues for some use cases. This will probably result in the PR not being merged.

Fix DuckDNS Lets Encrypt certificate creation/renewal failing with "Incorrect TXT record" error