Letsencrypt with cloudflare

1

Hi

I’m trying to switch over to cloudflare with letsencrypt and DNS verification.

I’ve disabled the duckdns and configured the letsencrypt according the documentation.

When starting letsencrypt, i can see the TXT getting added in my dns config and removes after a few minutes, however i’m getting this error in the log:

s6-rc: info: service s6rc-oneshot-runner: starting
s6-rc: info: service s6rc-oneshot-runner successfully started
s6-rc: info: service fix-attrs: starting
s6-rc: info: service fix-attrs successfully started
s6-rc: info: service legacy-cont-init: starting
cont-init: info: running /etc/cont-init.d/file-structure.sh
cont-init: info: /etc/cont-init.d/file-structure.sh exited 0
s6-rc: info: service legacy-cont-init successfully started
s6-rc: info: service legacy-services: starting
services-up: info: copying legacy longrun lets-encrypt (no readiness notification)
s6-rc: info: service legacy-services successfully started
[11:57:21] INFO: Selected DNS Provider: dns-cloudflare
[11:57:21] INFO: Use propagation seconds: 60
[11:57:22] INFO: Use CloudFlare token
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Requesting a certificate for ha.REDACHTED.com
Waiting 60 seconds for DNS changes to propagate

Certbot failed to authenticate some domains (authenticator: dns-cloudflare). The Certificate Authority reported these problems:
Domain: ha.REDACTED.com
Type: dns
Detail: DNS problem: looking up TXT for _acme-challenge.ha.REDACTED.com: DNSSEC: DNSKEY Missing

Hint: The Certificate Authority failed to verify the DNS TXT records created by --dns-cloudflare. Ensure the above domains are hosted by this DNS provider, or try increasing --dns-cloudflare-propagation-seconds (currently 60 seconds).

Don’t know what i’m doing wrong here, as i can’t seem to find what the root cause actually is…

anybody can point me out to something?

2

As I remember you have to use dns from cloudflare to make this work. It could take up to 24 hours to propagate. It was something like that.

3

Hi thx for the quick answer, cloudflare is not my registrar, i thought it was enough to set CF as my nameservers and add the domain there. I can see all my dns records in CF. Do i need to move my DNS to CF so it’s CF that is the registrar?

4

As I remember you have to move your dns records to cloudflare. There is doc somewhere online so check it out.

5

Hi, just transfered my domain to Cloudflare, and it works like a charm now.

So basically a pre-req of this is to have your DNS transferred to clouflare. At least that’s my conclusion, and for 10$ it’s even less than my current registrar…

6

If anyone else lands here and is having issues check out my YouTube video on how to configure LetsEncrypt with CloudFlare for Home Assistant

7

i followed your video but got below log from lets encypt add on.

6-rc: info: service s6rc-oneshot-runner successfully started

s6-rc: info: service fix-attrs: starting

s6-rc: info: service fix-attrs successfully started

s6-rc: info: service legacy-cont-init: starting

cont-init: info: running /etc/cont-init.d/file-structure.sh

cont-init: info: /etc/cont-init.d/file-structure.sh exited 0

s6-rc: info: service legacy-cont-init successfully started

s6-rc: info: service legacy-services: starting

services-up: info: copying legacy longrun lets-encrypt (no readiness notification)

s6-rc: info: service legacy-services successfully started

[15:56:13] INFO: Selected DNS Provider: null

[15:56:13] INFO: Use propagation seconds: 60

[15:56:13] INFO: Detecting existing certificate type for *277tipu.site

Saving debug log to /var/log/letsencrypt/letsencrypt.log

[15:56:13] INFO: No certificate found - using ‘ecdsa’ key type.

usage:

certbot [SUBCOMMAND] [options] [-d DOMAIN] [-d DOMAIN] …

Certbot can obtain and install HTTPS/TLS/SSL certificates. By default,

it will attempt to use a webserver both for obtaining and installing the

certificate.

certbot: error: unrecognized arguments: --null --null-credentials /data/dnsapikey

s6-rc: info: service legacy-services: stopping

s6-rc: info: service legacy-services successfully stopped

s6-rc: info: service legacy-cont-init: stopping

s6-rc: info: service legacy-cont-init successfully stopped

s6-rc: info: service fix-attrs: stopping

s6-rc: info: service fix-attrs successfully stopped

s6-rc: info: service s6rc-oneshot-runner: stopping

s6-rc: info: service s6rc-oneshot-runner successfully stopped