Hello everyone,
I’m currently trying to create wildcard certificates for my domains via the DNS challenge; does anyone have experience with this? What dns_sleep do you use? I’m currently at 90 and still often have the problem that it aborts.
90 seconds is a little low? Why not use 300 or 600 instead? You are not in a hurry after all 
because I’d like to do the whole thing via Ansible and with 9 domains. then I end up getting an SSH timeout.
can’t you start all of them at the same time?
It would be possible with async, but that would then cause other problems with the acme.sh script.
Looks like you have to make use of the cronjobs or change your SSH timeouts.
There is no magic sauce (beyond Anycast) to make DNS propagation even faster.
120 seconds used to be a default for many basic implementations. Some implementations like opnsense do it in a 20 seconds intervall for 10 minutes. Some like Proxmox do not retry at all, hence why I set them to wait for 300 seconds, because time is not critical.
What do you mean by that?
Excuse my ignoreance, maybe there is something I don’t understand.
I don’t use the ACME bash script directly, mostly certbot or some kind of ACME implementation (Proxmox, PBS, OPNsense, TrueNAS, the liest goes on). But all of them use a daily cronjob for cert renewal.
That way you don’t have to bother with ansible, ssh timeouts, or anything like that. Cronjob will trigger ACME.
Good, but for the cron to run, the cert has to be installed first and for that it has to be created once; at least with acme.sh
Maybe I’ll take a look at certbot, let’s see how it can be controlled.
sure, but you are not in a hurry there, right? Since you can run it once manually?
Well, I would like a playbook that ideally sets up a ready-to-use web server that is immediately fully functional.
There is no magic sauce (beyond Anycast) to make DNS propagation even faster.
Sounds like you have to increase both SSH timeout and ACME to at least 120s.
BTW, what is the reason for the aborts? Maybe it isn’t even the DNS but some kind of rate limit?
Currently I’m considering whether to go with Caddy, as it would handle the whole thing itself.