Let's Encrypt error: "it has external DNS and external A/AAAA records"

Jorgeoa

Hello,
I'm migrating a site that uses Let's Encrypt SSL certificate in Webfaction and want to setup it in Opalstack the same way.
After creating the Site Route I receive the following message:

Unable to issue LetsEncrypt certificate for site xxxxx because it has external DNS and external A/AAAA records.

I would like to test the full site in opal and have the SSL correctly configured before change the DNS name server to avoid problems with site visitors. Can I solve this problem?
Thank you very much.
Regards,
Jorge

vsajip

I had to ensure that:

The domain was added to Opalstack
The name server configuration at the registrar for the domain was set to point to Opalstack's name servers
Wait for DNS propagation (can take many hours)
Try to turn on LE certificate for the site.

Step 3 took a lot longer than expected. You can use e.g. https://dnspropagation.net/ to verify propagation.

Jorgeoa

Hello,
The name server is not pointing to Opalstack as I need to ensure that the website works correctly before that.
Is it not possible to test the site with SSL before changing the name servers?
Thanks

sean

Jorgeoa if you have a valid SSL cert at your current host then you can get a copy of your cert and key from there and install it manually on your site here at Opalstack: https://help.opalstack.com/article/33/managing-ssl-certificates

Once that is done you can test your site.

When you've completed testing you can then point your NS or A records at Opalstack. As soon as those changes have propagated you'll be able to enable automatic LE for your site via your Opalstack dashboard.

Jorgeoa

Thanks sean!

lunarcreative

Hello, I have similar issue, but the DNS is redirected already to opalstack as external DSNes on the provider. Mail is working correctly, and here is DNS propagation:
https://dnspropagation.net/A/hardasuka.pl
points to opalstack server. What can be the issue then?
AAAA records are not responsive.

sean

lunarcreative Check to see If you have additional domains attached to the site.

In order to generate a certificate we need to be able to verify that the domain is pointing at the Opalstack server. If you have additional domains on the site and those domains have their own external A or AAAA records then we won't be able to generate a Let's Encrypt certificate

saebel

I have a similar issue.

Unable to issue LetsEncrypt certificate for site summerville_org because it has external DNS and external A/AAAA records.
Unable to issue LetsEncrypt certificate for site summerville_net because it has external DNS and external A/AAAA records.

I redirected the DNS servers on my Hover account to point to the ones listed in the support documentation.
I've checked with some DNS checking sites and they are all showing the following server: 45.79.100.246, which is my vps server's IP address.

I deleted the sites from the old hosting service (Host Gator) and made sure that there were no additional A records on Hover.

So, is it just a wait and see sort of thing and try again in an hour?

sean

saebel I've checked the logs on the dashboard server (where LE certs are generated) and this does look like a DNS propagation problem. Please do wait at least an hour and then give it another shot.

saebel

sean
Okay. Also, I'm running into a different issue where I can't control which domain name appears. I think it's because I have multiple sites pointing to the same application and opalstack has it's own algorithm for deciding which domain name to display. So I've decided to create a separate application with an htaccess redirect that points to just one domain using the "Redirect 301 / https://example.com/" trick.

It's not an emergency, as the sites above aren't in use yet. But it's a dry run for later tonight when we flip the switch on our main site.

sean

saebel will follow up via your other post.