fix: make DNS-01 propagation timeout configurable - #260
Merged
Conversation
CertMagic waits 2 minutes for challenge records to propagate and reproxy never set the field, so a zone publishing slower than that could never issue or renew certificates and had no workaround. Adds --ssl.dns.propagation-timeout with 2m as the default, so existing behaviour is unchanged. Related to #258
Found while fixing #258. Resolvers changes what counts as propagated rather than how long to wait, so it was kept out of that fix.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fix #258, DNS-01 issuance failing on zones that publish challenge records slower than CertMagic's 2 minute timeout.
what happens today:
app/proxy/ssl.gobuilds theDNS01Solverwithout settingPropagationTimeout, so every deployment gets CertMagic's 2 minute default (defaultDNSPropagationTimeout,solvers.go:527). A zone publishing slower loses the race, the challenge record is deleted, and the retry loses it again. The reporter measured his Cloudflare zone publishing between 75s and 120s, with 5 of 12 FQDNs never obtaining a certificate and previously issued certs failing to renew.--ssl.dns.ttldoes not help, it sets the record TTL rather than how long the solver waits.the change: new
--ssl.dns.propagation-timeout/SSL_DNS_PROPAGATION_TIMEOUT, default2mso current behaviour is unchanged, carried onproxy.SSLConfigand set oncertmagic.DNSManager.scope is deliberately narrow.
PropagationDelaywas considered and left out: it sleeps and then starts the full timeout window anyway (solvers.go:421), so it does not help a slow zone and only slows the fast case.Resolverswas left out too, it turns off authoritative-server checking (solvers.go:442) and steers zone discovery (solvers.go:382), so it changes what counts as propagated rather than a duration. That gap is recorded indocs/backloginstead.tests cover both wiring halves, option to config in
app/main_test.goand config to solver inapp/proxy/ssl_test.go.