GoDaddy domain delegated to AzureDNS is not showing up in DNS pop up

[rsantoshk]

Describe the bug
I am having domain in Godaddy, I created a DNS zone in Azure and pointed the name servers of Godaddy.
ACME bot AD authentication is working well, when I open the app on https://func-acmebot-xxxxx.azurewebsites.net/dashboard
The DNS zone is empty pop up.

To Reproduce
Steps to reproduce the behavior:
I am having domain in Godaddy, I created a DNS zone in Azure and pointed the name servers of Godaddy.
ACME bot AD authentication is working well, when I open the app on https://func-acmebot-xxxxx.azurewebsites.net/dashboard
The DNS zone is empty pop up.

I have added all the necessary configuration and the IAM role also
https://github.com/shibayan/keyvault-acmebot/wiki/DNS-Provider-Configuration#app-settings-1

Environment (please complete the following information):

• Certificate Type: [e.g. Zone Apex, Sub-domain, Wildcard]
• Certificate Deploy Target: [e.g. App Service]

Additional context
Add any other context about the problem here.

[PavanGurram-DevOps]

Hi there,

Is there any update on this issue as I'm also facing exactly the same issue?
I have followed the guide and also youtube video and had set it up properly but no luck.

I was so excited to use this library as it made cert renewal process easy and sweet but disappointed with this issue now.
Any help is really appreciated.

Many thanks in advance

[PavanGurram-DevOps]

Hello,

Please can someone help as we are blocked?

Thanks

[JohnLBevan]

Just to clarify, is the issue with AzureDNS or GoDaddy (i.e. if you lookup the public nameservers for your zones (Resolve-DnsName example.com -Type NS does it return name servers from Azure (e.g. something like ns1-39.azure-dns.com) or from GoDaddy (e.g. something like cns1.godaddy.com)?

Which provider did you then configure AcmeBot to use; Azure or GoDaddy?

[PavanGurram-DevOps]

Thanks @JohnLBevan for the response.

Sorry,I should have either created a new ticket or detailed well in this ticket. At my end, I'm NOT using Azure DNS and we have hosted our website DNS in godaddy.

Our usecase is simple, Godaddy -> Azure Application GW (Lets encrypt cert SSL cert) -> AKS

I have created godaddy API credentials and used them in Azure function app as suggested by library. We have configured Azure authentication which is OK as we can load function app url else we wouldn't have it loaded.

Everything looks fine and configured as suggested but still unable to see any DNS Zones under drop down.

Please help if I'm missing something. Kindly let me know for more details.

[JohnLBevan]

I'm afraid I've no experience with the GoDaddy provider, but some ideas in case they help....

• Can you test the API credentials to confirm all's good there - e.g. see the calling the api section of https://developer.godaddy.com/getstarted - try running that CURL command with your credentials to ensure all's good there.
• Did you create the credentials against the Production environment, or did you accidentally select OTE (GoDaddy's test environment)? If the latter, create & use new API credentials for production.
• When requests egress from your function app to the GoDaddy API URI, does that egress go out directly via the Azure backbone, or is egress traffic to the internet blocked / routed via a FW - it's worth ensuring that communication is possible.

[PavanGurram-DevOps]

Thanks @JohnLBevan for the response.

There is no FW set up and I have tried both OTE and Prod envs. The curl command for OTE environment is giving empty results and ideally it should result the domain name and for Prod env, it is throwing unauthorised access with unknown reason. I have reached out to GoDaddy mentioning API keys are not working and discussion is in progress.

[webprofusion-chrisc]

Note also that Godaddy now restrict their API to customers with 10 domains or more. If you have less then certain API calls will fail with Unauthorised 403 errors, I'm not sure how they show up for this app in particular.

[PavanGurram-DevOps]

Thanks @webprofusion-chrisc for the response.

Yes, I have seen this point mentioned and would like to double check with GoDaddy on the same so reached them out and waiting for an update.

[mottosen]

@PavanGurram-DevOps Hi, I just had the same issue using what sounds like the exact same setup. I decided to create a free account on CloudFlare, then point the GoDaddy nameservers to CloudFlare nameservers, and then use the CloudFlare API. This works perfectly, and the CloudFlare UI + API is much nicer work with imo.

Basically, this lets your domain still be registered at GoDaddy, but managed by CloudFlare. This means you should set up the keyvault acmebot to use CloudFlare API key.

Here's a link for using GoDaddy domain on cloudflare: https://blog.softbinator.com/set-up-cloudflare-dns-godaddy-domains/
And this video for setting up the acmebot in Azure is good too: https://www.youtube.com/watch?v=MX-7rVL7088

Hope this helps, this worked perfectly for me. However, there can be a little delay before the CloudFlare setup starts working - anything from a couple of minutes to hours, depending on DNS caching and what not. I did my setup in the evening and it was working the next day, no worries.

[PavanGurram-DevOps]

Thanks @mottosen for the response.

It sounds like we both are on same boat. Yeah, I need to check about Cloudflare with Project team whether it can be acceptable component in our architecture. I have followed the same video to set up with GoDaddy and ended up with this issue raised.

[PavanGurram-DevOps]

Hello @mottosen @JohnLBevan @webprofusion-chrisc

All of sudden, I started seeing below "fetch error" valuesunder drop down. The only thing I did is running below curl commands for OTE and Prod env just to make sure I'm able to fetch the domain but it didn't work though. Any idea on how to resolve this 'fetch error' please?

Prod: curl -X GET -H "Authorization: sso-key :" "https://api.godaddy.com/v1/domains/available?domain="
OTE: curl -X 'GET'
'https://api.ote-godaddy.com/v1/domains'
-H 'accept: application/json'
-H 'Authorization: sso-key :'

[shibayan]

With the latest update, it is now possible to determine whether the error is due to an API call or whether the result is empty for each DNS provider. fetch error refers to an error during an API call.

[PavanGurram-DevOps]

Thanks @shibayan for the response.

How can I resolve the 'fetch error' please? Do you have any idea?

[shibayan]

Open Application Insights deployed at the same time and check Failures -> Dependencies and you should see API call errors.

I do not have GoDaddy API privileges so I have not been able to confirm this. GoDaddy Provider may be deprecated unless restrictions are relaxed.

[PavanGurram-DevOps]

Hi All,

Hope all is well :)

I have progressed somehow but now ended up with below 'fetch error' only for GoDaddy so please suggest me some ideas to resolve the issue.

[raju1970]

Hi @raju1970 PSBODHI is NOT GoDaddy domain hence appeared in the dropdown. The one which I wanted to appear is GoDaddy domain and it is not populated. Thanks.

[raju1970]

Hi @PavanGurram-DevOps I am ONLY using Azure DNS and the PSBODHI is related to Azure DNS. I am having the fetch error issue with Azure DNS and you have resolved that. Please see the attached screenshot which shows the fetch error under Azure DNS. In your case how were you able to fix that issue with Azure DNS to be able to see PSBODHI in Azure DNS domain?
Azure DNS Load Issue.pdf

[PavanGurram-DevOps]

Hi @raju1970 I didn't do anything special to bodhi azure dns, it has appeared by itself in drop down when keyvault acmebot guide is followed. Thanks.

[raju1970]

Hi @raju1970 I didn't do anything special to bodhi azure dns, it has appeared by itself in drop down when keyvault acmebot guide is followed. Thanks.

Ok. Thank you.

[raju1970]

Hi All,
Hope all is well :)
I have progressed somehow but now ended up with below 'fetch error' only for GoDaddy so please suggest me some ideas to resolve the issue.

Hi @PavanGurram-DevOps how did you resolve the 'fetch error' for Azure DNS? Hi @shibayan, I have looked at the Application insights and the logs tells me that it is a "401 " error on the "GET /certificates/" call. The call URL is "https://kv-rp-acmebotfapp-ejvt.vault.azure.net/certificates/?api-version=7.5&includePending=REDACTED" and the output of that URL is "{"error":{"code":"Unauthorized","message":"AKV10000: Request is missing a Bearer or PoP token."}}". I already have Token store enabled in App Server Authentication Settings. What else do I need to add and where.

Thanks in advance for both of your help.

Hi @shibayan any thoughts on why I would be getting a 401 (Unauthorized) error to fetch from Azure DNS? Do I need to add any special token in the request?
Azure DNS Load Issue.pdf

[PavanGurram-DevOps]

Hi @JohnLBevan @shibayan

Thanks for the response.

Yes I did and resolved couple of errors related to function app access on subscription and also 'Get certificates' permissions on Key vault. The only error I see now is below

[JohnLBevan]

How many domains do you have registered with them?

Per @webprofusion-chrisc's comment:

Note also that Godaddy now restrict their API to customers with 10 domains or more. If you have less then certain API calls will fail with Unauthorised 403 errors, I'm not sure how they show up for this app in particular.

I've seen similar here where they mention limits of 10, 20, and 50 domains. To me that translates as: "don't use GoDaddy".

After a lot of hunting I found mention of these domain limits at https://developer.godaddy.com/getstarted

Access to parts of our Domains API in Production may require meeting certain criteria: Availability API: Limited to accounts with 50 or more domains. Management and DNS APIs: Limited to accounts with 10 or more domains and/or an active Discount Domain Club – Premier Membership plan.

So this looks like a GoDaddy issue (and by design) rather than anything AcmeBot related.

[webprofusion-chrisc]

Yes, this is the GoDaddy API limit problem, which universally affects all ACME clients (and anything using the GoDaddy API). Solution is either to upgrade with GoDaddy, move DNS provider, or use CNAME _acme-challenge delegation to another zone that supports automation.

[PavanGurram-DevOps]

Thanks @JohnLBevan @webprofusion-chrisc for responses.

I will check with GoDaddy once if they can help in anyways.

Cheers!!