"Orchestrator function 'IssueCertificate' failed: The activity function 'Dns01Authorization'"

[ohhmaar]

I've validated that the function app has proper role assignments with the keyvault and DNS Zone. I've looked through the AppInsights logs.

Message: Exception while executing function: Dns01Authorization Sequence contains no matching element
Exception type: System.InvalidOperationException
Problem Id: System.InvalidOperationException at KeyVault.Acmebot.Functions.SharedActivity+<Dns01Authorization>d__16.MoveNext

{
  "type": "https://tools.ietf.org/html/rfc7231#section-6.6.1",
  "title": "An error occurred while processing your request.",
  "status": 500,
  "detail": "Orchestrator function 'IssueCertificate' failed: The activity function 'Dns01Authorization' failed: \"Sequence contains no matching element\". See the function execution logs for additional details.",
  "traceId": "00-64f51690ba14240e9d343b8f1bcebda2-a82343f57073dd58-00"
}

{
  "$type": "System.InvalidOperationException, System.Private.CoreLib",
  "ClassName": "System.InvalidOperationException",
  "Message": "Sequence contains no matching element",
  "Data": null,
  "InnerException": null,
  "HelpURL": null,
  "StackTraceString": "   at System.Linq.ThrowHelper.ThrowNoMatchException()\r\n   at KeyVault.Acmebot.Functions.SharedActivity.Dns01Authorization(IReadOnlyList`1 authorizationUrls) in /home/runner/work/keyvault-acmebot/keyvault-acmebot/KeyVault.Acmebot/Functions/SharedActivity.cs:line 0\r\n   at Microsoft.Azure.WebJobs.Host.Executors.FunctionInvoker`2.InvokeAsync(Object instance, Object[] arguments)\r\n   at Microsoft.Azure.WebJobs.Host.Executors.FunctionExecutor.InvokeWithTimeoutAsync(IFunctionInvoker invoker, ParameterHelper parameterHelper, CancellationTokenSource timeoutTokenSource, CancellationTokenSource functionCancellationTokenSource, Boolean throwOnTimeout, TimeSpan timerInterval, IFunctionInstance instance) in C:\\projects\\azure-webjobs-sdk-rqm4t\\src\\Microsoft.Azure.WebJobs.Host\\Executors\\FunctionExecutor.cs:line 581\r\n   at Microsoft.Azure.WebJobs.Host.Executors.FunctionExecutor.ExecuteWithWatchersAsync(IFunctionInstanceEx instance, ParameterHelper parameterHelper, ILogger logger, CancellationTokenSource functionCancellationTokenSource) in C:\\projects\\azure-webjobs-sdk-rqm4t\\src\\Microsoft.Azure.WebJobs.Host\\Executors\\FunctionExecutor.cs:line 527\r\n   at Microsoft.Azure.WebJobs.Host.Executors.FunctionExecutor.ExecuteWithLoggingAsync(IFunctionInstanceEx instance, FunctionStartedMessage message, FunctionInstanceLogEntry instanceLogEntry, ParameterHelper parameterHelper, ILogger logger, CancellationToken cancellationToken) in C:\\projects\\azure-webjobs-sdk-rqm4t\\src\\Microsoft.Azure.WebJobs.Host\\Executors\\FunctionExecutor.cs:line 306",
  "RemoteStackTraceString": null,
  "RemoteStackIndex": 0,
  "ExceptionMethod": null,
  "HResult": -2146233079,
  "Source": "System.Linq",
  "WatsonBuckets": null
}

This is the 2nd time I've deployed this app and I'm noticing it takes about a day or two to get passed annoying Azure propagation issues. After deployment it takes a day or so for the DNS Zone to being appearing. Then once it appears these Dns01Authorization errors appear until another day passes. Is there anything that can be done to address these?

I appreciate all the help, thanks!
Application version: 4.0.7

[shibayan]

Thanks for the feedback. I think the problem is probably occurring in one of the following two places, but it is difficult to identify in the current version, so I will release a version with improved error messages.

• https://github.com/shibayan/keyvault-acmebot/blob/master/KeyVault.Acmebot/Functions/SharedActivity.cs#L216
• https://github.com/shibayan/keyvault-acmebot/blob/master/KeyVault.Acmebot/Functions/SharedActivity.cs#L241

[ohhmaar]

Thank you for the assistance. The error message now states

{
  "$type": "KeyVault.Acmebot.PreconditionException, KeyVault.Acmebot",
  "ClassName": "KeyVault.Acmebot.PreconditionException",
  "Message": "DNS-01 cannot be used for domains for which a certificate has already been issued using HTTP-01.",
  "Data": null,
  "InnerException": null,
  "HelpURL": null,
  "StackTraceString": "   at KeyVault.Acmebot.Functions.SharedActivity.Dns01Authorization(IReadOnlyList`1 authorizationUrls) in /home/runner/work/keyvault-acmebot/keyvault-acmebot/KeyVault.Acmebot/Functions/SharedActivity.cs:line 220\r\n   at Microsoft.Azure.WebJobs.Host.Executors.FunctionInvoker`2.InvokeAsync(Object instance, Object[] arguments)\r\n   at Microsoft.Azure.WebJobs.Host.Executors.FunctionExecutor.InvokeWithTimeoutAsync(IFunctionInvoker invoker, ParameterHelper parameterHelper, CancellationTokenSource timeoutTokenSource, CancellationTokenSource functionCancellationTokenSource, Boolean throwOnTimeout, TimeSpan timerInterval, IFunctionInstance instance) in C:\\projects\\azure-webjobs-sdk-rqm4t\\src\\Microsoft.Azure.WebJobs.Host\\Executors\\FunctionExecutor.cs:line 581\r\n   at Microsoft.Azure.WebJobs.Host.Executors.FunctionExecutor.ExecuteWithWatchersAsync(IFunctionInstanceEx instance, ParameterHelper parameterHelper, ILogger logger, CancellationTokenSource functionCancellationTokenSource) in C:\\projects\\azure-webjobs-sdk-rqm4t\\src\\Microsoft.Azure.WebJobs.Host\\Executors\\FunctionExecutor.cs:line 527\r\n   at Microsoft.Azure.WebJobs.Host.Executors.FunctionExecutor.ExecuteWithLoggingAsync(IFunctionInstanceEx instance, FunctionStartedMessage message, FunctionInstanceLogEntry instanceLogEntry, ParameterHelper parameterHelper, ILogger logger, CancellationToken cancellationToken) in C:\\projects\\azure-webjobs-sdk-rqm4t\\src\\Microsoft.Azure.WebJobs.Host\\Executors\\FunctionExecutor.cs:line 306",
  "RemoteStackTraceString": null,
  "RemoteStackIndex": 0,
  "ExceptionMethod": null,
  "HResult": -2146233088,
  "Source": "KeyVault.Acmebot",
  "WatsonBuckets": null
}

[shibayan]

This is due to a limitation of Let's Encrypt that once a domain has been verified using HTTP, it cannot be verified using DNS. Please refer to the following thread

shibayan/appservice-acmebot#199 (comment)

[webprofusion-chrisc]

Sorry @shibayan there is no such limitation in Let's Encrypt, but keyvault-acmebot may have this limitation itself. You can definitely validate a domain using dns-01 even if you have previously issued using http-01.

Currently if you validate a domain using any method Let's Encrypt will cache the validation (meaning it will remaining valid for 30 days and not require a check if you try to get another cert in the same time frame), they may reduce this in the future. Other CAs like ZeroSSL have no validation caching (or very little).

[ohhmaar]

@shibayan Thank you for your response. I wanted to clarify that I'm using a CA (Keyfactor) that uses EAB credentials.
Would using using a new EAB account get past this? Is there a way to purge the existing verification and force it to re-verify?

[shibayan]

@ohhmaar If you are not using Let's Encrypt, you will need to verify that your actual issuer supports DNS-01. I am not familiar with Keyfactor CA's ACME implementation, so I don't know.