Route53: Error creating a certificate for some hosted zones

[gokublackssr]

Hi Everyone,

I've deployed the project into Azure and is working perfectly, but I've come into an issue recently where I cannot generate certificates for specific hosted zones.

DNS Host: Route 53

Examples:
maindomain.com - Working fine and other multiple domains and subdomains that I have.
this specifically acc.maindomain.com - Not working.

I go the following message:

1. The maindomain.com, already has the NS records for this subdomain (acc.maindomain.com)
2. The IAM Access to route53 has access to generate certificates for all hosted zones "*"
3. The Funcion APP is using Azure DNS, I don't see the issue here, since the function app is able to generate for some domains and subdomains.

Curious fact: I have a hosted zone in route53 subdomain, example: read.maindomain.com
I'm able to generate a certificate for *.read,maindomain.com but I'm not able to generate api.read.maindomain.com it shows the same error.

Another Note: I can generate the certificates via Powershell script with no issues

[AnthonyMartinezHCSS]

Running into a similar issue

[babarsac]

I'm running into the same issue as well.

[babarsac]

@gokublackssr

You mentioned that you can successfully make the cert requests via PowerShell. Do you have any script samples you would be willing to share?

[craigraven-trimble]

I've been getting this for some certs on renewal, but not all. All the ones with the issue are in Route53.

My problem seems to be with the logic around the _acme-challenge TXT record; the bot is trying to delete a record that doesn't exist and throwing an exception. If I manually create a TXT record for the challenge, it then functions correctly, deleting the existing record and then recreating it.