TLS ACME provider deSEC returns "Bad request" #2098

git001 · 2025-09-04T21:14:02Z

git001
Sep 4, 2025

Hi.

I try to setup stalwart with new added desec provider and need some help for debugging.

root@mail:~# /opt/stalwart/bin/stalwart -V
0.13.2

cat /opt/stalwart/etc/config.toml

authentication.fallback-admin.secret = "$6$oJtG0..."
authentication.fallback-admin.user = "admin-user"
directory.internal.store = "rocksdb"
directory.internal.type = "internal"
server.hostname = "mail.livesystem.at"
server.listener.http.bind = "[::]:8080"
server.listener.http.protocol = "http"
server.listener.https.bind = "[::]:443"
server.listener.https.protocol = "http"
server.listener.https.tls.implicit = true
server.listener.imap.bind = "[::]:143"
server.listener.imap.protocol = "imap"
server.listener.imaptls.bind = "[::]:993"
server.listener.imaptls.protocol = "imap"
server.listener.imaptls.tls.implicit = true
server.listener.sieve.bind = "[::]:4190"
server.listener.sieve.protocol = "managesieve"
server.listener.smtp.bind = "[::]:25"
server.listener.smtp.protocol = "smtp"
server.listener.submission.bind = "[::]:587"
server.listener.submission.protocol = "smtp"
server.listener.submissions.bind = "[::]:465"
server.listener.submissions.protocol = "smtp"
server.listener.submissions.tls.implicit = true
server.max-connections = 8192
server.socket.backlog = 1024
server.socket.nodelay = true
server.socket.reuse-addr = true
server.socket.reuse-port = true
storage.blob = "rocksdb"
storage.data = "rocksdb"
storage.directory = "internal"
storage.fts = "rocksdb"
storage.lookup = "rocksdb"
store.rocksdb.compression = "lz4"
store.rocksdb.path = "/opt/stalwart/data"
store.rocksdb.type = "rocksdb"
tracer.log.ansi = false
tracer.log.enable = true
tracer.log.level = "debug"
tracer.log.path = "/opt/stalwart/logs"
tracer.log.prefix = "stalwart.log"
tracer.log.rotate = "daily"
tracer.log.type = "log"

The log output for acme is quite silent, is it possible to print the json which is send to the desec api?

2025-09-04T21:00:31Z INFO ACME order started (acme.order-start) hostname = ["livesystem.at"]
2025-09-04T21:00:34Z INFO ACME authentication started (acme.auth-start) hostname = "livesystem.at", type = "dns-01", id = "desec"
2025-09-04T21:00:34Z DEBUG ACME renew backoff (acme.renew-backoff) id = "desec", hostname = ["livesystem.at"], total = 0, nextRetry = 1, causedBy = ACME DNS record creation failed (acme.dns-record-creation-failed) { id = "desec", hostname = "_acme-challenge.livesystem.at", details = "livesystem.at", reason = "Bad request" }
2025-09-04T21:00:40Z INFO ACME authentication started (acme.auth-start) hostname = "livesystem.at", type = "dns-01", id = "desec"
2025-09-04T21:00:40Z DEBUG ACME renew backoff (acme.renew-backoff) id = "desec", hostname = ["livesystem.at"], total = 1, nextRetry = 2, causedBy = ACME DNS record creation failed (acme.dns-record-creation-failed) { id = "desec", hostname = "_acme-challenge.livesystem.at", details = "livesystem.at", reason = "Bad request" }
2025-09-04T21:00:48Z INFO ACME authentication started (acme.auth-start) hostname = "livesystem.at", type = "dns-01", id = "desec"
2025-09-04T21:00:48Z DEBUG ACME renew backoff (acme.renew-backoff) id = "desec", hostname = ["livesystem.at"], total = 2, nextRetry = 4, causedBy = ACME DNS record creation failed (acme.dns-record-creation-failed) { id = "desec", hostname = "_acme-challenge.livesystem.at", details = "livesystem.at", reason = "Bad request" }

I have also tried to use as "Subject names"

*.livesystem.at
livesystem.at
mail.livesystem.at

attached the full stalwart.log.2025-09-04.zip.
stalwart.log.2025-09-04.zip

As this is a test server I can also build an debugging version.

I have open a issue in dns-update repo for that case stalwartlabs/dns-update#18

git001 · 2025-09-05T11:28:14Z

git001
Sep 5, 2025
Author

I have created an PR stalwartlabs/dns-update#19 to be able to see the reason for the Bad Request answer

0 replies

git001 · 2025-09-06T12:15:57Z

git001
Sep 6, 2025
Author

I have now build stalwart with the patched dns-update and got the following info in the log.

2025-09-06T12:01:33Z INFO ACME authentication started (acme.auth-start) hostname = "livesystem.at", type = "dns-01", id = "desec"
2025-09-06T12:01:33Z DEBUG ACME renew backoff (acme.renew-backoff) id = "desec", hostname = ["livesystem.at"], total = 1, nextRetry = 2, causedBy = ACME DNS record creation failed (acme.dns-record-creation-failed) { id = "desec", hostname = "_acme-challenge.livesystem.at", details = "livesystem.at", reason = "API error: BadRequest {"ttl":["Ensure this value is greater than or equal to 3600."]}" }

2025-09-06T12:01:41Z INFO ACME authentication started (acme.auth-start) hostname = "livesystem.at", type = "dns-01", id = "desec"
2025-09-06T12:01:41Z DEBUG ACME renew backoff (acme.renew-backoff) id = "desec", hostname = ["livesystem.at"], total = 2, nextRetry = 4, causedBy = ACME DNS record creation failed (acme.dns-record-creation-failed) { id = "desec", hostname = "_acme-challenge.livesystem.at", details = "livesystem.at", reason = "API error: BadRequest {"ttl":["Ensure this value is greater than or equal to 3600."]}" }

I'm looking now where I can in crease the ttl because in the admin interface is the default shown and this is 5m.

0 replies

git001 · 2025-09-06T12:26:09Z

git001
Sep 6, 2025
Author

I have now added the ttl manually into the config, which disappear when I change the ttl value in the admin web ui.

root@mail:~# cat /opt/stalwart/etc/config.toml
authentication.fallback-admin.secret = "$6$oJtG0..."
authentication.fallback-admin.user = "admin"
directory.internal.store = "rocksdb"
directory.internal.type = "internal"
server.hostname = "mail.livesystem.at"
server.listener.http.bind = "[::]:8080"
server.listener.http.protocol = "http"
server.listener.https.bind = "[::]:443"
server.listener.https.protocol = "http"
server.listener.https.tls.implicit = true
server.listener.imap.bind = "[::]:143"
server.listener.imap.protocol = "imap"
server.listener.imaptls.bind = "[::]:993"
server.listener.imaptls.protocol = "imap"
server.listener.imaptls.tls.implicit = true
server.listener.sieve.bind = "[::]:4190"
server.listener.sieve.protocol = "managesieve"
server.listener.smtp.bind = "[::]:25"
server.listener.smtp.protocol = "smtp"
server.listener.submission.bind = "[::]:587"
server.listener.submission.protocol = "smtp"
server.listener.submissions.bind = "[::]:465"
server.listener.submissions.protocol = "smtp"
server.listener.submissions.tls.implicit = true
server.max-connections = 8192
server.socket.backlog = 1024
server.socket.nodelay = true
server.socket.reuse-addr = true
server.socket.reuse-port = true
storage.blob = "rocksdb"
storage.data = "rocksdb"
storage.directory = "internal"
storage.fts = "rocksdb"
storage.lookup = "rocksdb"
store.rocksdb.compression = "lz4"
store.rocksdb.path = "/opt/stalwart/data"
store.rocksdb.type = "rocksdb"
tracer.log.ansi = false
tracer.log.enable = true
tracer.log.level = "debug"
tracer.log.path = "/opt/stalwart/logs"
tracer.log.prefix = "stalwart.log"
tracer.log.rotate = "daily"
tracer.log.type = "log"
[acme."desec"]
secret="Hs5..."
ttl=4600

restart

root@mail:~# systemctl restart stalwart.service

No change in the log

2025-09-06T12:22:27Z INFO ACME authentication started (acme.auth-start) hostname = "livesystem.at", type = "dns-01", id = "desec"
2025-09-06T12:22:27Z DEBUG ACME renew backoff (acme.renew-backoff) id = "desec", hostname = ["livesystem.at"], total = 3, nextRetry = 8, causedBy = ACME DNS record creation failed (acme.dns-record-creation-failed) { id = "desec", hostname = "_acme-challenge.livesystem.at", details = "livesystem.at", reason = "API error: BadRequest {"ttl":["Ensure this value is greater than or equal to 3600."]}" }

I have now reloaded the admin interface and the ttl isn't shown in the Web UI

After changing the ttl in the Web UI to 5m is the setting in the toml gone

root@mail:~# cat /opt/stalwart/etc/config.toml
authentication.fallback-admin.secret = "$6$oJtG0..."
authentication.fallback-admin.user = "admin"
directory.internal.store = "rocksdb"
directory.internal.type = "internal"
server.hostname = "mail.livesystem.at"
server.listener.http.bind = "[::]:8080"
server.listener.http.protocol = "http"
server.listener.https.bind = "[::]:443"
server.listener.https.protocol = "http"
server.listener.https.tls.implicit = true
server.listener.imap.bind = "[::]:143"
server.listener.imap.protocol = "imap"
server.listener.imaptls.bind = "[::]:993"
server.listener.imaptls.protocol = "imap"
server.listener.imaptls.tls.implicit = true
server.listener.sieve.bind = "[::]:4190"
server.listener.sieve.protocol = "managesieve"
server.listener.smtp.bind = "[::]:25"
server.listener.smtp.protocol = "smtp"
server.listener.submission.bind = "[::]:587"
server.listener.submission.protocol = "smtp"
server.listener.submissions.bind = "[::]:465"
server.listener.submissions.protocol = "smtp"
server.listener.submissions.tls.implicit = true
server.max-connections = 8192
server.socket.backlog = 1024
server.socket.nodelay = true
server.socket.reuse-addr = true
server.socket.reuse-port = true
storage.blob = "rocksdb"
storage.data = "rocksdb"
storage.directory = "internal"
storage.fts = "rocksdb"
storage.lookup = "rocksdb"
store.rocksdb.compression = "lz4"
store.rocksdb.path = "/opt/stalwart/data"
store.rocksdb.type = "rocksdb"
tracer.log.ansi = false
tracer.log.enable = true
tracer.log.level = "debug"
tracer.log.path = "/opt/stalwart/logs"
tracer.log.prefix = "stalwart.log"
tracer.log.rotate = "daily"
tracer.log.type = "log"

2 replies

pepa65 Sep 6, 2025

The interaction between the Webinterface and the Configfiles isn't really where it should be. The recommendation is that once you start touching the webinterface, you no longer should use the config files (and vice versa). I have never learned what happens when you use both, but settings not showing up in the webinterface is "normal". I hope this gets worked out in future versions...

git001 Sep 7, 2025
Author

Ah okay, thanks for the tip.

git001 · 2025-09-06T13:25:38Z

git001
Sep 6, 2025
Author

I have now change the ttl value hard coded to 4600 in https://github.com/stalwartlabs/stalwart/blob/main/crates/common/src/listener/acme/order.rs#L273 and now the log output shows another error.

That's what I have added into the order.rs

                        let my_ttl: u32 = 4600;

                        trc::event!(
                                Acme(AcmeEvent::RenewBackoff),
                                Hostname = name.to_string(),
                                Reason = my_ttl,
                                Details = origin.to_string(),
                                Id = provider.id.to_string(),
                            );

                        // Create the record
                        if let Err(err) = updater
                            .create(
                                &name,
                                DnsRecord::TXT {
                                    content: dns_proof.clone(),
                                },
                                //*ttl,
                                my_ttl,
                                &origin,
                            )
                            .await

{"non_field_errors":["Data for TXT records must be given using quotation marks."]}

2025-09-06T13:18:53Z INFO ACME authentication started (acme.auth-start) hostname = "livesystem.at", type = "dns-01", id = "desec"
2025-09-06T13:18:54Z DEBUG ACME renew backoff (acme.renew-backoff) hostname = "_acme-challenge.livesystem.at", reason = 4600, details = "livesystem.at", id = "desec"
2025-09-06T13:18:54Z DEBUG ACME renew backoff (acme.renew-backoff) id = "desec", hostname = ["livesystem.at"], total = 4, nextRetry = 16, causedBy = ACME DNS record creation failed (acme.dns-record-creation-failed) { id = "desec", hostname = "_acme-challenge.livesystem.at", details = "livesystem.at", reason = "API error: BadRequest {"non_field_errors":["Data for TXT records must be given using quotation marks."]}" }

It would be nice to see in debug mode what api request will be created to the DNS Provider.

2 replies

pepa65 Sep 6, 2025

I don't understand why deSec doesn't just add quotationmarks themselves...

git001 Sep 7, 2025
Author

Well the question is here also how the other DNS Provider behave? Maybe the issue exists for some time but was not visible. 🤷‍♂️

I have now created a PR stalwartlabs/dns-update#21 to format the TXT records for deSEC API.

git001 · 2025-09-06T14:14:38Z

git001
Sep 6, 2025
Author

Okay finally I was able to use deSEC ACME DNS Challange 😄

2025-09-06T13:55:31Z INFO ACME authentication started (acme.auth-start) hostname = "livesystem.at", type = "dns-01", id = "main-desec"
2025-09-06T13:55:31Z DEBUG ACME renew backoff (acme.renew-backoff) hostname = "_acme-challenge.livesystem.at", reason = "my_ttl :4600:", details = "livesystem.at", id = "main-desec"
2025-09-06T13:55:31Z DEBUG ACME renew backoff (acme.renew-backoff) hostname = "_acme-challenge.livesystem.at", reason = "dns_proof.clone() ":"SbywNo807xEAX0umMsgjyvE38j03W7uUsxkECRA0POQ":"", details = "livesystem.at", id = "main-desec"
2025-09-06T13:55:31Z INFO ACME DNS record created (acme.dns-record-created) hostname = "_acme-challenge.livesystem.at", details = "livesystem.at", id = "main-desec"
2025-09-06T13:55:31Z DEBUG ACME renew backoff (acme.renew-backoff) hostname = "_acme-challenge.livesystem.at", reason = "propagation_timeout :120s:", details = "livesystem.at", id = "main-desec"
2025-09-06T13:55:31Z DEBUG ACME DNS record lookup failed (acme.dns-record-lookup-failed) id = "main-desec", hostname = "_acme-challenge.livesystem.at", details = "livesystem.at", reason = "DNS record not found: Non-Existent Domain"
2025-09-06T13:56:02Z DEBUG ACME DNS record lookup failed (acme.dns-record-lookup-failed) id = "main-desec", hostname = "_acme-challenge.livesystem.at", details = "livesystem.at", reason = "DNS record not found: Non-Existent Domain"
2025-09-06T13:56:32Z DEBUG ACME DNS record lookup failed (acme.dns-record-lookup-failed) id = "main-desec", hostname = "_acme-challenge.livesystem.at", details = "livesystem.at", reason = "DNS record not found: Non-Existent Domain"
2025-09-06T13:57:02Z INFO ACME DNS record propagated (acme.dns-record-propagated) id = "main-desec", hostname = "_acme-challenge.livesystem.at", details = "livesystem.at"
2025-09-06T13:57:05Z INFO ACME authentication valid (acme.auth-valid) hostname = "livesystem.at", id = "main-desec"
2025-09-06T13:57:05Z INFO ACME authentication completed (acme.auth-completed) id = "main-desec", hostname = ["livesystem.at"]
2025-09-06T13:57:06Z INFO ACME order ready (acme.order-ready) id = "main-desec", hostname = ["livesystem.at"]
2025-09-06T13:57:08Z INFO ACME order valid (acme.order-valid) id = "main-desec", hostname = ["livesystem.at"]
2025-09-06T13:57:09Z INFO Processing ACME certificate (acme.process-cert) id = "main-desec", hostname = ["livesystem.at"], validFrom = 2025-09-06T12:58:37Z, validTo = 2025-12-05T12:58:36Z, due = 2025-11-05T12:58:36Z
2025-09-06T13:57:09Z INFO ACME order completed (acme.order-completed) domain = ["livesystem.at"], expires = 2025-11-05T12:58:35Z

The second change was in that line.

https://github.com/stalwartlabs/stalwart/blob/main/crates/common/src/listener/acme/order.rs#L271

-                                     content: dns_proof.clone(),
+                                     content: format!("\"{}\"",dns_proof.clone()),

I have set the Polling interval: 30s , the Propagation timeout: 2m and the TTL: 5m (which will not be used, at least what I have seen).

I see two issues:

It looks to me that the ttl value isn't given to the ChallengeSettings::Dns01 {) ( https://github.com/stalwartlabs/stalwart/blob/main/crates/common/src/listener/acme/order.rs#L238 ) in async fn authorize(...) ( https://github.com/stalwartlabs/stalwart/blob/main/crates/common/src/listener/acme/order.rs#L173 )
The TXT must be quoted at least for deSEC, maybe for the other Provider also 🤷‍♂️.
- the formatting is fixed with PR Add format for TXT for desec dns-update#21

What's the stalwart community opinion on that?

10 replies

pepa65 Sep 23, 2025

Can you force the TTL to be at least 3600? Otherwise deSec will not accept it.

darkknight7777777 Sep 23, 2025

Yes, I have tried that.

pepa65 Sep 23, 2025

I would just use 3600 not 4600, just in case they only accept certain values, like in their webinterface. And yes, make sure the TXT fields are surrounded by double-quotes at deSec.

darkknight7777777 Sep 23, 2025

I'm getting the same error in the original post "Bad Request", so it's not getting as far as creating the TXT at desec.

2025-09-23T18:36:31Z DEBUG ACME renew backoff (acme.renew-backoff) id = "desec1", hostname = ["*.example.com"], total = 2, nextRetry = 4, causedBy = ACME DNS record creation failed (acme.dns-record-creation-failed) { id = "desec1", hostname = "_acme-challenge.example.com", details = "example.com", reason = "Bad request" }

[acme."desec"]
directory = "https://acme-staging-v02.api.letsencrypt.org/directory"
challenge = "dns-01"
contact = ["[email protected]"]
provider = "desec"
domains = ["*.example.com"]
renew-before = "30d"
secret = "secret"
ttl = "3600"

git001 Sep 23, 2025
Author

As I mentioned in the original message it looks to me that the ttl value isn't handover to the DNS update function. It would be nice to add the handover data to the debug output for easier debugging.

Maybe the https://github.com/stalwartlabs/dns-update/ isn't used in the latest version where the Bad Request output was added with the API Output in that commit stalwartlabs/dns-update@101be18

git001 · 2025-09-09T10:45:08Z

git001
Sep 9, 2025
Author

Maybe wrong analysis from me. let's close the discussion for now. Imho

0 replies

CC3301 · 2025-09-10T16:33:53Z

CC3301
Sep 10, 2025

I have the exact same issue. Are you currently running the changes you suggested with a locally built version of stalwart?

1 reply

git001 Sep 10, 2025
Author

I have not bring the setup into prod. I'm still evaluating the move from dovecot to stalwart.

Uh oh!

TLS ACME provider deSEC returns "Bad request" #2098

Uh oh!

Uh oh!

Replies: 7 comments · 15 replies

Uh oh!

git001 Sep 5, 2025 Author

Uh oh!

git001 Sep 6, 2025 Author

Uh oh!

git001 Sep 6, 2025 Author

Uh oh!

Uh oh!

git001 Sep 7, 2025 Author

Uh oh!

git001 Sep 6, 2025 Author

Uh oh!

Uh oh!

Uh oh!

git001 Sep 7, 2025 Author

Uh oh!

Uh oh!

git001 Sep 6, 2025 Author

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

git001 Sep 23, 2025 Author

Uh oh!

git001 Sep 9, 2025 Author

Uh oh!

Uh oh!

git001 Sep 10, 2025 Author

Replies: 7 comments 15 replies

git001
Sep 5, 2025
Author

git001
Sep 6, 2025
Author

git001
Sep 6, 2025
Author

git001 Sep 7, 2025
Author

git001
Sep 6, 2025
Author

git001 Sep 7, 2025
Author

git001
Sep 6, 2025
Author

git001 Sep 23, 2025
Author

git001
Sep 9, 2025
Author

git001 Sep 10, 2025
Author