Let's Encrypt certificate on gandiv5 with Personal Access Token (PAT)

Traefik Traefik v2
1

Hi
I'm on Traefik version 2.10.7 on windows, trying to get let's encrypt working with gandi live DNS (gandi v5 REST API, last version)
I've been struggling with this for almost a week, and I think I found the issue

Following Lego instructions (Gandi Live DNS (v5) :: Let’s Encrypt client and ACME library written in Go.) and gandi's, the usage of API Key is now deprecated and should be replaced with PAT

Environment Variable Name Description
GANDIV5_API_KEY API key (Deprecated)
GANDIV5_PERSONAL_ACCESS_TOKEN Personal Access Token

When I try to use the PAT environment variable I got the error
"some credentials information are missing: GANDIV5_API_KEY"

When I use a PAT key with this variable, I got this error
"unable to generate a certificate for the domains [app.example.com]: error: one or more domains had a problem
acme: error presenting token: unable to get TXT records for domain example.com and name _acme-challenge.xray: 403: request failed: Access was denied to this resource"

So I think that acme client implementation in Traefik is not taking profit of the new PAT usage
(I could get a certificate with a certbot client and the PAT key, so PAT access is good)

Thanks for your help

2

Sorry, forgot to mention that this is for dnsChallenge (intrenal only application)

This is my trafic.yml

EntryPoints configuration

entryPoints:
web:
address: ":80"
http:
redirections:
entryPoint:
to: websecure
websecure:
address: ":443"

traefik:
address: ":8080"

TLS cert providers

certificatesResolvers:
c-letsencrypt:
acme:
certificatesDuration: 24 # in hours
dnsChallenge:
provider: gandiv5
delayBeforeCheck: 10
resolvers:
- "ns-237-a.gandi.net"
- "ns-170-b.gandi.net"

providers (router configuration in dynamic file)

providers:
file:
directory: "D:/Tools/Traefik"
watch: true

whatever I can get in the dynamic file doesn't change anything
only thing that works is API key with deprecated environment variable

3

It seems the LetsEncrypt library Traefik uses has not been updated yet (doc).

You would need to wait for the library to be updated and then Traefik to be updated.

For now you can use your created TLS certs via custom TLS in Traefik dynamic config file (doc).

4

Yes, this what I was thinking
Thanks

5

It seems it has been fixed in Lego 2.15, which still needs to be released (link, link).

Current Traefik is using 2.14, according to release notes (link).

6

This seems to be resolved, however Traefik is using the API URL of https://dns.api.gandi.net/api/v5/ instead of https://api.gandi.net/v5/livedns from the documentation - the former of which doesn’t work for me.

Is there anyway I can override this?

Thanks in advance!

EDIT: Traefik error from log below

ERR Unable to obtain ACME certificate for domains error="unable to generate a certificate for the domains [example.com .example.com]: error: one or more domains had a problem:\n[.example.com] [.example.com] acme: error presenting token: unable to get TXT records for domain example.com and name _acme-challenge: unable to communicate with the API server: error: Get "``https://dns.api.gandi.net/api/v5/domains/``example.com``/records/_acme-challenge/TXT\``": net/http: invalid header field value for "Authorization"\n[example.com] [example.com] acme: error presenting token: unable to get TXT records for domain example.com and name _acme-challenge: unable to communicate with the API server: error: Get "``https://dns.api.gandi.net/api/v5/domains/``example.com``/records/_acme-challenge/TXT\``": net/http: invalid header field value for "Authorization"\n" ACME CA=https://acme-staging-v02.api.letsencrypt.org/directory acmeCA=https://acme-staging-v02.api.letsencrypt.org/directory domains=["example.com",".example.com"] providerName=lets-encr.acme routerName=websecure-openwrt@file rule=Host(openwrt.example.com)

7

It needs to be fixed in the go-acme library, then the lib needs to be updated in Traefik.

8

Thanks, I have created an issue on the lego github. I was hoping there might be a bypass within Traefik to provide the API URL directly for the interim.

9

You already got an answer from the expert.

10

Thanks! And pleased they are active to set me on the right path, I seem to have solved it.
Believe that it was an issue with trailing whitespace on the PAT - the different API URLs was a red herring unfortunately.