Messages

Last Update.

Problem lies within the ACME Account-Config, in my case LetsEncrypt.
acme.sh saves credantials it needs for validation under /var/etc/acme-client/accounts/<ACME-Account>/account.conf

It had a "SAVED_AZUREDNS_BEARERTOKEN", that was old and "SAVED_AZUREDNS_TOKENVALIDTO", that was 0.
So it used the invalid token without even checking.

Removing those lines fixed the issue (at least on 24.7.12_4)

New Config contains an emtpy "SAVED_AZUREDNS_BEARERTOKEN", a valid "SAVED_AZUREDNS_ACCESSTOKEN" and a proper "SAVED_AZUREDNS_TOKENVALIDTO".
Creating a new Account should have fixed the issue as well.

As a side note, for FreeDNS acme.sh. puts a cookie in that file.
That also stopped working eventually.

Probably an Edge-case, depending on the verion we set AzureDNS up.
OPNsense versions with acme.sh 3.10 should be fine for new setups.

not so quick and very dirty Workaround:

1) log into Azure using poswershell with App-IP/Secret/Tennant-ID thats used in the Plugin

Code Select Expand

az login --service-principal -u <AppID> -p <AppSecret> --tenant <TenantID>2) get the current AuthToken

Code Select Expand

az account get-access-token3) add the Token as an export

Code Select Expand

vi /usr/local/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsAzure.php
add $this->acme_env['AZUREDNS_BEARERTOKEN'] = "String from 2)"4) rerun Validation within 1 Hour (see "expiresOn" in 2)

5) hope for a fix or look for another validation Method

If I read this right, bearer token should only be used if it exists:
https://github.com/acmesh-official/acme.sh/blob/master/dnsapi/dns_azure.sh

I think that change is making issues:

https://github.com/acmesh-official/acme.sh/pull/5276

Same issue here.
It broke around early November.

Same User/Token is used on multiple OPNsense and pfSense installations.
All OPNsense stopped working around November, all pfSense still work today.
Manually using the Azure-API through Powershell with the same User/Token also works.

Following log Entry is probably the Key here:

Code Select Expand

[Thu Jan 16 12:23:59 CET 2025] response {"error":{"code":"ExpiredAuthenticationToken","message":"The access token expiry UTC time '11/1/2024 3:15:32 AM' is earlier than current UTC time '1/16/2025 11:23:59 AM'."}}='[hidden](please add '--output-insecure' to see this value)'The original Key is valid until 07/2025
I created a new Key, (valid until 01/2027) but the Error did not change.

I think the "AuthenticationToken" is not the Key, that is created in Azure and configured in the Plugin, but a token that should be renewed when authentication is succsessfull.

I could be wrong.

There were some Updates to AzureDNS in November.
https://azure.microsoft.com/en-us/updates?filters=%5B%22Azure+DNS%22%5D