Add DNS provider for NGENIX#3036
Draft
ldez wants to merge 14 commits intogo-acme:mainfrom
Draft
Conversation
ldez
added
enhancement
area/dnsprovider
waiting-for/user-tests
|
Hi. Details$ NGENIX_USERNAME="yyy@xxx.ru" \
NGENIX_PASSWORD="mepassword" \
NGENIX_CUSTOMER_ID="SSSSS" \
./dist/lego run --dns ngenix -d '*.xxx.ru' -d xxx.ru -s letsencrypt-staging
2026-05-05T09:31:38.612967853+08:00 INFO acme: Obtaining bundled SAN certificate. domains="*.xxx.ru, xxx.ru"
2026-05-05T09:31:39.968921478+08:00 INFO acme: Could not find the solver. domain=xxx.ru type=tls-alpn-01
2026-05-05T09:31:39.968940578+08:00 INFO acme: Could not find the solver. domain=xxx.ru type=http-01
2026-05-05T09:31:39.968961178+08:00 INFO dns01: preparing to solve the challenge. domain=*.xxx.ru
2026-05-05T09:31:40.479861356+08:00 INFO dns01: preparing to solve the challenge. domain=xxx.ru
2026-05-05T09:31:40.580089377+08:00 INFO dns01: cleaning DNS-01 challenge. domain=*.xxx.ru
2026-05-05T09:31:40.678305204+08:00 WARN acme: cleaning up failed. domain=*.xxx.ru error="ngenix: list DNS zones: API error 0: Provided authorization is not valid"
2026-05-05T09:31:40.678337104+08:00 INFO dns01: cleaning DNS-01 challenge. domain=xxx.ru
2026-05-05T09:31:40.778771724+08:00 WARN acme: cleaning up failed. domain=xxx.ru error="ngenix: list DNS zones: API error 0: Provided authorization is not valid"
2026-05-05T09:31:41.037679404+08:00 INFO Deactivating authorization. url=https://acme-staging-v02.api.letsencrypt.org/acme/authz/289267084/1010887374
2026-05-05T09:32:12.566726440+08:00 INFO Deactivating authorization. url=https://acme-staging-v02.api.letsencrypt.org/acme/authz/289267084/1010887384
2026-05-05T09:32:12.833444004+08:00 ERROR Error error="obtain certificate: error: one or more domains had a problem:\n[*.xxx.ru] [*.xxxru] dns01: error presenting token: ngenix: list DNS zones: API error 0: Provided authorization is not valid\n[xxx.ru] [xxx.ru] dns01: error presenting token: ngenix: list DNS zones: API error 0: Provided authorization is not valid\n"P.S. xxx.ru - this is a modified domain. |
Member
Author
|
Can you try this two commands? You should replace curl -u "NGENIX_USERNAME/token:NGENIX_PASSWORD" -X GET 'https://api.ngenix.net/api/v3/whoami'curl -u "NGENIX_USERNAME/token:NGENIX_PASSWORD" -X GET 'https://api.ngenix.net/api/v3/dns-zone?customerId=NGENIX_CUSTOMER_ID' |
These commands won't work. The token isn't a password, it's an API token. I have a working script that works. Here's the code: DetailsObtaining zones and their IDs curl -u "123@xxx.ru/token:my_API_token" "https://api.ngenix.net/api/v3/dns-zone?customerId=SSSSS"Result: {"elements": [{"links": {"self": "https://api.ngenix.net/api/v3/dns-zone/1111111"}, "id": 1111111, "name": "testxxx.ru", "hints": {"dnssec": {"enabled": false}}, "modelName": "DnsZoneCollectionView"}, {"links": {"self": "https://api.ngenix.net/api/v3/dns-zone/2222222"}, "id": 2222222, "name": "xxx.ru", "hints": {"dnssec": {"enabled": false}}, "modelName": "DnsZoneCollectionView"}, {"links": {"self": "https://api.ngenix.net/api/v3/dns-zone/3333333"}, "id": 3333333, "name": "xxx2.ru", "hints": {"dnssec": {"enabled": false}}, "modelName": "DnsZoneCollectionView"}], "modelName": "Collection"}Obtaining a zone by the received ID curl -s -u "123@xxx.ru/token:my_API_token" "https://api.ngenix.net/api/v3/dns-zone/2222222" | jq '.records' > /tmp/test_records.jsonRemove the read-only parameter and add the TXT record We patch the updated file for the entire zone on the hosting curl -v -u "123@xxx.ru/token:my_API_token" -X PATCH -H "Content-Type: application/json" -H "accept: application/json" -d "{\"records\":$(cat /tmp/test_updated.json)}" "https://api.ngenix.net/api/v3/dns-zone/2222222"On hosting, the minimum TTL is 300 seconds. After adding a record to the DNS zone, you need to wait 300 seconds (the hosting recommendation is 600 seconds), then request a certificate, and then clear the zone. Clearing the file of records We patch the updated file of the entire zone on the hosting (cleaned) curl -v -u "123@xxx.ru/token:my_API_token" -X PATCH -H "Content-Type: application/json" -H "accept: application/json" -d "{\"records\":$(cat /tmp/test_clean.json)}" "https://api.ngenix.net/api/v3/dns-zone/2222222"This is part of a script that is manually edited as a reminder for two zones xxx.ru in xxx2.ru, which is not very convenient and convenient. |
Member
Author
|
I will change the name of the env var from |
Yes, result: Details |
Member
Author
|
can you pull, build, and run again? Note: The env var name is now |
Details |
Member
Author
|
can you pull, build, and run again? |
Yes, here's the result, I looked in the control panel, the records were created and cleared successfully, but the certificate didn't work Details |
Member
Author
I think this is a propagation issue, I increased the propagation timeout. can you pull, build, and run again? |
TXT records are created and even visible to external services (mxtoolbox), but it seems to me that the cleanup is happening too early, judging by the log. Details |
Member
Author
|
I think NGENIX doesn't support multiple records for the same name. I changed the implementation. can you pull, build, and run again?
This is not that: the error in the last log happen before the cleaning, but lego reports the result of the process after the operations. |
Yes, result: Details |
Member
Author
This is a DNS error: try to change the resolvers. |
I checked with the hosting company about the recording format. The recording format should be _acme-challenge without specifying the domain. It adds it automatically, but now it turns out to be _acme-challenge.xxx.ru.xxx.ru |
Member
Author
This is how I initially implemented the thing, but based on your comment #3036 (comment) I changed it. I will revert the modifications. |
Member
Author
|
I reverted, so here we go again: pull, build, run |
While waiting on the neighboring server, the money team is now giving responses: Details |
Member
Author
This is still a DNS problem: when lego checks the propagation it call the recursive nameservers, but the answers are SERVFAIL. This problem is not a lego problem, but a network issue. |
Member
Author
|
We can try something I don't recommend: we will disable the recursive propagation check. NGENIX_USERNAME="xxx" \
NGENIX_PASSWORD="yyy" \
NGENIX_CUSTOMER_ID="zzz" \
./dist/lego run --dns ngenix -d '*.example.com' -d example.com -s letsencrypt-staging
--dns.propagation.disable-rns |
|
Good afternoon. Everything is working fine, but there were some local issues accessing the DNS servers. Details```2026-05-06T10:53:10.737510705+08:00 INFO acme: Obtaining bundled SAN certificate. domains=".xxx.ru, xxx.ru" |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #3035
Ping @Freack89, can you run the command with your domain, credentials, etc. (and put the output of this command to a comment)?
Note that the wildcard domain is important.
How to test this PR?
git clone https://github.com/ldez/lego.git cd lego git checkout feat/dns/ngenixmake:make buildmake:go build -o dist/lego ./cmd/lego