Hello, we are evaluating the Hub version 7.1.1 fonctionality which are very promising
I was able to request certificates to Let’s Encrypt and another online CA using Online DNS challanges
Now I’m trying to integrate our internal PKI and internal Microsoft DNS for the challange
In Managed Challanges, I create a new Challange using DNS01.API.MSDNS as provider. Hub and DNS servers are in the same domain, and same subnet (no filters). I tested many options, even with a user in the Domain Admin group, but it fails alway.
When I click in the Zone Lookup box, I got this error:
Dns Zone Lookup failed: Failed to create provider while fetching DNS Zones using DNS01.API.MSDNS
I made sure as well that the domain is set in the stored credentials
Do you have an hint ? what did I do wrong ?
Thank you for your help
Best regards
Patrick
Hi Patrick,
The MS DNS provider is one of our older community contributed DNS providers but we haven’t heard of any recent issues with it, however that could be that not many people are using it.
The source code is here: certify/src/Certify.Providers/DNS/MSDNS/DnsProviderMSDNS.cs at development · webprofusion/certify · GitHub
It can fail to load if the machine is unable to load the required dependencies:
- Microsoft.Management.Infrastructure
- If the hub/instance is on Linux where windows specific things aren’t supported
Generally if the machine has been used for DNS administration these dependencies (or any nested DCOM references etc) will be met already.
An alternative workaround is to script your own DNS updates: DNS Scripting | Certify The Web Docs
Hi,
Thank you very much for your quick answer
Yes, it’s probably related to M.M.I. The Hub is running on a new Windows 2025 OS
I was looking at the scripts alternatves as well. I can see a “Windows.PS1” script in the PoshACME Plugins folder
Would it be supported to use it ?
Can it be added to the Challenge Provider list, like other plugins xxxxx(using Posh-ACME)?
Thank you
Best regards
Patrick
Yes you could start by referencing that script and using it for custom scripting.
We will look into enabling that via Posh-ACME directly but I suspect the main issue would that our process by default runs under local system and won’t be able to impersonate across the network, so the next problem would be that you’d have to migrate to running the service under another account (a user in Administrators usually) Change the Background Service User (Windows) | Certify The Web Docs which has it’s own complications.