Windows ServerでLet's EncryptのDNS認証を試みて失敗した話

 1I created scripts to do this that work on server 2012.
 2As my server is behind a firewall this turned out to be the wrong method to use, but you may find them useful.
 3Replace DNSServer with the name of your DNSserver and repeat that line if you have more than one server.
 4Replace YourZoneName with your domain name.
 5
 6create-dns.bat:
 7powershell -file ./create-dns.ps1 %1 %2 %3
 8
 9create-dns.ps1:
10Import-module dnsserver
11Add-DnsServerResourceRecord -Name $args[1] -Computername DNSServer-TXT -ZoneName "YourZoneName" -DescriptiveText $args[2]
12
13delete-dns.bat:
14powershell -file ./delete-dns.ps1 %1 %2
15
16delete-dns.ps1:
17Import-module dnsserver
18Remove-DnsServerResourceRecord -Force -Computername DNSServer-ZoneName "YourZoneName" -RRType "Txt" -Name $args[1]

  1 [INFO] A Simple ACME Client for Windows (WACS)
  2 [INFO] Software version 1911.2.6726.40690 (RELEASE)
  3 [INFO] IIS version 10.0
  4 [INFO] ACME server https://acme-v01.api.letsencrypt.org/
  5 [INFO] Please report issues at https://github.com/PKISharp/win-acme
  6
  7 N: Create new certificate
  8 M: Create new certificate with advanced options
  9 L: List scheduled renewals
 10 R: Renew scheduled
 11 S: Renew specific
 12 A: Renew *all*
 13 V: Revoke certificate
 14 C: Cancel scheduled renewal
 15 X: Cancel *all* scheduled renewals
 16 Q: Quit
 17
 18 Please choose from the menu: m
 19
 20 [INFO] Running in Advanced mode
 21
 22 1: Single binding of an IIS site
 23 2: SAN certificate for all bindings of an IIS site
 24 3: SAN certificate for all bindings of multiple IIS sites
 25 4: Manually input host names
 26 C: Cancel
 27
 28 Which kind of certificate would you like to create?: 4
 29
 30 Enter comma-separated list of host names, starting with the primary one: hoge2.frudens.app
 31
 32 [INFO] Plugin Manual generated target [Manual] [1 binding - hoge2.frudens.app]
 33
 34 1: [dns-01] Azure DNS
 35 2: [dns-01] Run external program/script to create and update records
 36 3: [http-01] Save file on local (network) path
 37 4: [http-01] Self-host verification files (recommended)
 38 5: [http-01] Upload verification file to FTP(S) server
 39 6: [http-01] Upload verification file to WebDav path
 40 C: Cancel
 41
 42 How would you like to validate this certificate?: 2
 43
 44 Path to script that creates DNS records. Parameters passed are the hostname, record name and token: scripts\create-dns.bat
 45
 46 Path to script that deletes DNS records. Parameters passed are the hostname and record name: scripts\delete-dns.bat
 47
 48 1: Create or update ftps bindings in IIS
 49 2: Create or update https bindings in IIS
 50 3: Do not run any installation steps
 51 4: Run a custom script
 52 C: Cancel
 53
 54 Which installer should run for the certificate?: 3
 55
 56 [INFO] Authorize identifier: hoge2.frudens.app
 57 [INFO] Authorizing hoge2.frudens.app using dns-01 validation (DnsScript)
 58 [INFO] Script scripts\create-dns.bat starting with parameters hoge2.frudens.app _acme-challenge.hoge2.frudens.app hw6PTBqElAV9MUhPjNVavDu948jnQ1PGLDeilb6kVnU [INFO]
 59C:\Users\teruhirokomaki\Desktop\win-acme.v1.9.11.2>powershell.exe -ExecutionPolicy RemoteSigned -File .\scripts\create-dns.ps1 hoge2.frudens.app _acme-challenge.hoge2.frudens.app hw6PTBqElAV9MUhPjNVavDu948jnQ1PGLDeilb6kVnU
 60
 61 [WARN] Script execution timed out after 5 minutes, will keep running in the background
 62 [INFO] Answer should now be available at _acme-challenge.hoge2.frudens.app
 63 [INFO] Script scripts\delete-dns.bat starting with parameters hoge2.frudens.app _acme-challenge.hoge2.frudens.app
 64 [EROR] Script error: Remove-DnsServerResourceRecord : Failed to get the zone information for hoge2.frudens.app on server DNSServer-ZoneName.
 65 [EROR] Script error: At C:\Users\teruhirokomaki\Desktop\win-acme.v1.9.11.2\scripts\delete-dns.ps1:2 char:1
 66 [EROR] Script error: + Remove-DnsServerResourceRecord -Force -Computername DNSServer-ZoneNam ...
 67 [EROR] Script error: + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 68 [EROR] Script error:     + CategoryInfo          : NotSpecified: (_acme-challenge.hoge2.frudens.app:root/Microsoft/...rResourceRecord) [Rem
 69 [EROR] Script error:    ove-DnsServerResourceRecord], CimException
 70 [EROR] Script error:     + FullyQualifiedErrorId : WIN32 1722,Remove-DnsServerResourceRecord
 71 [INFO]
 72C:\Users\teruhirokomaki\Desktop\win-acme.v1.9.11.2>powershell.exe -ExecutionPolicy RemoteSigned -File .\scripts\delete-dns.ps1 hoge2.frudens.app _acme-challenge.hoge2.frudens.app
 73Error: Remove-DnsServerResourceRecord : Failed to get the zone information for hoge2.frudens.app on server DNSServer-ZoneName.
 74Error: At C:\Users\teruhirokomaki\Desktop\win-acme.v1.9.11.2\scripts\delete-dns.ps1:2 char:1
 75Error: + Remove-DnsServerResourceRecord -Force -Computername DNSServer-ZoneNam ...
 76Error: + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 77Error:     + CategoryInfo          : NotSpecified: (_acme-challenge.hoge2.frudens.app:root/Microsoft/...rResourceRecord) [Rem
 78Error:    ove-DnsServerResourceRecord], CimException
 79Error:     + FullyQualifiedErrorId : WIN32 1722,Remove-DnsServerResourceRecord
 80
 81 [EROR] Error authorizing [Manual] [1 binding - hoge2.frudens.app]
 82 [EROR] AcmeWebException: Unexpected error
 83 +Response from server:
 84        + Code: BadRequest
 85        + Content: {
 86  "type": "urn:acme:error:badNonce",
 87  "detail": "JWS has invalid anti-replay nonce Y50_OdnTDpPBS4zJ10kh7_iojVNWr_hScGKEUl2w2rI",
 88  "status": 400
 89}
 90 [EROR] Create certificate failed
 91
 92 N: Create new certificate
 93 M: Create new certificate with advanced options
 94 L: List scheduled renewals
 95 R: Renew scheduled
 96 S: Renew specific
 97 A: Renew *all*
 98 V: Revoke certificate
 99 C: Cancel scheduled renewal
100 X: Cancel *all* scheduled renewals
101 Q: Quit