On Tue, Oct 27, 2026 at 10:00:04AM +0000, Dave Cottlehuber wrote: > Subject: Re: [PATCH 2/2] BUG/MEDIUM: acme: only mark one challenge as ready > per call > On Sun, 27 Sep 2026, at 11:05, Jérôme Billiras wrote: > > Hi William, > > > > Good question. I used Let's Encrypt, both staging and production; > > I haven't tested against another CA (ZeroSSL, Google Trust Services, > > ...), so I can't say whether they'd behave the same way. > > > > I went back and dug a bit after your message, since I wanted to make > > sure I wasn't missing something obvious on my end. Their > > challenge-types page does mention this case [1]: > > > > "You can have multiple TXT records in place for the same name. For > > instance, this might happen if you are validating a challenge for a > > wildcard and a non-wildcard certificate at the same time." > > > > and a couple of threads on their community forum describe the same > > shape of issue: two distinct authorizations, each with its own token, > > sharing the same identifier value [2]. > > Thanks Jérôme & William > > I've experienced this too and IMHO it does need to be resolved, as there > is no way to disambiguate the events and communicate a per-FQDN failure > if one fails for some reason, but the other is successful. > > I wrote a blog post[1] about using 3.5-dev8 and it was a very positive > experience, this was the only wart I ran into. I've deployed it now > to all my homelab front ends! >
Thank you for your feedback, the fix is still on my radar, but I need to do more testing. > If my lua script[2] for CloudFlare is up to snuff I'd be happy to > contribute it back as a patch, maybe we can modularise the core > and just have small per-provider changes? The code is already quite small, but if it's possible to have a common part for all providers, why not. Don't hesitate to send a patch with your script, however we can't merge the Ansible part, it should only depend on haproxy/ Regards, -- William Lallemand
