dns_namecheap submits invalid CAA records to the Namecheap API

[ElizabethCody]

The dnsapi dns_namecheap sends invalid CAA records to the Namecheap API.

Steps to reproduce

1. Attempt to obtain a certificate using dns_namecheap on a domain that has existing CAA records.
2. Observe the process failing.

Relevant logs

The API response signifying the invalid CAA record:

--snip--
[Tue Jun 30 16:54:23 CDT 2020] response='<?xml version="1.0" encoding="utf-8"?>
<ApiResponse Status="ERROR" xmlns="http://api.namecheap.com/xml.response">
  <Errors>
    <Error Number="2050900">CAA record with tag "issue" has incorrect value.</Error>
  </Errors>
  <Warnings />
  <RequestedCommand>namecheap.domains.dns.sethosts</RequestedCommand>
  <CommandResponse Type="namecheap.domains.dns.setHosts">
    <DomainDNSSetHostsResult Domain="cody.sh" EmailType="" IsSuccess="false">
      <Warnings />
    </DomainDNSSetHostsResult>
  </CommandResponse>
  <Server>PHX01APIEXT02</Server>
  <GMTTimeDifference>--4:00</GMTTimeDifference>
  <ExecutionTime>0.223</ExecutionTime>
</ApiResponse>'
[Tue Jun 30 16:54:23 CDT 2020] error CAA record with tag "issue" has incorrect value.
[Tue Jun 30 16:54:23 CDT 2020] CAA record with tag "issue" has incorrect value.
--snip--

Elsewhere in the logs you can see the script is using data that has undecoded HTML entities. I reckon this is what's causing the issue:

--snip--
[Tue Jun 30 16:54:22 CDT 2020] _host='<host HostId="206913321" Name="@" Type="CAA" Address="0 issue &quot;letsencrypt.org&quot;" MXPref="10" TTL="60" AssociatedAppTitle="" FriendlyName="" IsActive="true" IsDDNSEnabled="false" /'
[Tue Jun 30 16:54:22 CDT 2020] hostid='206913321'
[Tue Jun 30 16:54:22 CDT 2020] hostname='@'
[Tue Jun 30 16:54:22 CDT 2020] hosttype='CAA'
[Tue Jun 30 16:54:22 CDT 2020] hostaddress='0 issue &quot;letsencrypt.org&quot;'
[Tue Jun 30 16:54:22 CDT 2020] hostmxpref='10'
[Tue Jun 30 16:54:22 CDT 2020] hostttl='60'
--snip--

[auto-comment]

If this is a bug report, please upgrade to the latest code and try again:
如果有 bug, 请先更新到最新版试试:
acme.sh --upgrade
please also provide the log with --debug 2.
同时请提供调试输出 --debug 2
see: https://github.com/acmesh-official/acme.sh/wiki/How-to-debug-acme.sh
Without --debug 2 log, your issue will NEVER get replied.
没有调试输出, 你的 issue 不会得到任何解答.

[ElizabethCody]

Tagging @EverPresent who seems to be the point of contact on dns_namecheap issues (#2107).

[ElizabethCody]

Changing

acme.sh/dnsapi/dns_namecheap.sh

Line 211 in 71a5f0e

_hostaddress=$(echo "$_host" | _egrep_o ' Address="[^"]*' | cut -d '"' -f 2)

to

  _hostaddress=$(echo "$_host" | _egrep_o ' Address="[^"]*' | cut -d '"' -f 2 | recode html..ascii)

fixes the issue for me, but this is more of a hacky workaround for users than it is a permanent solution for the project since it would add a dependency on recode, which would require an additional package install on most platforms.

[ElizabethCody]

Perhaps a more permanent solution would be to add some sort of HTML entity decoder into the main acme.sh script.

[maveick2880]

I can confirm I have the same issue, did @EverPresent respond to you regarding this ?

[ElizabethCody]

I can confirm I have the same issue, did @EverPresent respond to you regarding this ?

I have not had any correspondence with @EverPresent or any of the project's contributors or maintainers regarding this issue.

[maveick2880]

I have attempted to apply the workaround you have posted however when I use it I get this error, /usr/local/pkg/acme/acme.sh: recode: not found & error Invalid Address

[ElizabethCody]

I have attempted to apply the workaround you have posted however when I use it I get this error, /usr/local/pkg/acme/acme.sh: recode: not found & error Invalid Address

You need to have recode installed.

It's available on many platforms' package repositories.

Platform	Command
Debian Ubuntu Linux Mint Pop!_OS Proxmox VE	sudo apt install recode
CentOS 7 RHEL 7 Oracle Linux 7 Scientific Linux	sudo yum install recode
Fedora CentOS Stream CentOS 8 RHEL 8 Oracle Linux 8 Rocky Linux	sudo dnf install recode
FreeBSD pfSense OPNSense	sudo pkg install recode
Arch Linux	sudo pacman -S recode
openSUSE	sudo zypper install recode

[Neilpang]

Changing

acme.sh/dnsapi/dns_namecheap.sh

Line 211 in 71a5f0e

_hostaddress=$(echo "$_host" | _egrep_o ' Address="[^"]*' | cut -d '"' -f 2)

to

  _hostaddress=$(echo "$_host" | _egrep_o ' Address="[^"]*' | cut -d '"' -f 2 | recode html..ascii)

fixes the issue for me, but this is more of a hacky workaround for users than it is a permanent solution for the project since it would add a dependency on recode, which would require an additional package install on most platforms.

@MaxwellCody

Can you please show me the value of "$host" and the value of the result $_hostaddress ?
Maybe I can fix it.

[ElizabethCody]

@Neilpang You can see those values in the main issue.

Here they are:

_host='<host HostId="206913321" Name="@" Type="CAA" Address="0 issue &quot;letsencrypt.org&quot;" MXPref="10" TTL="60" AssociatedAppTitle="" FriendlyName="" IsActive="true" IsDDNSEnabled="false" /'

hostaddress='0 issue "letsencrypt.org"'

The dns-namecheap script is pulling out data with undecoded XML entities (notice the instances of "), they need to be decoded because the existing DNS records need to be specified in the subsequent API request's query string.

[maveick2880]

Just updated to 0.6.8_2 looks like CAA is now working, need to test a little more but so far so good!

[bigalownz]

Changing

acme.sh/dnsapi/dns_namecheap.sh

Line 211 in 71a5f0e

_hostaddress=$(echo "$_host" | _egrep_o ' Address="[^"]*' | cut -d '"' -f 2)

to

  _hostaddress=$(echo "$_host" | _egrep_o ' Address="[^"]*' | cut -d '"' -f 2 | recode html..ascii)

fixes the issue for me, but this is more of a hacky workaround for users than it is a permanent solution for the project since it would add a dependency on recode, which would require an additional package install on most platforms.

had the same problem and this worked for me too

[danieljkemp]

I just tested this, and the bug still exists. The hack workaround is functional.

I ended up here by way of Proxmox, which is using the dns plugins from this project.

[Neilpang]

please update to latest code and try again.

acme.sh --upgrade -b dev

[plotters]

I can confirm that using the Dev branch it works now. Thanks @Neilpang @MaxwellCody

please update to latest code and try again.

acme.sh --upgrade -b dev