Home Assistant: ERROR: rfc2136_sign_query is not supported since Letsencrypt Home Assistant App v6.0.0.

My Home Assistant started sending me a daily warning: Let’s Encrypt certificate is expiring in 29 days, 28 days, 27 days - until I finally found time to investigate why the certificate is not renewing.

My setup

My Home Assistant (HA) runs on Proxmox and is only using an internal IP in my home network. The system is not exposed to the Internet, intentionally. It is however using a certificate to encrypt the traffic. I’m using a DNS Challenge to update the certificate.

The problem

This setup stopped working after a recent Home Assistant Update. More specifically, it didn’t like the dns.rfc2136_sign_query setting anymore. This happened when HA moved all in on certbot.

At first I didn’t spot the problem, everything seemed to work after the upgrade. A couple weeks later, the task stated triggering. The one I wrote to keep an eye on the certificate, and warn me if the remaining valid time is running low.

When checking the logs for the Let’s Encrypt integration, I found the following error:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

s6-rc: info: service s6rc-oneshot-runner: starting
s6-rc: info: service s6rc-oneshot-runner successfully started
s6-rc: info: service fix-attrs: starting
s6-rc: info: service fix-attrs successfully started
s6-rc: info: service legacy-cont-init: starting
cont-init: info: running /etc/cont-init.d/file-structure.sh
[21:03:14] ERROR: rfc2136_sign_query is not supported since Letsencrypt Home Assistant App v6.0.0.
cont-init: info: /etc/cont-init.d/file-structure.sh exited 1
cont-init: warning: some scripts exited nonzero
s6-rc: warning: unable to start service legacy-cont-init: command exited 1
/run/s6/basedir/scripts/rc.init: warning: s6-rc failed to properly bring all the services up! Check your logs (in /run/uncaught-logs/current if you have in-container logging) for more information.
/run/s6/basedir/scripts/rc.init: fatal: stopping the container.
s6-rc: info: service fix-attrs: stopping
s6-rc: info: service fix-attrs successfully stopped
s6-rc: info: service s6rc-oneshot-runner: stopping
s6-rc: info: service s6rc-oneshot-runner successfully stopped

The crucial part:

ERROR: rfc2136_sign_query is not supported since Letsencrypt Home Assistant App v6.0.0.

Couldn’t really figure out what was going on with this rfc2136_sign_query setting. It is in the DNS settings for Let’s Encrypt, but was ticked off. Nevertheless this prevented the renew of the certificate. Tried enabling and disabling it again, to no avail.

The bugfix

In the end, I opened the Let’s Encrypt YAML configuration.

Go to Settings -> Apps -> Let's Encrypt -> Configuration -> click the three dots (︙) -> Edit in YAML

And found the following:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

keyfile: privkey.pem
certfile: fullchain.pem
challenge: dns
dns:
  provider: dns-rfc2136
  rfc2136_algorithm: hmac-sha512
  rfc2136_name: letsencrypt-topsecret
  rfc2136_port: "53"
  rfc2136_secret: >-
    ==topsecret==
  rfc2136_server: xxx.xxx.xxx.xxx
  rfc2136_sign_query: false
domains:
  - homeassistant.domain
email: me@ha.test
verbose: true
force_renew: true

There is a rfc2136_sign_query: false setting in the configuration. Apparently, and based on this code, that’s enough to throw the integration off the rails.

Removed the line, saved the YAML, restarted the app and a couple minutes later my certificate was renewed.

Comments

With an account on the Fediverse or Mastodon, you can respond to this post. Known replies are displayed below:

Load Comments from Fediverse

Note: This will load data from mastodon.social.

Learn how this is implemented here.