From 0b38604db91b3aac3ae75f6b52c878335326a1fa Mon Sep 17 00:00:00 2001 From: Kevin Wang Date: Thu, 15 Oct 2026 18:33:27 -0700 Subject: [PATCH] fix(ingress): skip the issuance retry when no account was created The retry after the CAA write is for a fresh account refused by a CAA naming an earlier one. It checked only that the account was missing before the first attempt, so when that attempt never got as far as creating one -- the CA unreachable, say -- it still ran a second certbot and logged that the CAA now names the new account, which it does not. Also require the account to exist after the first attempt. Signed-off-by: Kevin Wang --- custom-domain/dstack-ingress/scripts/dns01.sh | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/custom-domain/dstack-ingress/scripts/dns01.sh b/custom-domain/dstack-ingress/scripts/dns01.sh index 2090c64..c3e35b5 100644 --- a/custom-domain/dstack-ingress/scripts/dns01.sh +++ b/custom-domain/dstack-ingress/scripts/dns01.sh @@ -303,7 +303,7 @@ process_domain() { fi # The CAA record names our ACME account, so the account has to exist first: - # try once, write CAA, and try again if the first attempt failed while + # try once, write CAA, and try again if the first attempt failed after # creating the account. That is the attempt a CAA record naming an earlier # account refuses, and set_caa_record has just replaced it. Any other # failure would only fail again, spending another of Let's Encrypt's five @@ -316,8 +316,11 @@ process_domain() { set_caa_record "$domain" # Never after a success (0) or "nothing to renew" (2): a second attempt - # would issue another certificate whenever renewal is due. - if [ "$retry" = true ] && [ "$status" -ne 0 ] && [ "$status" -ne 2 ]; then + # would issue another certificate whenever renewal is due. Nor when the + # attempt did not get as far as creating the account (the CA unreachable, + # say): then there is no CAA naming it either. + if [ "$retry" = true ] && [ "$status" -ne 0 ] && [ "$status" -ne 2 ] && + acme_account_file >/dev/null 2>&1; then echo "First certificate attempt failed for $domain, retrying now that the CAA record names the new account" if issue_certificate "$domain"; then status=0; else status=$?; fi fi