April 15, 2026, 10:45pm 1

We have run this command with PowerShell with the url matched to the server on several servers for the past 5+ years with no issues. Now it fails and am unable to determine the cause.

My domain is:
https://agdev05.esmsportal.com

I ran this command:
Submit-Renewal agdev05.esmsportal.com

It produced this output:

Submit-ChallengeValidation : {"error": "db_error"}
At C:\Program Files\WindowsPowerShell\Modules\Posh-ACME\4.31.0\Public\New-PACertificate.ps1:275 char:9

•     Submit-ChallengeValidation
  

•     ~~~~~~~~~~~~~~~~~~~~~~~~~~
  

  • CategoryInfo : InvalidOperation: (System.Net.HttpWebRequest:HttpWebRequest) [Submit-ChallengeValidation
    ], WebException
  • FullyQualifiedErrorId : WebCmdletWebResponseException,Submit-ChallengeValidation

The {"error": "db_error"} string in the error message there is probably coming from acme-dns.

When I try to invoke the /register endpoint I get the following error back from auth.acme-dns.io:

{"error": "database or disk is full"}

You could try opening an issue on their issue tracker, but note that they actually recommend hosting your own instance of acme-dns instead of relying on auth.acme-dns.io. Clarification on usage of https://auth.acme-dns.io · Issue #120 · acme-dns/acme-dns · GitHub

3 Likes

There's the installation section in the README: GitHub - acme-dns/acme-dns: Limited DNS server with RESTful HTTP API to handle ACME DNS challenges easily and securely. · GitHub

The Docker (compose) instructions seem pretty easy. You also have to setup the DNS as per the 'DNS Records' instructions.

I've never hosted this software myself so I can't help more with this.

I would recommend making sure you actually need acme-dns. If your DNS provider has an API then you might be able to use that. If you don't need wildcard certs then you can instead use the HTTP-01 challenge.

1 Like

@joe.roberts Looks like you have GoDaddy as your DNS provider. Their API was restricted but recently opened up again. @rmbolger posted about this here: GoDaddy API access policy update As Dexter noted this may be a better option than acme-dns.

Looks like Ryan could update his docs here GoDaddy - Posh-ACME

2 Likes

1 Like

There is a new challenge type called dns-persist-01 in the works. It is currently in Let's Encrypt Staging system with plans for production this quarter.

I am very sure posh-acme will support that as soon as LE production is ready (as will Certify).

The idea is you create a TXT record once and that persists for as long you like to satisfy cert renewals. That avoids needing a DNS API, acme-dns, and similar.

See: DNS-PERSIST-01: A New Model for DNS-based Challenge Validation - Let's Encrypt

Perhaps the dreaded manual DNS Challenge to get a fresh cert now to carry you until LE has production dns-persist ready? I say dreaded b/c automation is far better but perhaps to avoid having to setup a very temporary new DNS infrastructure it is worth it?

1 Like

Yes, that would provide some better options. DNS management can be a challenge when the provider doesn't provide the necessary tools!

Thanks again for information

1 Like

Certify DNS (which I develop, and which can be cheaply licensed month-to-month via Azure marketplace) is an option but as @MikeMcQ mentioned the upcoming dns-persist-01 looks like it's going to be a simpler overall option for DNS based validation.

[Edit: I see we have support ticket from you, will investigate that myself]

You do also have the option of self-hosting acme-dns (many people do) but that's an administrative/maintenance/hosting overhead.

The GoDaddy API would be theoretically ideal but it's had a checkered history and it's confusing to know if you do or don't have access. Note that your domain registrar does not need to be your DNS host and there are many good large scale DNS hosts that are low cost or free (e.g. AWS Route 53, Cloudflare). Cloudflare in particular offers a lot of features in their free tier.

2 Likes

Docs are updated in the dev branch already along with a GoDaddy plugin update to support corporate accounts. Just waiting for the next module release to push the doc updates live.

3 Likes

2 Likes