From 7e5adb1b2ec8c90ff89b5e42984998ce477d14af Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Stephan=20D=C3=BCsterhaupt?= <me@stephanduesterhaupt.de>
Date: Sat, 4 Jul 2026 12:52:26 +0200
Subject: [PATCH] fix: check dns-01 TSIG key before ACME execution

---
 CHANGELOG.md | 10 ++++++++++
 dyntls.sh    |  8 ++++++++
 2 files changed, 18 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index abb7ae8..cc1cbcd 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,16 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## Unreleased
+
+### Added
+
+- Added an early dns-01 prerequisite check in certificate creation for wildcard certificates.
+
+### Fixed
+
+- Fixed silent failures for wildcard dns-01 runs by aborting certificate creation and logging a clear error when the configured TSIG/RNDC key file is missing.
+
 ## 1.0.0 - 2026-06-28
 
 ### Added
diff --git a/dyntls.sh b/dyntls.sh
index ae78efb..be11d32 100644
--- a/dyntls.sh
+++ b/dyntls.sh
@@ -1085,6 +1085,14 @@ _create_cert() {
     if echo "$DYNTLS_SAN_LIST" | grep -E -q '(^\*\.)|( \*\.)'; then
         DYNTLS_DNS_ZONE=$(_Hostname get domain)
         _log "Wildcard detected in SAN list; using dns-01 challenge for zone '$DYNTLS_DNS_ZONE'." 1
+
+        _log "Check for dns-01 TSIG/RNDC key." 1
+        if [ ! -r "$DYNTLS_DNS_TSIG" ]; then
+            _log "dns-01 TSIG/RNDC key not readable: '$DYNTLS_DNS_TSIG'; cannot perform dns-01 challenge." 4
+            rm -f "$out_file_tmp"
+            return 1
+        fi
+
         DYNTLS_DNS_OPTIONS="$DYNTLS_DNS_OPTIONS -l dns-01 -d $DYNTLS_DNS_SERVER -t $DYNTLS_DNS_TSIG -z $DYNTLS_DNS_ZONE"
         _log "DNS challenge options: -l dns-01 -d $DYNTLS_DNS_SERVER -t $DYNTLS_DNS_TSIG -z $DYNTLS_DNS_ZONE" 1
     else