fix: check dns-01 TSIG key before ACME execution

2026-07-04 12:52:26 +02:00
parent a67ce8e38e
commit 7e5adb1b2e
2 changed files with 18 additions and 0 deletions
@@ -1085,6 +1085,14 @@ _create_cert() {
    if echo "$DYNTLS_SAN_LIST" | grep -E -q '(^\*\.)|( \*\.)'; then
        DYNTLS_DNS_ZONE=$(_Hostname get domain)
        _log "Wildcard detected in SAN list; using dns-01 challenge for zone '$DYNTLS_DNS_ZONE'." 1
+
+        _log "Check for dns-01 TSIG/RNDC key." 1
+        if [ ! -r "$DYNTLS_DNS_TSIG" ]; then
+            _log "dns-01 TSIG/RNDC key not readable: '$DYNTLS_DNS_TSIG'; cannot perform dns-01 challenge." 4
+            rm -f "$out_file_tmp"
+            return 1
+        fi
+
        DYNTLS_DNS_OPTIONS="$DYNTLS_DNS_OPTIONS -l dns-01 -d $DYNTLS_DNS_SERVER -t $DYNTLS_DNS_TSIG -z $DYNTLS_DNS_ZONE"
        _log "DNS challenge options: -l dns-01 -d $DYNTLS_DNS_SERVER -t $DYNTLS_DNS_TSIG -z $DYNTLS_DNS_ZONE" 1
    else