fix: check dns-01 TSIG key before ACME execution

CHANGELOG.md

@@ -5,6 +5,16 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## Unreleased
+
+### Added
+
+- Added an early dns-01 prerequisite check in certificate creation for wildcard certificates.
+
+### Fixed
+
+- Fixed silent failures for wildcard dns-01 runs by aborting certificate creation and logging a clear error when the configured TSIG/RNDC key file is missing.
+
 ## 1.0.0 - 2026-06-28
 
 ### Added

dyntls.sh

@@ -1085,6 +1085,14 @@ _create_cert() {
     if echo "$DYNTLS_SAN_LIST" | grep -E -q '(^\*\.)|( \*\.)'; then
         DYNTLS_DNS_ZONE=$(_Hostname get domain)
         _log "Wildcard detected in SAN list; using dns-01 challenge for zone '$DYNTLS_DNS_ZONE'." 1
+
+        _log "Check for dns-01 TSIG/RNDC key." 1
+        if [ ! -r "$DYNTLS_DNS_TSIG" ]; then
+            _log "dns-01 TSIG/RNDC key not readable: '$DYNTLS_DNS_TSIG'; cannot perform dns-01 challenge." 4
+            rm -f "$out_file_tmp"
+            return 1
+        fi
+
         DYNTLS_DNS_OPTIONS="$DYNTLS_DNS_OPTIONS -l dns-01 -d $DYNTLS_DNS_SERVER -t $DYNTLS_DNS_TSIG -z $DYNTLS_DNS_ZONE"
         _log "DNS challenge options: -l dns-01 -d $DYNTLS_DNS_SERVER -t $DYNTLS_DNS_TSIG -z $DYNTLS_DNS_ZONE" 1
     else