GetDNSZone from all azure subscription

[ruchi1803]

While running the renew certificate, the function throwing error:
Orchestrator function 'RenewCertificate_Orchestrator' failed: The orchestrator function 'IssueCertificate' failed: "The activity function 'Dns01Precondition' failed: "DNS zone(s) are not found. DnsNames

My key vault is in different subscription and dns zone in different subscription. I deployed this function app in same subscription as the DNS zone and updated the key vault URL in function configuration variable.

Is it the issue from function itself or am I missing something?

[shibayan]

Please check the following three points Please also refer to the Wiki documentation if necessary.

1. Deploy Acmebot in the same subscription as Azure Key Vault
2. Azure DNS Zone can exist in a separate subscription. The subscription ID can be specified in the configuration
3. Make sure that the RBAC configuration for the Azure DNS Zone is correct for Acmebot.

• https://github.com/shibayan/keyvault-acmebot/wiki/DNS-Provider-Configuration#azure-dns

[ruchi1803]

Thank you, this configuration worked, but while running function its failing with below error:

2023-09-28T10:30:42.956 [Error] Executed 'IssueCertificate' 
(Failed, Id=a754c4b1-1ded-4a4d-b8f2-b0a6ce5720ce, 
Duration=32ms)Orchestrator function 'IssueCertificate' failed: 
The activity function 'Order' failed: "Failed to deserialize exception from TaskActivity: 
{"$type":"ACMESharp.Protocol.AcmeProtocolException, ACMESharp",
"ProblemType":0,"ProblemTypeRaw":null,"ProblemDetail":null,
"ProblemStatus":-1,"Message":"Unexpected response status code [BadRequest] for [CreateOrderAsync]",
"Data":{"$type":"System.Collections.ListDictionaryInternal, 
System.Private.CoreLib"},"InnerException":null,"HelpLink":null,
"Source":"ACMESharp","HResult":-2146233088,"StackTrace":"  
 at ACMESharp.Protocol.AcmeProtocolClient.SendAcmeAsync(Uri uri, HttpMethod method, Object message, HttpStatusCode[] 
 expectedStatuses, Boolean skipNonce, Boolean skipSigning, Boolean includePublicKey, CancellationToken cancel, 
 String opName)\r\n   at ACMESharp.Protocol.AcmeProtocolClient.CreateOrderAsync(IEnumerable`1 identifiers, Nullable`1 notBefore,
  Nullable`1 notAfter, CancellationToken cancel)\r\n   at KeyVault.Acmebot.Functions.SharedActivity.Order(IReadOnlyList`1 dnsNames)
in /home/runner/work/keyvault-acmebot/keyvault-acmebot/KeyVault.Acmebot/Functions/SharedActivity.cs:line 148\r\n   at Microsoft.Azure.WebJobs.Host.Executors.FunctionInvoker`2.InvokeAsync(Object instance, Object[] arguments) in D:\\a\\_work\\1\\s\\src\\Microsoft.Azure.WebJobs.Host\\Executors\\FunctionInvoker.cs:line 52\r\n   at Microsoft.Azure.WebJobs.Host.Executors.FunctionExecutor.InvokeWithTimeoutAsync(IFunctionInvoker invoker, ParameterHelper parameterHelper, CancellationTokenSource timeoutTokenSource, CancellationTokenSource functionCancellationTokenSource, Boolean throwOnTimeout, TimeSpan timerInterval, IFunctionInstance instance) in D:\\a\\_work\\1\\s\\src\\Microsoft.Azure.WebJobs.Host\\Executors\\FunctionExecutor.cs:line 581\r\n   at Microsoft.Azure.WebJobs.Host.Executors.FunctionExecutor.ExecuteWithWatchersAsync(IFunctionInstanceEx instance, ParameterHelper parameterHelper, ILogger logger, CancellationTokenSource functionCancellationTokenSource) in D:\\a\\_work\\1\\s\\src\\Microsoft.Azure.WebJobs.Host\\Executors\\FunctionExecutor.cs:line 527\r\n   at Microsoft.Azure.WebJobs.Host.Executors.FunctionExecutor.ExecuteWithLoggingAsync(IFunctionInstanceEx instance, FunctionStartedMessage message, FunctionInstanceLogEntry instanceLogEntry, ParameterHelper parameterHelper, ILogger logger, CancellationToken cancellationToken) in D:\\a\\_work\\1\\s\\src\\Microsoft.Azure.WebJobs.Host\\Executors\\FunctionExecutor.cs:line 306"}". See the function execution logs for additional details.

FYI my certificate provider is Entrust and I added the configuration https://github.com/shibayan/keyvault-acmebot/wiki/External-Account-Binding from Entrust.

[shibayan]

The DNS zone settings seem to be working fine. The error message indicates that a BadRequest was returned for the certificate issuance request to Entrust. Entrust may not be returning the cause of the BadRequest, but even a simple single domain fails? Try with a single domain if you are using multiple domains or wildcards.