Certificate Request Error #23410

marvk · 2021-06-23T18:07:04Z

marvk
Jun 23, 2021

GitHub is unable to create a certificate for my custom domain GitHub Pages page. This has worked before, but recently I noticed an certificate error on the page. After reading the documentation, it seemed like I was missing a www CNAME marvk.github.io DNS entry.

After adding this entry, the configuration error on the projects GitHub Pages configuration site got resolved, but I am left with a seemingly properly configured domain, but no certificates being generated.

These are my DNS entries:

1273×764 25.1 KB

And at the content root I have a CNAME file with the content vatprism.org

Barring DNS propagation, which seems to have already happened, I fail to see the issue. Should I just try giving it a bit more time or is there some issue I’m missing?

Thanks in advance.

Answered by marvk

Jun 25, 2021

Unfortunately my provider wasn’t able to help me out, however, via

ttps://dns.google.com/query?name=vatprism.org&rr_type=A&ecs=

I was able to determine that Google wasn’t accepting the DNS entry because of a DNSSEC issue:

{
  "Status": 2,
  "TC": false,
  "RD": true,
  "RA": true,
  "AD": false,
  "CD": false,
  "Question": [
    {
      "name": "www.vatprism.org.",
      "type": 5
    }
  ],
  "Comment": "DNSSEC validation failure. Check http://dnsviz.net/d/www.vatprism.org/dnssec/ and http://dnssec-debugger.verisignlabs.com/www.vatprism.org for errors"
}

After checking the “DNSSEC Status” checkbox on my providers page, the DNS issue went away and shortly after, GitHub started issuing a…

View full answer

yoannchaudet · 2021-06-24T22:45:51Z

yoannchaudet
Jun 24, 2021
Collaborator

Hello and welcome here!

You could not have asked at a better time. We actually deployed changes today around certificates handling to correct an entire class of errors that were happening lately.

Your DNS configuration (on the screenshot) looks good. You probably removed it because I am unable to query these records anymore (that would prevent us from obtaining a certificate for your domain). If you want to give it another try, I will be happy to monitor this certificate provisioning for you.

0 replies

marvk · 2021-06-24T23:41:52Z

marvk
Jun 24, 2021
Author

Hey there, thank you! Other than TTL I haven’t touched the records in about 36 hours. The A records have been untouched for months, the only thing I added about 36 hours ago was the CNAME.

On whatismydns.com the propagation seems poor:

  <a href="https://www.whatsmydns.net/?utm_source=whatsmydns.com&amp;utm_medium=redirect#A/vatprism.org" target="_blank" rel="noopener nofollow ugc">whatsmydns.net</a>

DNS Checker - DNS Propagation Check & DNS Lookup

Instant DNS Propagation Check. Global DNS Lookup and DNS Propagation Checker. Check your DNS records around the world.

  <a href="https://www.whatsmydns.net/?utm_source=whatsmydns.com&amp;utm_medium=redirect#CNAME/www.vatprism.org" target="_blank" rel="noopener nofollow ugc">whatsmydns.net</a>

DNS Checker - DNS Propagation Check & DNS Lookup

Instant DNS Propagation Check. Global DNS Lookup and DNS Propagation Checker. Check your DNS records around the world.

However, on dnschecker.com propagation is close to exhaustive:

  <a href="https://dnschecker.org/#A/vatprism.org" target="_blank" rel="noopener nofollow ugc">DNS Checker</a>

DNS Checker - DNS Check Propagation Tool

Check DNS Propagation worldwide. DNS Checker provides name server propagation check instantly. Changed nameservers so do a DNS lookup and check if DNS and nameservers have propagated.

  <a href="https://dnschecker.org/?#CNAME/www.vatprism.org" target="_blank" rel="noopener nofollow ugc">DNS Checker</a>

DNS Checker - DNS Check Propagation Tool

Check DNS Propagation worldwide. DNS Checker provides name server propagation check instantly. Changed nameservers so do a DNS lookup and check if DNS and nameservers have propagated.

What method are you using to query the DNS records for the domain?

0 replies

yoannchaudet · 2021-06-25T00:05:25Z

yoannchaudet
Jun 25, 2021
Collaborator

We use the library we published here: GitHub - github/pages-health-check: Checks your GitHub Pages site for common DNS configuration issues.

And we resolve the DNS records with both Cloudflare (1.1.1.1) and Google (8.8.8.8) if I am not mistaken.

In both cases I am unable to query your DNS zone (e.g. for A records):

image1278×1394 239 KB

I am not familiar with your registrar’s user interface but are you sure your DNS zone is properly published? Some registrar do have a concept of version you need to publish before propagation can start.

0 replies

marvk · 2021-06-25T18:10:00Z

marvk
Jun 25, 2021
Author

Unfortunately my provider wasn’t able to help me out, however, via

ttps://dns.google.com/query?name=vatprism.org&rr_type=A&ecs=

I was able to determine that Google wasn’t accepting the DNS entry because of a DNSSEC issue:

{
  "Status": 2,
  "TC": false,
  "RD": true,
  "RA": true,
  "AD": false,
  "CD": false,
  "Question": [
    {
      "name": "www.vatprism.org.",
      "type": 5
    }
  ],
  "Comment": "DNSSEC validation failure. Check http://dnsviz.net/d/www.vatprism.org/dnssec/ and http://dnssec-debugger.verisignlabs.com/www.vatprism.org for errors"
}

After checking the “DNSSEC Status” checkbox on my providers page, the DNS issue went away and shortly after, GitHub started issuing a certificate.

I’m not sure what caused Google to reject the DNS, since all of my other domains don’t have the checkbox checked and resolve without issue on Google.

While my case seems quite specific, I think the user experience on the GitHub Pages page could be improved:

First, it is not transparent when GitHub will try to reissue a certificate, forcing you to clear and re-add the domain as a workaround to manually trigger an attempt at reissuing.

Second, the warning being displayed is quite generic and I’m sure threads like this could be prevented by creating some official documentation.

It sounds like you guys are working on the whole certificate thing at the moment, so I’m sure many of these things are already being worked on.

Thanks for the otherwise excellent service!

0 replies

yoannchaudet · 2021-06-26T03:35:59Z

yoannchaudet
Jun 26, 2021
Collaborator

Glad to hear you manage to get your certificate provisioned and thank you for the feedback!

We actually do try to obtain certificates on error continuously in the background. It is just not happening as fast as it does when you go to the Pages settings page simply to stay under rate limits imposed by our certificate provider (Let’s Encrypt).

0 replies

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

GitHub Community

Certificate Request Error #23410

{{title}}

Replies: 5 comments

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

Select a reply

GitHub Community

Certificate Request Error #23410

marvk Jun 23, 2021

Replies: 5 comments

yoannchaudet Jun 24, 2021 Collaborator

marvk Jun 24, 2021 Author

DNS Checker - DNS Propagation Check & DNS Lookup

DNS Checker - DNS Propagation Check & DNS Lookup

DNS Checker - DNS Check Propagation Tool

DNS Checker - DNS Check Propagation Tool

yoannchaudet Jun 25, 2021 Collaborator

marvk Jun 25, 2021 Author

yoannchaudet Jun 26, 2021 Collaborator

marvk
Jun 23, 2021

yoannchaudet
Jun 24, 2021
Collaborator

marvk
Jun 24, 2021
Author

yoannchaudet
Jun 25, 2021
Collaborator

marvk
Jun 25, 2021
Author

yoannchaudet
Jun 26, 2021
Collaborator