Mark Komarinski's picture

Fresh install of openldap 18.0 in a proxmox vm and trying to use dns-01 challenge to get a LE cert.  I was asked to install lexicon, said yes, got an error that I flashed past and now I keep getting:

lexicon tool is required for dns-01 challenge, but your system is in an unexpected state

Do you wish to continue?

Whether I click on "Yes" or "No" I get the same bit of python errors that don't tell me what the problem is and I get kicked out.  I can't use http challenge because this is an internal box.


Jeremy Davis's picture

Hi Mark, sorry to hear of your troubles using the Confconsole Let's Encrypt DNS-01 module. What you describe is definitely not the intended outcome!

For what it's worth (very little I imagine) I actually explicitly tested it in the v18.0 OpenLDAP appliance (in a VM on Proxmox) just before release. There had been some issues with it on v18.0 (the module was initially written by a community member for v17.x - and it worked fine there). But I did a fairly significant rewrite and it should be the version that you have installed (OpenLDAP was only very recently released and should have shipped with the fixed version).

My guess is that you are actually running it in a LXC container rather than a proper VM (and I overlooked some specific LXC limitation). In theory it should work exactly the same whether a container or "proper" VM, but perhaps not?

My next guess is that there is some networking issue and I'm not handling that case (or at least not properly).

First thing first, please double check that you have the latest version. I.e. just run this:

apt update
apt install confconsole

If the first line (apt update) gives any error messages, there is no use running the second and it's almost certainly a network issue. It's fine if your server isn't publicly available, but it still needs outgoing internet access for this process to work - it needs to download lexicon, lexicon needs to download the provider list and then contact your DNS provider.

If the first line goes ok (no warnings or errors) and the second line says something like "confconsole is already at the latest version", then that's not the issue. TBH I'm expecting either the first line to fail (and you have a network issue) or the second line to say it's already up to date. I'd be surprised if you have any other result.

It might be worth seeing if there are any log files in /var/log/confconsole/ considering what you've reported, I doubt that there will be anything useful in there, but perhaps?

A possible workaround (and/or another way to hopefully find the specific issue) would be to perform the same initial setup steps that confconsole should be performing, except directly in the CLI. This should do it:

rm -rf /usr/local/src/venv/lexicon
mkdir -p /usr/local/src/venv
python3 -m venv /usr/local/src/venv/lexicon
/usr/local/src/venv/lexicon/bin/pip install dns-lexicon[full]
ln -s /usr/local/src/venv/lexicon/bin/lexicon /usr/local/bin/lexicon
ln -s /usr/local/src/venv/lexicon/bin/tldextract /usr/local/bin/tldextract

If that fails at any step, please post back with the error message. Ideally copy/paste the text if possible. But a screenshot is also ok - please edit the top post and attach it and let me know (it won't be visible after you save - a dumb quirk of the website, but if you let me know I can take care of it).

If all those commands complete successfully, then please retry running Confconsole and fingers crossed it should work - please let me know how you go. I did test it fairly extensively, but it's possible I missed an edge case.

Mark Komarinski's picture

For the first two commands, the update ran fine and confconsole was already the latest version (2.1.3)


For the second set of commands, I had to pip install python3.1-venv but otherwise worked.  Thanks!

Jeremy Davis's picture

Thanks for letting me know and I'm really glad that it otherwise works now.

It's a pity that I'm still not 100% clear on why it worked when I tested it and yet failed for you!? Although I wonder if the issue is rooted in your comment:

[...] I had to pip install python3.1-venv [...]

It should actually install the 'python3-venv' Debian package if it's not already installed (essentially the same as what you did, but the Debian packaged version - rather than via pip).

Given that additional info, I can only assume that there is some sort of race condition when it installs that package? I've opened a new issue to track this. I'm a bit under the pump at the moment, but I'd really like to circle back to looking closer at this ASAP.

Thanks again for reporting the issue.

Add new comment