DNS automated resolution failed: APIKey or SecretKey is empt

Error message

DNS automated resolution failed: APIKey or SecretKey is empty in CloudXNS configuration file

What it means

SetDnsCloudxns configures the lego CloudXNS DNS-01 provider. It validates that keyConfig contains non-empty 'APIKey' and 'SecretKey'; a nil map or either empty value produces this error. CloudXNS' API authenticates each request with an API key plus its secret.

Source

Thrown at core/internal/service/acme/acme.go:214

	}

	err = client.Challenge.SetDNS01Provider(p)
	if err != nil {
		return errors.New(public.LangCtx(ctx, "DNS verification setup failed: {}", err.Error()))
	}

	return nil
}

/**
 * @description: Configure DNS verification via CloudXNS
 * @param {*lego.Client} client Client
 * @param {map[string]string} keyConfig Configuration information
 * @return error Error information
 */
func SetDnsCloudxns(ctx context.Context, client *lego.Client, keyConfig map[string]string) error {
	if keyConfig == nil || keyConfig["APIKey"] == "" || keyConfig["SecretKey"] == "" {
		return errors.New(public.LangCtx(ctx, "DNS automated resolution failed: APIKey or SecretKey is empty in CloudXNS configuration file"))
	}

	cfg := cloudxns.NewDefaultConfig()
	cfg.APIKey = keyConfig["APIKey"]
	cfg.SecretKey = keyConfig["SecretKey"]

	p, err := cloudxns.NewDNSProviderConfig(cfg)
	if err != nil {
		return errors.New(public.LangCtx(ctx, "DNS provider initialization failed: {}", err.Error()))
	}

	err = client.Challenge.SetDNS01Provider(p)
	if err != nil {
		return errors.New(public.LangCtx(ctx, "DNS verification setup failed: {}", err.Error()))
	}

	return nil
}

View on GitHub (pinned to fc36c76c05)

Solutions

Set both keyConfig["APIKey"] and keyConfig["SecretKey"] to the CloudXNS credentials.
Verify exact map key names 'APIKey' and 'SecretKey'.
If the CloudXNS service is no longer available, switch the DNS provider to DNSPod/Tencent Cloud instead.
Re-save the DNS provider configuration and confirm persistence.

Example fix

// before
SetDnsCloudxns(ctx, client, nil)
// after
SetDnsCloudxns(ctx, client, map[string]string{"APIKey": key, "SecretKey": secret})

Defensive patterns

Strategy: validation

Validate before calling

if ak, sk := keyConfig["APIKey"], keyConfig["SecretKey"]; ak == "" || sk == "" {
    return errors.New("cloudxns DNS config requires non-empty APIKey and SecretKey")
}

Type guard

func hasCloudXNSKeys(m map[string]string) bool {
    return m != nil && m["APIKey"] != "" && m["SecretKey"] != ""
}

Prevention

Validate credentials non-empty before calling the SSL apply flow.
Use exact map keys APIKey and SecretKey.
Check CloudXNS service availability; migrate to DNSPod/Tencent Cloud if deprecated.
Reject blank form submissions when saving the DNS provider config.

When it happens

Trigger: Calling ApplySSLWithExistingServer with dnsProvider 'cloudxns' whose keyConfig is nil or has empty 'APIKey'/'SecretKey' entries (acme.go:213-215).

Common situations: CloudXNS credentials never entered for the domain; keys stored under different names ('api_key'); CloudXNS merged into DNSPod/Tencent after service shutdown so users have no valid CloudXNS keys at all; empty strings saved from a blank form.

Related errors

AI-assisted analysis of Billionmail/BillionMail@fc36c76c05 (2026-09-05). Data as JSON: /api/errors/3cf7316db692372e. Report an issue: GitHub.