Billionmail/BillionMail · error

DNS automated resolution failed: SecretId or SecretKey is em

Error message

DNS automated resolution failed: SecretId or SecretKey is empty in TencentCloud configuration file

What it means

SetDnsTencentcloud configures a lego ACME DNS-01 challenge using the lego Tencent Cloud (tencentcloud) provider. Before touching the provider, it validates the incoming keyConfig map; if it is nil, or the SecretId/SecretKey entries are empty, it refuses to proceed with this localized message. Tencent Cloud's DNS API requires both an access key ID (SecretId) and its secret (SecretKey) to authenticate, so absent credentials make provider construction meaningless.

Source

Thrown at core/internal/service/acme/acme.go:131

	// Set CA directory URL
	config.CADirURL = "https://acme-v02.api.letsencrypt.org/directory"

	// Set key type
	config.Certificate.KeyType = certcrypto.RSA2048

	return config
}

/**
 * @description: Configure DNS verification via Tencent Cloud
 * @param {*lego.Client} client Client
 * @param {map[string]string} keyConfig Configuration information
 * @return error Error information
 */
func SetDnsTencentcloud(ctx context.Context, client *lego.Client, keyConfig map[string]string) error {
	if keyConfig == nil || keyConfig["SecretId"] == "" || keyConfig["SecretKey"] == "" {
		return errors.New(public.LangCtx(ctx, "DNS automated resolution failed: SecretId or SecretKey is empty in TencentCloud configuration file"))
	}

	cfg := tencentcloud.NewDefaultConfig()
	cfg.SecretID = keyConfig["SecretId"]
	cfg.SecretKey = keyConfig["SecretKey"]

	p, err := tencentcloud.NewDNSProviderConfig(cfg)
	if err != nil {
		return errors.New(public.LangCtx(ctx, "DNS provider initialization failed: {}", err.Error()))
	}

	err = client.Challenge.SetDNS01Provider(p)
	if err != nil {
		return errors.New(public.LangCtx(ctx, "DNS verification setup failed: {}", err.Error()))
	}
	return nil
}

View on GitHub (pinned to fc36c76c05)

Solutions

1. Fill in both 'SecretId' and 'SecretKey' in the TencentCloud keyConfig map before calling ApplySSLWithExistingServer.
2. Verify exact key names: the lookup is keyConfig["SecretId"] and keyConfig["SecretKey"] (capital I in Id).
3. Check the persisted DNS provider config in the database/UI was actually saved and non-empty.
4. Create a Tencent Cloud API key pair in the console (CAM -> API Key) if none exists.

Example fix

// before
ApplySSLWithExistingServer(..., "tencentcloud", map[string]string{"SecretKey": "xxx"})
// after
ApplySSLWithExistingServer(..., "tencentcloud", map[string]string{"SecretId": "AKID...", "SecretKey": "xxx"})

if cfg, ok := keyConfig["tencentcloud"]; !ok || cfg["SecretId"] == "" || cfg["SecretKey"] == "" {
    return errors.New("tencentcloud DNS config requires non-empty SecretId and SecretKey")
}

func hasTencentKeys(m map[string]string) bool {
    return m != nil && m["SecretId"] != "" && m["SecretKey"] != ""
}

When it happens

Trigger: Calling ApplySSLWithExistingServer with dnsProvider 'tencentcloud' whose keyConfig map is nil, or lacks non-empty 'SecretId' and 'SecretKey' entries (acme.go:130-132).

Common situations: User saved Tencent Cloud credentials in the UI but one field was left blank; config was loaded from an env/file where only SecretKey was set; a rename of the map key (e.g. 'SecretID' vs 'SecretId') silently yields an empty string; nil map passed when the DB row for DNS config is missing.

Related errors

• DNS provider initialization failed: {}
• DNS automated resolution failed: APIKey or SecretKey is empt
• DNS automated resolution failed: APIKey or Email is empty in
• DNS automated resolution failed: APIKey or SecretKey is empt
• DNS automated resolution failed: ClientID, ClientSecret or T

AI-assisted analysis of Billionmail/BillionMail@fc36c76c05 (2026-09-05). Data as JSON: /api/errors/8ed509a552df3a78. Report an issue: GitHub.