Billionmail/BillionMail · error

Failed to set Tencent Cloud DNS verification: {}

Error message

Failed to set Tencent Cloud DNS verification: {}

What it means

When vtype == "dns" and dnsProvider == "tencentcloud", ApplySSLWithExistingServer calls SetDnsTencentcloud, which builds a lego dns-01 provider from the supplied dnsProviderToken and registers it with client.Challenge.SetDNS01Provider. This error means that setup failed — typically bad Tencent Cloud credentials or the lego Tencent provider construction erroring. The underlying lego error text is embedded in the message.

Source

Thrown at core/internal/service/acme/acme.go:409

	if err != nil {
		return "", "", errors.New(public.LangCtx(ctx, "Failed to create ACME client: {}", err.Error()))
	}

	// Set verification method
	if vtype == "http" {
		// Assume the HTTP server is already running and properly configured
		// to handle the challenge requests
		err = client.Challenge.SetHTTP01Provider(http01.NewProviderServer("127.0.0.1", "60880"))
		if err != nil {
			return "", "", errors.New(public.LangCtx(ctx, "Failed to set HTTP verification: {}", err.Error()))
		}
	} else if vtype == "dns" && dnsProvider != "" {
		// Set DNS verification - same as in the standard ApplySSL function
		switch dnsProvider {
		case "tencentcloud":
			err = SetDnsTencentcloud(ctx, client, dnsProviderToken)
			if err != nil {
				return "", "", errors.New(public.LangCtx(ctx, "Failed to set Tencent Cloud DNS verification: {}", err.Error()))
			}
		case "alidns":
			err = SetDnsAliyun(ctx, client, dnsProviderToken)
			if err != nil {
				return "", "", errors.New(public.LangCtx(ctx, "Failed to set Alibaba Cloud DNS verification: {}", err.Error()))
			}
		case "cloudxns":
			err = SetDnsCloudxns(ctx, client, dnsProviderToken)
			if err != nil {
				return "", "", errors.New(public.LangCtx(ctx, "Failed to set CloudXNS DNS verification: {}", err.Error()))
			}
		case "azuredns":
			err = SetDnsAzuredns(ctx, client, dnsProviderToken)
			if err != nil {
				return "", "", errors.New(public.LangCtx(ctx, "Failed to set AzureDNS verification: {}", err.Error()))
			}
		case "cloudflare":
			err = SetDnsCloudflare(ctx, client, dnsProviderToken)

View on GitHub (pinned to fc36c76c05)

Solutions

1. Check the wrapped err text; re-enter the Tencent Cloud SecretId/SecretKey in dnsProviderToken in the expected format (no whitespace, correct separator)
2. Verify the Tencent Cloud account/role has DNS resolution (dnspod) write permission for the certificate domain
3. Test the credentials outside lego (Tencent Cloud CLI/API) against the domain's hosted zone, then retry the certificate application

Example fix

// before
dnsProviderToken = "akp123"
// after
dnsProviderToken = "SecretId:SecretKey" // both parts, correct order, trimmed

func validTencentToken(tok string) bool {
    parts := strings.Split(strings.TrimSpace(tok), ":")
    return len(parts) == 2 && parts[0] != "" && parts[1] != ""
}
if dnsProvider == "tencentcloud" && !validTencentToken(dnsProviderToken) {
    return errors.New("invalid Tencent Cloud credentials format")
}

func isTencentConfigured(vtype, provider, token string) bool {
    return vtype == "dns" && provider == "tencentcloud" && strings.TrimSpace(token) != ""
}

cert, _, err := ApplySSLWithExistingServer(ctx, ...)
if err != nil && strings.Contains(err.Error(), "Tencent Cloud DNS") {
    // surface credential-rotation guidance to the operator
    return fmt.Errorf("check Tencent Cloud SecretId/SecretKey: %w", err)
}

When it happens

Trigger: ApplySSLWithExistingServer (via Apply, StartRenew, ApplyLetsEncryptCertWithHttp, ApplyConsoleCert) with vtype="dns", dnsProvider="tencentcloud", and an invalid/malformed dnsProviderToken (wrong SecretId/SecretId+SecretKey format, expired keys, or a token string that cannot be parsed).

Common situations: Storing the Tencent Cloud API key pair in the wrong order or with surrounding whitespace; a sub-account without DNS permission for the zone; rotated secrets not yet synced to the config the service reads.

Related errors

• Failed to set Alibaba Cloud DNS verification: {}
• Failed to set AzureDNS verification: {}
• Failed to set Cloudflare DNS verification: {}
• Failed to set Godaddy DNS verification: {}
• DNS automated resolution failed: SecretId or SecretKey is em

AI-assisted analysis of Billionmail/BillionMail@fc36c76c05 (2026-09-05). Data as JSON: /api/errors/6341535c423e851d. Report an issue: GitHub.