{"record":{"id":"6341535c423e851d","repo":"Billionmail/BillionMail","slug":"failed-to-set-tencent-cloud-dns-verification","errorCode":null,"errorMessage":"Failed to set Tencent Cloud DNS verification: {}","messagePattern":"Failed to set Tencent Cloud DNS verification: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/internal/service/acme/acme.go","lineNumber":409,"sourceCode":"\tif err != nil {\n\t\treturn \"\", \"\", errors.New(public.LangCtx(ctx, \"Failed to create ACME client: {}\", err.Error()))\n\t}\n\n\t// Set verification method\n\tif vtype == \"http\" {\n\t\t// Assume the HTTP server is already running and properly configured\n\t\t// to handle the challenge requests\n\t\terr = client.Challenge.SetHTTP01Provider(http01.NewProviderServer(\"127.0.0.1\", \"60880\"))\n\t\tif err != nil {\n\t\t\treturn \"\", \"\", errors.New(public.LangCtx(ctx, \"Failed to set HTTP verification: {}\", err.Error()))\n\t\t}\n\t} else if vtype == \"dns\" && dnsProvider != \"\" {\n\t\t// Set DNS verification - same as in the standard ApplySSL function\n\t\tswitch dnsProvider {\n\t\tcase \"tencentcloud\":\n\t\t\terr = SetDnsTencentcloud(ctx, client, dnsProviderToken)\n\t\t\tif err != nil {\n\t\t\t\treturn \"\", \"\", errors.New(public.LangCtx(ctx, \"Failed to set Tencent Cloud DNS verification: {}\", err.Error()))\n\t\t\t}\n\t\tcase \"alidns\":\n\t\t\terr = SetDnsAliyun(ctx, client, dnsProviderToken)\n\t\t\tif err != nil {\n\t\t\t\treturn \"\", \"\", errors.New(public.LangCtx(ctx, \"Failed to set Alibaba Cloud DNS verification: {}\", err.Error()))\n\t\t\t}\n\t\tcase \"cloudxns\":\n\t\t\terr = SetDnsCloudxns(ctx, client, dnsProviderToken)\n\t\t\tif err != nil {\n\t\t\t\treturn \"\", \"\", errors.New(public.LangCtx(ctx, \"Failed to set CloudXNS DNS verification: {}\", err.Error()))\n\t\t\t}\n\t\tcase \"azuredns\":\n\t\t\terr = SetDnsAzuredns(ctx, client, dnsProviderToken)\n\t\t\tif err != nil {\n\t\t\t\treturn \"\", \"\", errors.New(public.LangCtx(ctx, \"Failed to set AzureDNS verification: {}\", err.Error()))\n\t\t\t}\n\t\tcase \"cloudflare\":\n\t\t\terr = SetDnsCloudflare(ctx, client, dnsProviderToken)","sourceCodeStart":391,"sourceCodeEnd":427,"githubUrl":"https://github.com/Billionmail/BillionMail/blob/fc36c76c050c3775c5e899faf7403cf0262d2744/core/internal/service/acme/acme.go#L391-L427","documentation":"When vtype == \"dns\" and dnsProvider == \"tencentcloud\", ApplySSLWithExistingServer calls SetDnsTencentcloud, which builds a lego dns-01 provider from the supplied dnsProviderToken and registers it with client.Challenge.SetDNS01Provider. This error means that setup failed — typically bad Tencent Cloud credentials or the lego Tencent provider construction erroring. The underlying lego error text is embedded in the message.","triggerScenarios":"ApplySSLWithExistingServer (via Apply, StartRenew, ApplyLetsEncryptCertWithHttp, ApplyConsoleCert) with vtype=\"dns\", dnsProvider=\"tencentcloud\", and an invalid/malformed dnsProviderToken (wrong SecretId/SecretId+SecretKey format, expired keys, or a token string that cannot be parsed).","commonSituations":"Storing the Tencent Cloud API key pair in the wrong order or with surrounding whitespace; a sub-account without DNS permission for the zone; rotated secrets not yet synced to the config the service reads.","solutions":["Check the wrapped err text; re-enter the Tencent Cloud SecretId/SecretKey in dnsProviderToken in the expected format (no whitespace, correct separator)","Verify the Tencent Cloud account/role has DNS resolution (dnspod) write permission for the certificate domain","Test the credentials outside lego (Tencent Cloud CLI/API) against the domain's hosted zone, then retry the certificate application"],"exampleFix":"// before\ndnsProviderToken = \"akp123\"\n// after\ndnsProviderToken = \"SecretId:SecretKey\" // both parts, correct order, trimmed","handlingStrategy":"validation","validationCode":"func validTencentToken(tok string) bool {\n    parts := strings.Split(strings.TrimSpace(tok), \":\")\n    return len(parts) == 2 && parts[0] != \"\" && parts[1] != \"\"\n}\nif dnsProvider == \"tencentcloud\" && !validTencentToken(dnsProviderToken) {\n    return errors.New(\"invalid Tencent Cloud credentials format\")\n}","typeGuard":"func isTencentConfigured(vtype, provider, token string) bool {\n    return vtype == \"dns\" && provider == \"tencentcloud\" && strings.TrimSpace(token) != \"\"\n}","tryCatchPattern":"cert, _, err := ApplySSLWithExistingServer(ctx, ...)\nif err != nil && strings.Contains(err.Error(), \"Tencent Cloud DNS\") {\n    // surface credential-rotation guidance to the operator\n    return fmt.Errorf(\"check Tencent Cloud SecretId/SecretKey: %w\", err)\n}","preventionTips":["Store SecretId:SecretKey pairs in the exact expected format, trimmed","Grant the sub-account DNS (dnspod) write permission on the zone","Re-test credentials with the Tencent CLI after any key rotation"],"tags":["acme","dns-01","tencentcloud","credentials"],"backgroundTag":"dns-provider-auth-failed","analyzedSha":"fc36c76c050c3775c5e899faf7403cf0262d2744","analyzedAt":"2026-09-05T21:28:54.019Z","contentChangedAt":"2026-09-05T21:28:54.019Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}