BUG/MEDIUM: acme: pass record names relative to the zone to libdns

[bilhackmac]

Hi,

I've been setting up the native HAProxy ACME client with dns-01 and Data Plane API, using the OVH provider. The challenge never completed: the TXT record was created, but under _acme-challenge.sub.example.com.example.com instead of _acme-challenge.sub.example.com.

Cause

makeRecord() builds the record name from the full domain and Present() passes it as-is to the provider, alongside the zone (example.com.). libdns expects names relative to the zone (that's what libdns.RelativeName() / AbsoluteName() are for).

libdns/ovh follows that contract literally and uses the name as the OVH subDomain, hence the doubled name. I suspect this went unnoticed because some providers tolerate a FQDN there. libdns/cloudflare, for instance, goes through libdns.AbsoluteName(), and the Cloudflare API normalizes a name that already ends with the zone.

Fix

Convert the name with libdns.RelativeName() once the zone is known, in both Present() and CleanUp(). Wait() builds its own absolute name for the propagation check, so it doesn't need to change.

Testing

Built from v3.4.3 with this patch, OVH provider, *.sub.example.com in zone example.com:

• the TXT record is created at the right name, and the propagation check succeeds;
• the certificate is issued;
• the record is removed after the 10-minute cleanup delay.

Before the patch, dig TXT _acme-challenge.sub.example.com.example.com returned the challenge token.