Zone could not be found?

[Avamander]

I'm seeing an error saying cloudflare: failed to find zone subsub.sub.domain.com.: Zone could not be found. From my perspective, the zones exist and subsub.sub.domain.com resolves.

What does it very literally mean Zone could not be found? What is it checking? Is there a way to disable this check?

[ldez]

Since you liked my answer in the Traefik forum, I guess my answer in the forum is the answer to your question.

https://community.traefik.io/t/cloudflare-failed-to-find-zone-com-zone-could-not-be-found/8512/8?u=ldez

[Avamander]

Well yes, CF only allows using domain.com and not anything below that.

[ldez]

So we have the "answer" 😄

I'm sorry but if it's a Cloudflare limitation, I will not be able to bypass that, the ACME challenge requires creating TXT records in a valid zone in Cloudflare.

[Avamander]

Well it could, but the record has to be placed under the primary domain (and zone).

[Avamander]

@ldez Thanks for the help with coming to this conclusion. But I think this is a bug in the process of using the SOA results for CF API. As CF API always wants you to use the "root" zone basically and all domains should be converted to that, having a local authority due to split-horizon should not change that part.

[Avamander]

@asbachb

You can get one for a subdomain (sub.example.com) if your local resolver points at the exact CF zone name as authoritative (SOA example.com). If you've got a split-horizon setup and you want to request a certificate for a local domain (subsub.sub.example.com) where the local resolver is returning a subdomain SOA (sub.example.com), it will fail.

Lego makes the erroneous assumption that the value returned in SOA matches the zone name at Cloudflare, when that might not be the case.