Issue multiple certificates with cloudflare

[keamas]

Hello,
I need to issue multiple certificates via cloudflare.
For this I tried different ways without any success.:

./acme.sh --issue --server letsencrypt --dns dns_cf -d vpn.mydomain.com -w /home/admin/.acme.sh/vpn.mydomain.com -d fw1.mydomain.com -w /home/admin/.acme.sh/fw1.mydomain.com

./acme.sh --issue --server letsencrypt --dns dns_cf -d vpn.mydomain.com  -d fw1.mydomain.com

But I just get the certificate which I put first in the statement the second domains seems not to be created. But I can see multiple txt entries in the Cloudflare DNS.

I also tried to use a wildcard certificate instead which I don't prefer.

But than I can't upload the wildcard certificate via the PaloAlto deploy script:

admin@amy:~/.acme.sh $ acme.sh --deploy -d "*.mydomain.com" --deploy-hook panos --insecure
[Thu 12 May 17:03:09 CEST 2022] Deploy of type cert failed. Try deploying with --debug to troubleshoot.
[Thu 12 May 17:03:10 CEST 2022] Deploy of type key failed. Try deploying with --debug to troubleshoot.
[Thu 12 May 17:03:10 CEST 2022] Deploy of type commit failed. Try deploying with --debug to troubleshoot.
[Thu 12 May 17:03:10 CEST 2022] Error deploy for domain:*.mydomain.com
[Thu 12 May 17:03:11 CEST 2022] Deploy error.

Is there any Solution how I can create multiple certs with cloudflare or anything how I can deploy the wildcard certs ?

[GwynethLlewelyn]

To be clear in your question: do you want one certificate with both domains (this is what acme.sh will actually do) or two separate certificates, each with one domain only? (this would require calling acme.sh twice, once for each domain)

Also, using Cloudflare DNS like in the first examples you gave, will the following command not work?

./acme.sh --issue --server letsencrypt -d '*.mydomain.com'  --dns dns_cf

I'm asking just because all of the above works for me under Ubuntu 22.04.

[sg1888]

@keamas - Why are you using webroot -w in conjunction with DNS authentication --dns? You typically would need one or the other. You can delete the -w /home/admin/.acme.sh/vpn.mydomain.com and -w /home/admin/.acme.sh/fw1.mydomain.com entries.

This configuration alone should work to create the certs:
./acme.sh --issue --server letsencrypt --dns dns_cf -d vpn.mydomain.com -d fw1.mydomain.com

As far as wildcard certs, if you're trying to deploy a wildcard cert to a Palo Alto firewall, you'll need to pull some new code. I made a PR #4575, which enables wildcard certs for PANOS. Until the changes are merged, you can download the changes from my repo (https://github.com/sg1888/acme.sh/tree/panos-ecc-fix). The raw file is here: (https://raw.githubusercontent.com/sg1888/acme.sh/panos-ecc-fix/deploy/panos.sh).

Good luck!