DNS challenge fails with "unexpected status code" 404 with API claiming to be PowerDNS compatible (UD Media)

[jotasi]

I'm trying to get the DNS challenge to work with (German) provider UD Media that claims to provide a PowerDNS compatible API. However, I'm encountering multiple issues and am a bit at a loss on how to diagnose this further. I would therefore be grateful for any pointers in that regard. If this is the wrong place to ask for this, please let me know.

The PowerDNS compatible configuration is performed analogous to the description given by the provider here (German only).

Querying of the API version is already failing:

export PDNS_API_URL=https://login.udmedia.de/dns
export PDNS_SERVER_NAME=udmedia
export PDNS_API_KEY=<read_from_file>
./lego_4.15.0 '--accept-tos' '--path' '.' '-d' 'some_domain.de' '--email' '[email protected]' '--key-type' 'ec256' '--dns' 'pdns' '--dns.resolvers' '5.1.66.255:53' '--server' 'https://acme-staging-v02.api.letsencrypt.org/directory' 'run'

./lego_4.15.0 --accept-tos --path '.' -d 'jonathansiebert.de' --email '[email protected]' --key-type 'ec256' --dns 'pdns' --dns.resolvers '5.1.66.255:53' --server 'https://acme-staging-v02.api.letsencrypt.org/directory' run
2024/02/28 21:50:53 [WARN] pdns: failed to get API version json: cannot unmarshal object into Go value of type []internal.apiVersion
2024/02/28 21:50:53 [INFO] [some_domain.de] acme: Obtaining bundled SAN certificate
2024/02/28 21:50:53 [INFO] [some_domain.de] AuthURL: https://acme-staging-v02.api.letsencrypt.org/acme/authz-v3/<snip>
2024/02/28 21:50:53 [INFO] [some_domain.de] acme: Could not find solver for: tls-alpn-01
2024/02/28 21:50:53 [INFO] [some_domain.de] acme: Could not find solver for: http-01
2024/02/28 21:50:53 [INFO] [some_domain.de] acme: use dns-01 solver
2024/02/28 21:50:53 [INFO] [some_domain.de] acme: Preparing to solve DNS-01
2024/02/28 21:50:53 [INFO] [some_domain.de] acme: Cleaning DNS-01 challenge
2024/02/28 21:50:54 [WARN] [some_domain.de] acme: cleaning up failed: pdns: unexpected status code: [status code: 404] body: {
    "error": "Not found"
}
2024/02/28 21:50:54 [INFO] Deactivating auth: https://acme-staging-v02.api.letsencrypt.org/acme/authz-v3/<snip>
2024/02/28 21:50:54 Could not obtain certificates:
	error: one or more domains had a problem:
[some_domain.de] [some_domain.de] acme: error presenting token: pdns: unexpected status code: [status code: 404] body: {
    "error": "Not found"
}

However, querying via curl seems to give a reasonably looking result:

curl -H "X-Api-Key: ${PDNS_API_KEY}" 'https://login.udmedia.de/dns/api'

{
    "url": "\/dns\/api\/v1",
    "version": 1
}

When setting the API version manually (export PDNS_API_VERSION=1) the warning about the API version query vanishes (as it is no longer performed) but the query still fails:

2024/02/28 21:46:31 [INFO] [some_domain.de] acme: Obtaining bundled SAN certificate
2024/02/28 21:46:31 [INFO] [some_domain.de AuthURL: https://acme-staging-v02.api.letsencrypt.org/acme/authz-v3/<snip>
2024/02/28 21:46:31 [INFO] [some_domain.de] acme: Could not find solver for: tls-alpn-01
2024/02/28 21:46:31 [INFO] [some_domain.de] acme: Could not find solver for: http-01
2024/02/28 21:46:31 [INFO] [some_domain.de] acme: use dns-01 solver
2024/02/28 21:46:31 [INFO] [some_domain.de] acme: Preparing to solve DNS-01
2024/02/28 21:46:32 [INFO] [some_domain.de] acme: Cleaning DNS-01 challenge
2024/02/28 21:46:32 [WARN] [some_domain.de] acme: cleaning up failed: pdns: unexpected status code: [status code: 404] body: {
    "error": "Not found"
}
2024/02/28 21:46:32 [INFO] Deactivating auth: https://acme-staging-v02.api.letsencrypt.org/acme/authz-v3/<snip>
2024/02/28 21:46:32 Could not obtain certificates:
	error: one or more domains had a problem:
[some_domain.de] [some_domain.de] acme: error presenting token: pdns: unexpected status code: [status code: 404] body: {
    "error": "Not found"
}

Querying the API with the URL I would have expected with curl as follows, a valid JSON response is given:

curl -H "X-Api-Key: ${PDNS_API_KEY}" "${PDNS_API_URL}/api/v1/servers/${PDNS_SERVER_NAME}/zones/some_domain.de"

Is there anything I misunderstood with the configuration or what I could do to diagnose this further?

[jotasi]

For the first part, the reason for the API version query to fail is that lego expects a list of API versions such as:

[
    {
        "url": "\/dns\/api\/v1",
        "version": 1
    }
]

But the provider returns just a single version information:

{
    "url": "\/dns\/api\/v1",
    "version": 1
}

However, for lego 4.15.0, setting the API version via PDNS_API_VERSION=1 solves this part and allows to porperly continue.

This does not resolve the second issue of the later failure though. For that, I have opened a separate issue (#2128) as this is caused by the API not being located at the URL root (i.e., https://login.udmedia.de/dns/api instead of https://login.udmedia.de/api).