oraclecloud: PATCH does not work on non-exisiting _acme-challenge TXT records

[tyskjohan]

Welcome

• Yes, I'm using a binary release within 2 latest releases.
• Yes, I've searched similar issues on GitHub and didn't find any.
• Yes, I've included all information below (version, config, etc).

What did you expect to see?

I expected LEGO to create a new TXT record for _acme-challenge in the domain I indicated, when one did not exist.
I even tried creating one from the OCI console usig clickOps, but LEGO deleted it.

What did you see instead?

No ACME challenge record created.
Manually created record deleted.

How do you use lego?

Through Terraform ACME provider

Reproduction steps

Try to create an ACME certificate from scratch with Domain challenge going to Oracle OCI.

Effective version of lego

v4.25.2

Logs

acme_certificate.my_acme_certificate: Still creating... [1m10s elapsed]
╷
│ Error: error creating certificate: error: one or more domains had a problem:
│ [*.subdomain.mydomain.org] [*.subdomain.mydomain.org] acme: error presenting token: 2 errors occurred:
│ 	* rpc error: code = Unknown desc = oraclecloud: Error returned by Dns Service. Http Status Code: 404. Error Code: NotAuthorizedOrNotFound. Opc request id: 3f98f21ef40044d2f0f0a5dcc3bbb4f5/1BBDB9D9545165EBAA5BE4B37034F0A4/0A8D85DAD8AB4FC3C6A755A485B557A8. Message: Authorization failed or requested resource not found.
│ Operation Name: PatchDomainRecords
│ Timestamp: 2025-08-22 13:58:25 +0000 GMT
│ Client Version: Oracle-GoSDK/65.95.2
│ Request Endpoint: PATCH https://dns.us-phoenix-1.oci.oraclecloud.com/20180115/zones/mydomain.org./records/_acme-challenge.subdomain.mydomain.org?compartmentId=ocid1.compartment.oc00..aaaaaaaahjmabrw2gofibdvrc7j65loechpmm7v7gv65jal27dtlvvzwxxxx
│ Troubleshooting Tips: See https://docs.oracle.com/iaas/Content/API/References/apierrors.htm#apierrors_404__404_notauthorizedornotfound for more information about resolving this error.
│ Also see https://docs.oracle.com/iaas/api/#/en/dns/20180115/Records/PatchDomainRecords for details on this operation's requirements.
│ To get more info on the failing request, you can set OCI_GO_SDK_DEBUG env var to info or higher level to log the request/response details.
│ If you are unable to resolve this Dns issue, please contact Oracle support and provide them this full error message.
│ 	* error encountered while presenting token for DNS challenge: rpc error: code = Unknown desc = oraclecloud: Error returned by Dns Service. Http Status Code: 404. Error Code: NotAuthorizedOrNotFound. Opc request id: 3f98f21ef40044d2f0f0a5dcc3bbb4f5/1BBDB9D9545165EBAA5BE4B37034F0A4/0A8D85DAD8AB4FC3C6A755A485B557A8. Message: Authorization failed or requested resource not found.
│ Operation Name: PatchDomainRecords
│ Timestamp: 2025-08-22 13:58:25 +0000 GMT
│ Client Version: Oracle-GoSDK/65.95.2
│ Request Endpoint: PATCH https://dns.us-phoenix-1.oci.oraclecloud.com/20180115/zones/mydomain.org./records/_acme-challenge.subdomain.mydomain.org?compartmentId=ocid1.compartment.oc00..aaaaaaaahjmabrw2gofibdvrc7j65loechpmm7v7gv65jal27dtlvvzwxxxx
│ Troubleshooting Tips: See https://docs.oracle.com/iaas/Content/API/References/apierrors.htm#apierrors_404__404_notauthorizedornotfound for more information about resolving this error.
│ Also see https://docs.oracle.com/iaas/api/#/en/dns/20180115/Records/PatchDomainRecords for details on this operation's requirements.
│ To get more info on the failing request, you can set OCI_GO_SDK_DEBUG env var to info or higher level to log the request/response details.
│ If you are unable to resolve this Dns issue, please contact Oracle support and provide them this full error message.
│ 
│ 
│ 
│ 
│   with acme_certificate.my_acme_certificate,
│   on acme.tf line 30, in resource "acme_certificate" "my_acme_certificate":
│   30: resource "acme_certificate" "my_acme_certificate" {

Go environment (if applicable)

N/A

[tyskjohan]

Quite clear from the Oracle documentation that PATCH only works for existing records:
https://docs.oracle.com/en-us/iaas/api/#/en/dns/20180115/Records/PatchDomainRecords

[ldez]

The documentation states:

You can also add or remove records using this function.

[ldez]

You are assuming that it is related to a missing existing TXT record for _acme-challenge, but for me, this is not the problem.

No existing TXT record for _acme-challenge is expected, so I think this is not a problem.

The endpoint updates a zone/domain, not a record.

The problem seems related to other resources (zone, compartment).

[ldez]

Endpoint	Description
DeleteDomainRecords	Deletes all records at the specified zone and domain.
GetDomainRecords	Gets a list of all records at the specified zone and domain.
GetZoneRecords	Gets all records in the specified zone.
PatchDomainRecords	Updates records in the specified zone at a domain. (You can also add or remove records using this function.)
PatchZoneRecords	Updates a collection of records in the specified zone. (You can also add or remove records using this function.)
UpdateDomainRecords	Replaces records in the specified zone at a domain with the records specified in the request body. (If a specified record does not exist, it will be created. If a record in the zone does not exist in the request body, the record will be removed from the zone. )
UpdateZoneRecords	Replaces records in the specified zone with the records specified in the request body. (If a specified record does not exist, it will be created. If a record in the zone does not exist in the request body, the record will be removed from the zone.)

PatchXXX updates zone/domain records.
UpdateXXX replaces zone/domain records.
The 2 endpoints can create/add records.

PatchXXX can add one record without sending all the records of the zone/domain. It doesn't expect existing records.

UpdateXXX requires to provide all the records of the zone/domain to add or remove one.

[tyskjohan]

It seems the problem is in the URL that gets constructed, somehow the subdomain gets lost. There was a related LEGO but bit PR #1055 seems not to work reliably.

Request Endpoint: PATCH https://dns.us-phoenix-1.oci.oraclecloud.com/20180115/zones/**mydomain.org.**/records/_acme-challenge.subdomain.mydomain.org?compartmentId=ocid1.compartment.oc1..aaaaaaaahjmabrw2gofibdvrc7j65loechpmm7v7gv65dxr27dtlvvzwxxxx

should be subdomain.mydomain.org

[ldez]

The PR work as expected, I think this is problem with your OCI zones setup (not related to lego).

subdomain.mydomain.org should answer to SOA calls (it should be a zone from the POV of a DNS).

[tyskjohan]

It's an internal zone, not exposed in public DNS - is LEGO somehow trying to retrieve the SOA outside of OCI APIs?

[ldez]

lego is doing SOA DNS calls.