DNS challenge with CPanel/WHM provider and subdomain

[gsadtc]

Hi,
i've domain zone managed by WHM "domain.tld" and subdomain "corporate.domain.tld" and i need to create certificate for host "host1.corporate.domain.tld"
When i execute LEGO for "host1.corporate.domain.tld" the results is

acme: error presenting token: cpanel[mode=whm]: fetch zone information: parse_dns_zone error(0): API failure: (XID p93pps) You do not have access to a domain named “corporate.domain.tld”.

missing something in the LEGO configuration or my DNS, or is not provided this feature?

Thank you

[ldez]

Hi,

Is host1.corporate.domain.tld and corporate.domain.tld the same domain but with a copy-paste error?

Could you provide the full logs?

[gsadtc]

Hello,

2025/10/15 13:02:54 [INFO] [host1.corporate.domain.tld] acme: Obtaining bundled SAN certificate
2025/10/15 13:02:55 [INFO] [host1.corporate.domain.tld] AuthURL: https://acme-v02.api.letsencrypt.org/acme/authz/2727320151/598088575991
2025/10/15 13:02:55 [INFO] [host1.corporate.domain.tld] acme: Could not find solver for: tls-alpn-01
2025/10/15 13:02:55 [INFO] [host1.corporate.domain.tld] acme: Could not find solver for: http-01
2025/10/15 13:02:55 [INFO] [host1.corporate.domain.tld] acme: use dns-01 solver
2025/10/15 13:02:55 [INFO] [host1.corporate.domain.tld] acme: Preparing to solve DNS-01
2025/10/15 13:02:55 [INFO] [host1.corporate.domain.tld] acme: Cleaning DNS-01 challenge
2025/10/15 13:02:56 [WARN] [host1.corporate.domain.tld] acme: cleaning up failed: cpanel[mode=whm]: fetch zone information: parse_dns_zone error(0): API failure: (XID 383pfu) You do not have access to a domain named “corporate.domain.tld”.
2025/10/15 13:02:56 [INFO] Deactivating auth: https://acme-v02.api.letsencrypt.org/acme/authz/2727320151/598088575991
2025/10/15 13:02:56 Could not obtain certificates:
        error: one or more domains had a problem:
[host1.corporate.domain.tld] [host1.corporate.domain.tld] acme: error presenting token: cpanel[mode=whm]: fetch zone information: parse_dns_zone error(0): API failure: (XID p93pps) You do not have access to a domain named “corporate.domain.tld”.

in other environment, like Windows, i'm using WACS and to obtain a working challenge with subdomain i have wrote my Powershell script to extend behavior enable WHM and subdomain case

[ldez]

lego is trying to detect the zone with SOA calls: the result for host1.corporate.domain.tld is corporate.domain.tld.

Then lego tries to get information about this zone (corporate.domain.tld), but, based on the logs, the user/token used doesn't allow fetching the information.

So, either this is a rights problem or a DNS zone configuration problem.

[gsadtc]

Hi,

i've create new subdomain zone with SOA and now the problem is this:

2025/10/15 17:35:55 [INFO] [host1.corporate.domain.tld] acme: Obtaining bundled SAN certificate
2025/10/15 17:35:55 [INFO] [host1.corporate.domain.tld] AuthURL: https://acme-v02.api.letsencrypt.org/acme/authz/2727320151/598177904431
2025/10/15 17:35:55 [INFO] [host1.corporate.domain.tld] acme: Could not find solver for: tls-alpn-01
2025/10/15 17:35:55 [INFO] [host1.corporate.domain.tld] acme: Could not find solver for: http-01
2025/10/15 17:35:55 [INFO] [host1.corporate.domain.tld] acme: use dns-01 solver
2025/10/15 17:35:55 [INFO] [host1.corporate.domain.tld] acme: Preparing to solve DNS-01
2025/10/15 17:35:56 [INFO] [host1.corporate.domain.tld] acme: Cleaning DNS-01 challenge
2025/10/15 17:35:57 [INFO] Deactivating auth: https://acme-v02.api.letsencrypt.org/acme/authz/2727320151/598177904431
2025/10/15 17:35:57 Could not obtain certificates:
        error: one or more domains had a problem:
[host1.corporate.domain.tld] [host1.corporate.domain.tld] acme: error presenting token: cpanel[mode=whm]: add record: mass_edit_dns_zone error(0): Permission denied: You do not have the required privileges to run “mass_edit_dns_zone”.

[ldez]

Permission denied: You do not have the required privileges to run “mass_edit_dns_zone”.

Your problem is related to a missing permission; you have to check that.