Repository: go-acme/lego (language: go)

Issue:
Invalid FQDN for wildcard DNS challenge if target domain have CNAME record
I'm using Traefik 2 to generate wildcard certificate through DNS challenge.

My "public" domain (e.g. `company.com`) is managed by OVH and I expose services running on a specific host with a "public" domain (e.g. `*.host01.node.company.com`) through wildcard CNAME targetting another managed domain service (e.g. `host01.provider.com.`.

However, it seems OVH is called for the CNAME target domain zone which is refused as it's not managed by OVH:

```
time="2020-10-20T07:38:57Z" level=info msg="Testing certificate renew..." providerName=letsencrypt-dns.acme
time="2020-10-20T07:38:57Z" level=info msg="Testing certificate renew..." providerName=letsencrypt-http.acme
time="2020-10-20T07:38:58Z" level=info msg="Renewing certificate from LE : {Main:*.host01.node.company.com SANs:[]}" providerName=letsencrypt-dns.acme
time="2020-10-20T07:40:45Z" level=error msg="Error renewing certificate from LE: {*.host01.node.company.com []}, error: one or more domains had a problem:\n[*.host01.node.company.com] time limit exceeded: last error: could not determine the zone: unexpected response code 'REFUSED' for host01.provider.com.\n" providerName=letsencrypt-dns.acme
```


Discussion / hints:

Fix patch:
diff --git a/providers/dns/ovh/ovh.go b/providers/dns/ovh/ovh.go
index f1aaf8697c..5ce5f17267 100644
--- a/providers/dns/ovh/ovh.go
+++ b/providers/dns/ovh/ovh.go
@@ -126,9 +126,9 @@ func (d *DNSProvider) Present(domain, token, keyAuth string) error {
 	fqdn, value := dns01.GetRecord(domain, keyAuth)
 
 	// Parse domain name
-	authZone, err := dns01.FindZoneByFqdn(dns01.ToFqdn(domain))
+	authZone, err := dns01.FindZoneByFqdn(fqdn)
 	if err != nil {
-		return fmt.Errorf("ovh: could not determine zone for domain %q: %w", domain, err)
+		return fmt.Errorf("ovh: could not determine zone for domain %q: %w", fqdn, err)
 	}
 
 	authZone = dns01.UnFqdn(authZone)
@@ -170,9 +170,9 @@ func (d *DNSProvider) CleanUp(domain, token, keyAuth string) error {
 		return fmt.Errorf("ovh: unknown record ID for '%s'", fqdn)
 	}
 
-	authZone, err := dns01.FindZoneByFqdn(dns01.ToFqdn(domain))
+	authZone, err := dns01.FindZoneByFqdn(fqdn)
 	if err != nil {
-		return fmt.Errorf("ovh: could not determine zone for domain %q: %w", domain, err)
+		return fmt.Errorf("ovh: could not determine zone for domain %q: %w", fqdn, err)
 	}
 
 	authZone = dns01.UnFqdn(authZone)
@@ -210,5 +210,5 @@ func extractRecordName(fqdn, zone string) string {
 	if idx := strings.Index(name, "."+zone); idx != -1 {
 		return name[:idx]
 	}
-	return name
+	return ""
 }


Test patch: