Hi, I ran into a real head-scratcher when I tried to install Swag on my OMV NAS and I didn’t see any site talking about this “problem”, so maybe it will help someone…
If you want to install Swag, the site forum-nas.fr already covers it very well.

What is Swag?

SWAG – Secure Web Application Gateway (formerly known as letsencrypt, no relation to Let’s Encrypt) sets up an Nginx web server and reverse proxy with php support and a built-in certbot client that automates the process of generating and renewing free SSL server certificates (Let’s Encrypt™ and ZeroSSL). It also includes fail2ban for intrusion prevention.

The GitHub link | The Docker Hub link

There are also mods to improve it, to get a dashboard or to see the location of the people connecting to your server for example…

List of mods

Context

For now, I host my sites with Hostinger and my domain name is with OVH.
Yes, my domain name is with OVH because Hostinger doesn’t offer an API key for domains, anyway, never mind…
I have a NAS running OpenMediaVault with Docker and Portainer and I wanted to install Swag and I got this error:

Certbot failed to authenticate some domains (authenticator: dns-ovh). The Certificate Authority reported these problems:

  Domain: test.remipetit.fr

  Type:   unauthorized

  Detail: Incorrect TXT record "TXT" found at _acme-challenge.test.remipetit.fr

Hint: The Certificate Authority failed to verify the DNS TXT records created by --dns-ovh. Ensure the above domains are hosted by this DNS provider, or try increasing --dns-ovh-propagation-seconds (currently 30 seconds).

Some challenges have failed.

Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.

ERROR: Cert does not exist! Please see the validation error above. Make sure you entered correct credentials into the /config/dns-conf/ovh.ini file.

Indeed, I created an API key at OVH, I gave the Swag container access properly but… it was asking me to add a TXT record to my DNS zone to do the DNS challenge.
Up to there I wasn’t asking myself too many questions but… what value do I need to add to
mon_acme-challenge.test.remipetit.fr to prove that the domain belongs to me?
After a lot of struggling and searching, knowing that this doesn’t happen to people in the various tutorials on the internet, I finally understood.

Solving the problem

I told myself it didn’t make sense to have to create the TXT record myself in my DNS zone, when the whole point of choosing OVH for my domain name was to be able to use API keys.
These API keys give certain rights to whoever holds them, in my case all rights (GET, POST, DELETE, PUT), which allows LetsEncrypt via Certbot to automate the challenges for my domain name and therefore get an SSL certificate without having to do anything.

Ensure the above domains are hosted by this DNS provider

… Yes, it did have access to my API key but… I had modified my DNS zone by pointing it to Hostinger for my websites…
So Hostinger actually took precedence over OVH, which meant OVH couldn’t modify the DNS zone itself and was therefore blocking me.