LE certificate issuing

[Former user]

The Let's Encrypt automatic module cannot open the token http://myserver/.well-known/acme-challenge/blaablaa After this fails, the program fails completely, with the following errors: LEScript.ERROR: Please check http://myserver/.well-known/acme-challenge/sIWZOsUMuQvfq_ahCwRQC9IKQMZmR5UA0j5R1rYG_Fo - token not available [2018-06-17 11:29:25] LEScript.ERROR: #0 /opt/admin/src/Analogic/LetsEncryptBundle/Handler/LeHandler.php(55): Analogic\ACME\Lescript->signDomains(Array) [2018-06-17 11:29:25] LEScript.ERROR: #1 /opt/admin/src/Analogic/LetsEncryptBundle/Controller/LeController.php(74): Analogic\LetsEncryptBundle\Handler\LeHandler->renew(true) [2018-06-17 11:29:25] LEScript.ERROR: #2 [internal function]: Analogic\LetsEncryptBundle\Controller\LeController->issueAction(Object(Symfony\Component\HttpFoundation\Request)) [2018-06-17 11:29:25] LEScript.ERROR: #3 /opt/admin/vendor/symfony/symfony/src/Symfony/Component/HttpKernel/HttpKernel.php(153): call_user_func_array(Array, Array) [2018-06-17 11:29:25] LEScript.ERROR: #4 /opt/admin/vendor/symfony/symfony/src/Symfony/Component/HttpKernel/HttpKernel.php(68): Symfony\Component\HttpKernel\HttpKernel->handleRaw(Object(Symfony\Component\HttpFoundation\Request), 1) [2018-06-17 11:29:25] LEScript.ERROR: #5 /opt/admin/vendor/symfony/symfony/src/Symfony/Component/HttpKernel/Kernel.php(171): Symfony\Component\HttpKernel\HttpKernel->handle(Object(Symfony\Component\HttpFoundation\Request), 1, true) [2018-06-17 11:29:25] LEScript.ERROR: #6 /opt/admin/web/app.php(22): Symfony\Component\HttpKernel\Kernel->handle(Object(Symfony\Component\HttpFoundation\Request)) [2018-06-17 11:29:25] LEScript.ERROR: #7 {main}

This is preventing me from renewing my certificate and my mailserver is not functioning very well.

Best regards, Julius

[Scott MacDonald]

Are you using version 2.0.8?

[Julius Eskola]

I'm not sure about the version, how do i check that? My image is the one that was latest a few months ago, i think.

[Scott MacDonald]

Just do a "sudo docker images" at your server's prompt and the tag will give you the version. Having said that, being your image is a month or so old.. it would be a good idea to update the image and stop and remove your container and run a new container from the latest image. (Version 2.0.8)

[Julius Eskola]

Now updated the image to version 2.0.8, i tried to renew the certificate. It doesn't inform me of any errors, just stops after the "token saved" message, i tried to reboot with no success. Should i remove the old certificate manually?

[Scott MacDonald]

Yes. Stop and remove your container. You can find and delete the LE cert account folder from your "data" folder. Then start up again.

[Julius Eskola]

Seems it for some reason cannot change the certificate that is in the ssl folder, i mean, i tried to delete everything and finally got the self-signed cert, but script would not replace it with the LE cert.

[Julius Eskola]

It completely fails to fetch the certificate, as i now reattempted, i checked the files and no new ones except _account was generated.

[Scott MacDonald]

You do have a properly configured DNS hostname? Meaning, if you PING the FQDN of your mail server it responds with the public IP address that your mail server uses?

[Julius Eskola]

Yes, sure. I've thought about permissions, is the ssl folder supposed to be owned by root? Docker created it as such.

[Scott MacDonald]

Yes, root will own the SSL folder, but then "mail" should own the folders created within.. There should be a "_account" and then a folder for your FQDN ("mail.myserver.ext").

[Julius Eskola]

I figured it out. My firewall was blocking it somehow, i was thinking that docker could bypass it as it does with mail etc. I should have tried disabling it before, i'm sorry that i wasted your time.

[Scott MacDonald]

Ha.. ufw?

Been there, sorry I should have noticed -- lets-encrypt-certificate-error-existing

[Scott MacDonald]

This issue can be closed. This is a known issue with Poste.io and LE certs - that ports 80 and 443 must be opened thru any inbound firewall (software or hardware) otherwise the docker container is prevented from "looping back" on itself and thus fails in checking itself to see that the token is available.

[SH]

New version have LE token exchange test which should test non-redirected, non-blocked port 80 (ACME requirement)