Jump to content
Froxlor Forum
  • 0

letsencrypt getting failed under NAT


nisamudeen97

Question

Hi,

Our froxlor server is behiend NAT and it uses the local IP  192.168.73.40.  We have enabled letsencrypt module in froxlor and tried validating SSL for a domain in the server.  SSL generation is getting failed with 403 error.  See the debug log information.      Replaced domain name and main IP.    Can any one help me regarding the issue.

 

[information] Updating Let's Encrypt certificates
[information] Updating domain-name.com
[information] Adding SAN entry: domain-name.com
[information] Adding SAN entry: www.domain-name.com
[information] letsencrypt-v2 Using 'https://acme-v02.api.letsencrypt.org' to generate certificate
[information] letsencrypt-v2 Using existing account key
[information] letsencrypt-v2 Starting certificate generation process for domains
[information] letsencrypt-v2 Sending signed request to https://acme-v02.api.letsencrypt.org/acme/new-order
[information] letsencrypt-v2 Requesting challenge for domain-name.com
[information] letsencrypt-v2 Got challenge token for domain-name.com
[information] letsencrypt-v2 Token for domain-name.com saved at /var/www/froxlor/.well-known/acme-challenge/vkTyLi2ApfP9O9ou8GyDz6WQmB--HP4ULnU0fhjXI0k and should be available at http://domain-name.com/.well-known/acme-challenge/vkTyLi2ApfP9O9ou8GyDz6WQmB--HP4ULnU0fhjXI0k
[information] letsencrypt-v2 Sending request to challenge
[information] letsencrypt-v2 Sending signed request to https://acme-v02.api.letsencrypt.org/acme/chall-v3/803008408/k46kFQ
[information] letsencrypt-v2 Verification pending, sleeping 1s
[information] letsencrypt-v2 Verification pending, sleeping 1s
[error] Could not get Let's Encrypt certificate for domain-name.com: Verification ended with error: {"type":"http-01","status":"invalid","error":{"type":"urn:ietf:params:acme:error:unauthorized","detail":"Invalid response from http:\/\/domain-name.com\/.well-known\/acme-challenge\/vkTyLi2ApfP9O9ou8GyDz6WQmB--HP4ULnU0fhjXI0k [212.224.xxx.xxx]: \"<!DOCTYPE html>\\n<html lang=\\\"en-CA\\\" class=\\\"html_stretched responsive av-preloader-active av-preloader-enabled av-default-lightbox\"","status":403},"url":"https:\/\/acme-v02.api.letsencrypt.org\/acme\/chall-v3\/803008408\/k46kFQ","token":"vkTyLi2ApfP9O9ou8GyDz6WQmB--HP4ULnU0fhjXI0k","validationRecord":[{"url":"http:\/\/www.domain-name.com\/.well-known\/acme-challenge\/vkTyLi2ApfP9O9ou8GyDz6WQmB--HP4ULnU0fhjXI0k","hostname":"www.domain-name.com","port":"80","addressesResolved":["212.224.xxx.xxx"],"addressUsed":"212.224.xxx.xxx"},{"url":"http:\/\/domain-name.com\/.well-known\/acme-challenge\/vkTyLi2ApfP9O9ou8GyDz6WQmB--HP4ULnU0fhjXI0k","hostname":"domain-name.com","port":"80","addressesResolved":["212.224.xxx.xxx"],"addressUsed":"212.224.xxx.xxx"}]}
[information] Let's Encrypt certificates have been updated

 

Link to comment
Share on other sites

2 answers to this question

Recommended Posts

  • 0

Hi,

Problem is solved.   Acme conf was found causing the problem.   Fixed that

 

/etc/apache2/conf-enabled/acme.conf


Alias "/.well-known/acme-challenge" "/var/www/froxlor/.well-known/acme-challenge"
<Directory "/var/www/froxlor/.well-known/acme-challenge">
Require all granted
</Directory>
Link to comment
Share on other sites

  • 0

Well, let's encrypt needs to verify the domain using http-request on the domain, which from your logs resolve to 212.224.xxx.xxx; if your apache does not listen on that IP to validate the token, then it cannot be verified and you won't get a certificate.

Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
×
×
  • Create New...