Jump to content
Froxlor Forum
  • 0
nisamudeen97

letsencrypt getting failed under NAT

Question

Hi,

Our froxlor server is behiend NAT and it uses the local IP  192.168.73.40.  We have enabled letsencrypt module in froxlor and tried validating SSL for a domain in the server.  SSL generation is getting failed with 403 error.  See the debug log information.      Replaced domain name and main IP.    Can any one help me regarding the issue.

 

[information] Updating Let's Encrypt certificates
[information] Updating domain-name.com
[information] Adding SAN entry: domain-name.com
[information] Adding SAN entry: www.domain-name.com
[information] letsencrypt-v2 Using 'https://acme-v02.api.letsencrypt.org' to generate certificate
[information] letsencrypt-v2 Using existing account key
[information] letsencrypt-v2 Starting certificate generation process for domains
[information] letsencrypt-v2 Sending signed request to https://acme-v02.api.letsencrypt.org/acme/new-order
[information] letsencrypt-v2 Requesting challenge for domain-name.com
[information] letsencrypt-v2 Got challenge token for domain-name.com
[information] letsencrypt-v2 Token for domain-name.com saved at /var/www/froxlor/.well-known/acme-challenge/vkTyLi2ApfP9O9ou8GyDz6WQmB--HP4ULnU0fhjXI0k and should be available at http://domain-name.com/.well-known/acme-challenge/vkTyLi2ApfP9O9ou8GyDz6WQmB--HP4ULnU0fhjXI0k
[information] letsencrypt-v2 Sending request to challenge
[information] letsencrypt-v2 Sending signed request to https://acme-v02.api.letsencrypt.org/acme/chall-v3/803008408/k46kFQ
[information] letsencrypt-v2 Verification pending, sleeping 1s
[information] letsencrypt-v2 Verification pending, sleeping 1s
[error] Could not get Let's Encrypt certificate for domain-name.com: Verification ended with error: {"type":"http-01","status":"invalid","error":{"type":"urn:ietf:params:acme:error:unauthorized","detail":"Invalid response from http:\/\/domain-name.com\/.well-known\/acme-challenge\/vkTyLi2ApfP9O9ou8GyDz6WQmB--HP4ULnU0fhjXI0k [212.224.xxx.xxx]: \"<!DOCTYPE html>\\n<html lang=\\\"en-CA\\\" class=\\\"html_stretched responsive av-preloader-active av-preloader-enabled av-default-lightbox\"","status":403},"url":"https:\/\/acme-v02.api.letsencrypt.org\/acme\/chall-v3\/803008408\/k46kFQ","token":"vkTyLi2ApfP9O9ou8GyDz6WQmB--HP4ULnU0fhjXI0k","validationRecord":[{"url":"http:\/\/www.domain-name.com\/.well-known\/acme-challenge\/vkTyLi2ApfP9O9ou8GyDz6WQmB--HP4ULnU0fhjXI0k","hostname":"www.domain-name.com","port":"80","addressesResolved":["212.224.xxx.xxx"],"addressUsed":"212.224.xxx.xxx"},{"url":"http:\/\/domain-name.com\/.well-known\/acme-challenge\/vkTyLi2ApfP9O9ou8GyDz6WQmB--HP4ULnU0fhjXI0k","hostname":"domain-name.com","port":"80","addressesResolved":["212.224.xxx.xxx"],"addressUsed":"212.224.xxx.xxx"}]}
[information] Let's Encrypt certificates have been updated

 

Share this post


Link to post
Share on other sites

2 answers to this question

Recommended Posts

  • 0

Hi,

Problem is solved.   Acme conf was found causing the problem.   Fixed that

 

/etc/apache2/conf-enabled/acme.conf


Alias "/.well-known/acme-challenge" "/var/www/froxlor/.well-known/acme-challenge"
<Directory "/var/www/froxlor/.well-known/acme-challenge">
Require all granted
</Directory>

Share this post


Link to post
Share on other sites
  • 0

Well, let's encrypt needs to verify the domain using http-request on the domain, which from your logs resolve to 212.224.xxx.xxx; if your apache does not listen on that IP to validate the token, then it cannot be verified and you won't get a certificate.

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

  • Similar Content

    • By Jason Szymanski
      Hallo,
       
      ich habe leider ein Problem mit Froxlor.
      Zu meiner Situation: Froxlor läuft auf der Subdomain web01.meinedomain.net
      Jetzt möchte ich die Domain aber auch noch weiter Nutzen und habe mich daher als Kunde angelegt und die Domain meineDomain.net als Domain hinzugefügt.
      Dort kann ich auch weitere Subdomains hinzufügen. Das scheint soweit auch zu klappen ich sehe das er VHosts anlegt und auch die Verzeichnisse im FTP anlegt.
      Wenn ich jetzt allerdings versuche auf meinedomain.net oder eine andere Subdomain unter dieser Domain zuzugreifen leitet er mich auf web01.meinedomain.net
      Ich habe mich schon in den Einstellungen umgeschaut konnte aber keine entsprechende Einstellung finden an der das liegen könnte.
      Wie verhindere ich also das er mich auf Froxlor umleitet?
       
      Mit Freundlichen Grüßen
      Jason Szymanski
    • By nisamudeen97
      Hi,
      Wile doing migration of email accounts from one froxlor server to another I have noting some thing.   Expecting some clarification on this.  As we all know emails are normally stored in the location "/var/customers/mail/user/domain.com/user/Maildir/" .   I create email accounts via froxlor panel and copy the email files directly via scp or rsync from old server to new.  The strange thing I have noticed is it is not coping custom folders and its emails like we have in source.  
      The solution I have found for this is to use imapsync between old and new.  imapsync is preserving custom folders like as it is in source.    Does it mean custom folder settings are stored somewhere else?  How we can preserve it and copy emails manually?
    • By peterpan
      Hi,
      I have a domain equipped with a certificate from LE. The cert is valid another 2 months. Now I added a domain as an alias of the existing domain, but the certificate isn't updated to have the new domain as its SAN.
      How do I trigger getting a new and updated certificate? Should I delete the existing one?
      Thanks for helping out.
       
      Peter
    • By FroxTheFrog
      For some reason the .well-known/acme-challenge inside my froxlor folder just contains only four files. I have several dozens of domains and subdomains, so this must be an error. How can I regenerate them?`
    • By juca
      Hi,
      I was wondering if it possible to specify different custom configurations for HTTP and HTTPS traffic. 
      I have a couple of sites that would need to keep HTTP traffic active. Basically what I would like to do is the following:
      for HTTP:
      ProxyPreserveHost On ProxyRequests off ### HTTP Proxy AllowCONNECT 443 563 ProxyPass / http://localhost:16080/ ProxyPassReverse / http://localhost:16080/  
      for HTTPS:
      ###SSL Proxy ProxyPreserveHost On ProxyRequests off SSLProxyEngine on SSLProxyVerify none  SSLProxyCheckPeerCN off SSLProxyCheckPeerName off SSLProxyCheckPeerExpire off ProxyPass / https://localhost:16443/ ProxyPassReverse / https://localhost:16433/ is this possible?
       
×
×
  • Create New...