403 Forbidden when trying to generate new LetsEncrypt cert

Hey, it's somebody else using a custom AWS Lambda! I'm curious how big this club is. Are you using an existing ACME library to handle making the requests, or is it just completely custom?

That error message means that the order is now in an invalid state (see the diagram for it in the RFC section 7.1.6):

Order objects are created in the "pending" state. Once all of the
authorizations listed in the order object are in the "valid" state,
the order transitions to the "ready" state. The order moves to the
"processing" state after the client submits a request to the order's
"finalize" URL and the CA begins the issuance process for the
certificate. Once the certificate is issued, the order enters the
"valid" state. If an error occurs at any of these stages, the order
moves to the "invalid" state. The order also moves to the "invalid"
state if it expires or one of its authorizations enters a final state
other than "valid" ("expired", "revoked", or "deactivated").

I'm guessing that your authorization challenges failed, and your code isn't logging or diagnosing that properly. My best guess as to why it failed is that your challenge URL you posted only works on IPv4-only networks. That is, the IPv4 address works but the IPv6 address is returning a file-not-found.

$ curl -6 http://geraldtoncityspeedway.com.au/.well-known/acme-challenge/dNEpdSg7NSzf3zM3UFztKti0Y2X1ac05GXGL_X3YzLo
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>404 Not Found</title>
</head><body>
<h1>Not Found</h1>
<p>The requested URL was not found on this server.</p>
<p>Additionally, a 404 Not Found
error was encountered while trying to use an ErrorDocument to handle the request.</p>
</body></html>
$ curl -4 http://geraldtoncityspeedway.com.au/.well-known/acme-challenge/dNEpdSg7NSzf3zM3UFztKti0Y2X1ac05GXGL_X3YzLo
dNEpdSg7NSzf3zM3UFztKti0Y2X1ac05GXGL_X3YzLo._nH4Ef7Db7YQ597Gk6blCA3vIRiVC89ME1WZzQmfteo

So you likely have your AAAA DNS records pointed at the wrong server. (And you should probably add some more handling around the challenge validation, since if it fails and the order becomes invalid then finalizing it obviously won't work.)

4 Likes