Authorization result: invalid

dantehavenaar · September 15, 2020, 5:10pm

Hi,

Can you please help me with the following problem:
I have installed Exchange 2016 on my server en follow this tutorial for install a certificate.

However it gives me the error Authorization result: invalid (see below)
I have read that duckdns needs a TXT record which can be read by letsencrypt.
So I tried to create a TXT record but where can I get the txt / key that i have to fill in where i set the question marks below?
https://www.duckdns.org/update?domains={mail,autodiscover}&token={MyToken Number}&txt={???}[&verbose=true]

Thanks a lot if you can help me.
it gives me a headache…

My domain is:mail.dhavenaar.nl autodiscover.dhavenaar.nl (dhavenaar.duckdns.org)

I ran this command: WACS.EXE as administrator

It produced this output:
[mail.dhavenaar.nl] Authorizing…
[mail.dhavenaar.nl] Authorizing using http-01 validation (SelfHosting)
[mail.dhavenaar.nl] Authorization result: invalid
[mail.dhavenaar.nl] {
“type”: “urn:ietf:params:acme:error:unauthorized”,
“detail”: "Invalid response from http://mail.dhavenaar.nl/.well-known/acme-challenge/mR_PwpzdycC9KNKHnYkToD_7UrZvMYrni2hdch0vGkc [77.170.52.41]: “\r\n<html xmlns=\“http””,
“status”: 403

My web server is (include version): No webserver, Exchange 2016

The operating system my web server runs on is (include version): Windows server 2016

My hosting provider, if applicable, is: KPN

I can login to a root shell on my machine (yes or no, or I don’t know): Yes

I’m using a control panel to manage my site (no, or provide the name and version of the control panel): No

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you’re using Certbot):

griffin · September 15, 2020, 6:31pm

Welcome to the Let's Encrypt Community, Dante

You are currently attempting to use http-01 authentication, which requires the creation of challenge files at a certain location on your webserver. You want to be using dns-01 authentication, which requires the creation of dns txt records of the form _acme-challenge.(domain).

In your case:
_acme-challenge.mail.dhavenaar.nl
_acme-challenge.autodiscover.dhavenaar.nl

dantehavenaar · September 16, 2020, 7:23am

Hi Griffin,

Thanks for your quick reply.
Sorry for my ignorance but I don't know how to use this commands.
Let me explane: I have installed win-acme.v2.1.10.896.x64.pluggable and certbot-beta-installer-win32 on my Windows 2016 server.
How can I use _acme-challenge
Is it a command line in CMD.EXE or do I need to install something else?

Thanks for your patience
Dante

rg305 · September 16, 2020, 1:59pm

It's basically a parameter in the request to WIN-ACME or CERTBOT(for Windows).
Where you would specific DNS authentication instead of HTTP authentication.

griffin · September 16, 2020, 3:31pm

I’ve included a reference to the official manual for win-acme below. I recommend that you start with manual DNS validation (creating the DNS TXT records manually for your domain) then move towards some type of automation for renewal purposes. Check out the Command line arguments and Settings.json entries at the top as well as the DNS validation section to get started.

dantehavenaar · September 19, 2020, 5:31am

Hi Griffin,

Can you please help me again?
I get stuck in this menu:

A simple Windows ACMEv2 client (WACS)
Software version 2.1.10.896 (RELEASE, PLUGGABLE)
ACME server https://acme-v02.api.letsencrypt.org/
IIS version 10.0
Running with administrator credentials
Scheduled task not configured yet
Please report issues at https://github.com/win-acme/win-acme

N: Create certificate (default settings)
M: Create certificate (full options)
R: Run renewals (0 currently due)
A: Manage renewals (0 total)
O: More options…
Q: Quit

Please choose from the menu: m

Running in mode: Interactive, Advanced

Please specify how the list of domain names that will be included in the
certificate should be determined. If you choose for one of the “all bindings”
options, the list will automatically be updated for future renewals to
reflect the bindings at that time.

1: Read site bindings from IIS
2: Manual input
3: CSR created by another program
C: Abort

How shall we determine the domain(s) to include in the certificate?: 2

Enter comma-separated list of host names, starting with the common name: mail.dhavenaar.nl,autodiscover.dhavenaar.nl

Target generated using plugin Manual: mail.dhavenaar.nl and 1 alternatives

Suggested friendly name ‘[Manual] mail.dhavenaar.nl’, press to accept or type an alternative:

The ACME server will need to verify that you are the owner of the domain
names that you are requesting the certificate for. This happens both during
initial setup and for every future renewal. There are two main methods of
doing so: answering specific http requests (http-01) or create specific dns
records (dns-01). For wildcard domains the latter is the only option. Various
additional plugins are available from https://github.com/win-acme/win-acme/.

1: [http-01] Save verification files on (network) path
2: [http-01] Serve verification files from memory
3: [http-01] Upload verification files via FTP(S)
4: [http-01] Upload verification files via SSH-FTP
5: [http-01] Upload verification files via WebDav
6: [dns-01] Create verification records manually (auto-renew not possible)
7: [dns-01] Create verification records with acme-dns (https://github.com/joohoi/acme-dns)
8: [dns-01] Create verification records with your own script
9: [tls-alpn-01] Answer TLS verification request from win-acme
C: Abort

How would you like prove ownership for the domain(s)?: 7

URL of the acme-dns server:

griffin · September 19, 2020, 6:50am

Happy to help.

This is the method to which you are accustomed. It requires manual interaction (creation of dns txt records) every time a certificate is created/renewed. I highly recommend that you start here and successfully get a certificate before proceeding to use #7 (acme-dns).

This method delegates the dns txt challenges to a different domain in order to automate renewals. It's a bit more complicated initially, but it makes renewals cake. It basically involves creating the following CNAME records and a few other steps:
_acme-challenge.mail.dhavenaar.nl
_acme-challenge.autodiscover.dhavenaar.nl

Some resources:

Fortunately for you my friend, I recently walked in the path of automating wildcard certificates with another gentleman who generously documented his process:

dantehavenaar · September 19, 2020, 3:58pm

Hi Griffin,
Thanks for your help so far.
Again I get stuck. My public DNS is DuckDNS. I only can create a TXT record in this way:
https://www.duckdns.org/update?domains=dhavenaar.duckdns.org&token=xxxxxxxxxxxxxxxxxxxxx&txt=LWTAnaK6lt7bRPepgdTnTiAg1YTENTVJKKBDVP4QI1I8&verbose=true

I can’t create a TXT record for mail.dhavenaar.nl or autodiscover.dhavenaar.nl
Is there a way to solved the given string from LetsEncript ?

Thanks a lot for your help
Dante

1: [http-01] Save verification files on (network) path
2: [http-01] Serve verification files from memory
3: [http-01] Upload verification files via FTP(S)
4: [http-01] Upload verification files via SSH-FTP
5: [http-01] Upload verification files via WebDav
6: [dns-01] Create verification records manually (auto-renew not possible)
7: [dns-01] Create verification records with acme-dns (https://github.com/joohoi/acme-dns)
8: [dns-01] Create verification records with your own script
9: [tls-alpn-01] Answer TLS verification request from win-acme
C: Abort

How would you like prove ownership for the domain(s)?: 6

After ownership of the domain(s) has been proven, we will create a
Certificate Signing Request (CSR) to obtain the actual certificate. The CSR
determines properties of the certificate like which (type of) key to use. If
you are not sure what to pick here, RSA is the safe default.

1: Elliptic Curve key
2: RSA key
C: Abort

What kind of private key should be used for the certificate?: 2

When we have the certificate, you can store in one or more ways to make it
accessible to your applications. The Windows Certificate Store is the default
location for IIS (unless you are managing a cluster of them).

1: IIS Central Certificate Store (.pfx per host)
2: PEM encoded files (Apache, nginx, etc.)
3: PFX archive
4: Windows Certificate Store
5: No (additional) store steps

How would you like to store the certificate?: 4

1: IIS Central Certificate Store (.pfx per host)
2: PEM encoded files (Apache, nginx, etc.)
3: PFX archive
4: Windows Certificate Store
5: No (additional) store steps

Would you like to store it in another way too?: 5

With the certificate saved to the store(s) of your choice, you may choose one
or more steps to update your applications, e.g. to configure the new
thumbprint, or to update bindings.

1: Create or update https bindings in IIS
2: Create or update ftps bindings in IIS
3: Start external script or program
4: No (additional) installation steps

Which installation step should run first?: 1

1: Default Web Site
2: Exchange Back End

Choose site to create new bindings: 1

1: Create or update https bindings in IIS
2: Create or update ftps bindings in IIS
3: Start external script or program
4: No (additional) installation steps

Add another installation step?: 4

[autodiscover.dhavenaar.nl] Authorizing…
[autodiscover.dhavenaar.nl] Authorizing using dns-01 validation (Manual)

Domain: autodiscover.dhavenaar.nl
Record: _acme-challenge.autodiscover.dhavenaar.nl
Type: TXT
Content: “LWTAnaK6lt7bRPepgdTnTiAg1YTENTVJKKBDVP4QI1I”
Note: Some DNS managers add quotes automatically. A single set
is needed.

Please press after you’ve created and verified the record

[autodiscover.dhavenaar.nl] Preliminary validation failed: no TXT records found

griffin · September 19, 2020, 4:21pm

Perhaps this may help?

(Derived from https://www.duckdns.org/spec.jsp)

Your TXT record will apply to all sub-subdomains under your domain (e.g. xxx.yyy.duckdns.org shares the same TXT record as yyy.duckdns.org).

The domain can be a single domain or a comma-separated list of domains.

The domain does not need to include the .duckdns.org part of your domain, just the subname (aka your domain name).

So maybe this?

https://www.duckdns.org/update?domains=dhavenaar&token=xxxxxxxxxxxxxxxxxxxxx&txt=LWTAnaK6lt7bRPepgdTnTiAg1YTENTVJKKBDVP4QI1I8&verbose=true

rg305 · September 19, 2020, 5:22pm

Not exactly.

nslookup -q=ns dhavenaar.nl
dhavenaar.nl    nameserver = nsn1.mijndomein.nl
dhavenaar.nl    nameserver = nsn2.mijndomein.nl
dhavenaar.nl    nameserver = nsn3.mijndomein.nl

You CNAME your names to DuckDNS:

nslookup -q=a mail.dhavenaar.nl
Name:    dhavenaar.duckdns.org
Address:  77.170.52.41
Aliases:  mail.dhavenaar.nl

CNAMEing won't change the DNS servers used to resolve the TXT record.
The TXT record need to placed within the "mijndomein.nl" DNS system (not DuckDNS system).

griffin · September 19, 2020, 5:25pm

Does he not have CNAMEs for the _acme-challenges?

rg305 · September 19, 2020, 5:26pm

I don’t think DuckDNS would know how to handle them even if you did send them there.
[it is just a simple DDNS service]

Your instructions, although normally correct, can’t apply in such a (basic) DDNS service model.

griffin · September 19, 2020, 5:27pm

It can because it routes all subdomain requests of a domain to a single txt record.

Are you sure?

This can be used for example to prove your ownership with letsencrypt.org

rg305 · September 19, 2020, 5:30pm

No CNAME even found for:

nslookup -q=ns _acme-challenge.mail.dhavenaar.nl nsn1.mijndomein.nl
Server: pdns107.ultradns.com
Address: 156.154.64.107
*** pdns107.ultradns.com can’t find _acme-challenge.mail.dhavenaar.nl: Non-existent domain

nslookup -q=TXT _acme-challenge.autodiscover.dhavenaar.nl nsn1.mijndomein.nl
Server: pdns107.ultradns.com
Address: 156.154.64.107
*** pdns107.ultradns.com can’t find _acme-challenge.autodiscover.dhavenaar.nl: Non-existent domain

griffin · September 19, 2020, 5:31pm

By jove, you’ve found the snag!

griffin · September 19, 2020, 5:32pm

@dantehavenaar

I think you forgot to create the CNAME records! Thanks be to @rg305 for noticing this.

They should both point to dhavenaar.duckdns.org.

rg305 · September 19, 2020, 5:34pm

For future reference (until they change things):
DDNS services just do one name (to the left of their base name).
{YourName}.service.company
which means you can’t reach:
_acme-challenge.{YourName}.service.company
thorough their service.

Not even sure if they handle TXT records for:
{YourName}.service.company
[which would be the closest thing to making it work in this direction]

I propose the original direction: Use the real DNS servers.

griffin · September 19, 2020, 5:36pm

Not to worry, Rudy.

your TXT record will apply to all sub-subdomains under your domain e.g. xxx.yyy.duckdns.org shares the same TXT record as yyy.duckdns.org

How can he automate then?

rg305 · September 19, 2020, 6:35pm

The simplest would be if "mijndomein.nl" DNS servers support API updates.
If that is NOT possible, then CNAME the TXT records to the DDNS name: "dhavenaar.duckdns.org"
[this would have LE query his IP for those TXT records]
Then run his own DNS server to satisfy the DNS auth requests (himself)
Enters GitHub - joohoi/acme-dns: Limited DNS server with RESTful HTTP API to handle ACME DNS challenges easily and securely. to save the day!

dantehavenaar · September 19, 2020, 8:19pm

Thank you gentlemen,

It’s bedtime now in the Netherlands, tomorrow I will try out your valuable solutions.

Have a nice weekend.
Kind regards,
Dante

Topic		Replies	Views
[solved] Invalid response from Help	4	8402	December 25, 2017
Problem getting certificate for email server on separate host from web server Help	1	1023	April 13, 2017
Authorization result: invalid Help	7	1031	October 7, 2021
Unable to generate and install SSL certificate for exchange server 2019 Help	6	115	November 8, 2024
Authorization result : invalid Help	6	2548	January 6, 2021

Authorization result: invalid

Related topics