Cannot create new certificates. Error 400

Help
1

I'm using Caddy with their CertMagic client. For some reason, the system cant create new certificates. This is the log with debug activated.

I cannot clearly see anything missing, but an 400 error

All 3 letsdebug tests went well

So I'm a little bit clueless on what could be going on.

caddy  | {"level":"debug","ts":1722861954.0194893,"logger":"http.acme_client","msg":"http request","method":"HEAD","url":"https://acme-v02.api.letsencrypt.org/acme/new-nonce","headers":{"User-Agent":["Caddy/2.8.4 CertMagic acmez (linux; amd64)"]},"response_headers":{"Cache-Control":["public, max-age=0, no-cache"],"Date":["Mon, 05 Aug 2024 12:45:53 GMT"],"Link":["<https://acme-v02.api.letsencrypt.org/directory>;rel=\"index\""],"Replay-Nonce":["VbHcGKwnY9Oqu8dr57wzVLSqd7Hlia3IIoSDmFWnpk75YJqfHqc"],"Server":["nginx"],"Strict-Transport-Security":["max-age=604800"],"X-Frame-Options":["DENY"]},"status_code":200}
caddy  | {"level":"debug","ts":1722861954.1816185,"logger":"http.acme_client","msg":"http request","method":"POST","url":"https://acme-v02.api.letsencrypt.org/acme/new-order","headers":{"Content-Type":["application/jose+json"],"User-Agent":["Caddy/2.8.4 CertMagic acmez (linux; amd64)"]},"response_headers":{"Boulder-Requester":["1873678947"],"Cache-Control":["public, max-age=0, no-cache"],"Content-Length":["107"],"Content-Type":["application/problem+json"],"Date":["Mon, 05 Aug 2024 12:45:54 GMT"],"Link":["<https://acme-v02.api.letsencrypt.org/directory>;rel=\"index\""],"Replay-Nonce":["QYxeyab8GJuVlhvpIi3ln3gEPwQNWXKRwiB8R1OL53JB3RP-O0c"],"Server":["nginx"]},"status_code":400}
caddy  | {"level":"error","ts":1722861954.181795,"logger":"tls.obtain","msg":"could not get certificate from issuer","identifier":"fedora.mcamargo.es","issuer":"acme-v02.api.letsencrypt.org-directory","error":"HTTP 400 urn:ietf:params:acme:error:malformed - JWS verification error"}
caddy  | {"level":"debug","ts":1722861954.181849,"logger":"events","msg":"event","name":"cert_failed","id":"8b4124e9-6e1f-4615-a957-8c138f08d180","origin":"tls","data":{"error":{},"identifier":"fedora.mcamargo.es","issuers":["acme-v02.api.letsencrypt.org-directory"],"renewal":false}}
caddy  | {"level":"error","ts":1722861954.181875,"logger":"tls.obtain","msg":"will retry","error":"[fedora.mcamargo.es] Obtain: [fedora.mcamargo.es] creating new order: attempt 1: https://acme-v02.api.letsencrypt.org/acme/new-order: HTTP 400 urn:ietf:params:acme:error:malformed - JWS verification error (ca=https://acme-v02.api.letsencrypt.org/directory)","attempt":1,"retrying_in":60,"elapsed":0.808648962,"max_duration":2592000
1 Like
2

It looks like you may be rate limited:
image

3 Likes
3

:confused: :question:

@mholt, I'm going to throw this one at you. :baseball:

5 Likes
4

I'm already replying on GitHub, but there's something else going on I can't follow with the limited information provided.

5 Likes
5

Could be, how can I check this?

6

OP has discovered some weird things about their container setup that led to the unusual behavior.

4 Likes
7

I used:
crt.sh | fedora.mcamargo.es

2 Likes
8

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.