Cannot negotiate alpn protocol "acme-tls/1" for tls-alpn-01 challenge

ashraf-revo · April 4, 2023, 2:30pm

My domain is: petman.asrevo.com
iam trying to build ssl generator in java using (acme4j) it currently working with dns validation
now iam trying to use also alpn my server running behind aws nlb

It produced this output:
however i enabled h2 ,alpn on spring-webflux (reactor-netty) server
i am getting this error cannot negotiate alpn protocol "acme-tls/1" for tls-alpn-01 challenge

rg305 · April 4, 2023, 3:36pm

Hi @ashraf-revo, and welcome to the LE community forum

Please provide as much information as possible.
[the error message alone is not enough]

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. https://crt.sh/?q=example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is:

I ran this command:

It produced this output:

My web server is (include version):

The operating system my web server runs on is (include version):

My hosting provider, if applicable, is:

I can login to a root shell on my machine (yes or no, or I don't know):

I'm using a control panel to manage my site (no, or provide the name and version of the control panel):

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot):

jvanasco · April 4, 2023, 4:04pm

acme4j supports TLS-ALPN-01, so you are likely hitting a configuration issue on your AWS load balancer OR have an issue implementing it it.

i would probably try to troubleshoot the first scenario by setting up a microservice behind the load balancer that can speak tls-alpn-01 and ensuring you can communicate correctly. I would also use Pebble (Issues · letsencrypt/pebble · GitHub) to work this all out, then graduate to letsencrypt's staging servers, before using the live version.

For the second scenario, double check that you are conforming to the docs (tls-alpn-01 Challenge - acme4j) and test the authorization certificate it generates to ensure you made the right one.

Other people here may have more insights.

@rg305 acme4j is a library for building ACME into applications. this is basically a client-dev question, not a general help one.

rg305 · April 4, 2023, 4:23pm

Pint taken.
But again:

jvanasco · April 4, 2023, 4:30pm

100% agreed that error message is not enough. I know what they're doing, and the best response I could give is suggest generic troubleshooting of 2 things that seem more likely than others to be the cause right now.

_az · April 4, 2023, 10:28pm

Does AWS NLB support arbitrary TLS ALPNs?

These are the only options that are presented to me in the EC2 console:

It seems like it only really supports the h2 ALPN. If it won't negotiate acme-tls/1 (rather than falling back to None), then I don't think you'll be able to get this working.

linkp · April 5, 2023, 1:26pm

While I have not used AWS NLB, I can confirm that I had to switch from TLS-ALPN-01 on sites that I placed behind Cloudflare. If the TLS connection terminates on the AWS NLB and is then transported via a new connection to the origin server, I would expect the TLS-ALPN-01 will not be an option.

ashraf-revo · April 5, 2023, 2:03pm

thanks for your response
this is image that check if alpn is working

so i think its not a aws nlb problem

ashraf-revo · April 5, 2023, 2:07pm

this is the certificates that i generated using java acmj

ashraf-revo · April 5, 2023, 2:11pm

also my site response with the certificates that generated before

ashraf-revo · April 5, 2023, 2:16pm

sorry for not follow the template because most of those not fit with my case
for example i dont have server iam building it as mention using spring and netty in java
operating system is linux and in aws as i mention
host is aws
no command used i fail to validate the certificate by tls challenge

ashraf-revo · April 5, 2023, 2:18pm

the error iam getting is cannot negotiate alpn protocol "acme-tls/1" for tls-alpn-01 challenge
so i want to know what might casue this error in my custom server
it response with http2 with alpn enabled and the certifcate that was generated

linkp · April 5, 2023, 2:35pm

How exactly does this screenshot invalidate the possibility of AWS NLB as the problem? You would need to test without AWS NLB and with AWS NLB to make that determination.

jvanasco · April 5, 2023, 6:19pm

Expanding on this: That image shows the platform can support h2 and ALPN in general, but it does not indicate what it supports (or how) in the context of being a load balancer and proxying connections. In other words, it suggests external clients can talk h2/alpn to the load balancer, but it does not suggest anything about how the load balancer speaks to backend services.

ashraf-revo · April 5, 2023, 6:50pm

thanks all
i manged solving this issue
the problem was that i should make the java netty server return acme-tls/1 only when negotiate process it was just passing http11,http2

that is why it was saying cannot negotiate alpn protocol "acme-tls/1" for tls-alpn-01 challenge error

system · May 5, 2023, 6:51pm

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Cannot negotiate ALPN protocol "acme-tls/1" for tls-alpn-01 challenge Client dev	3	2087	March 20, 2021
Cannot negotiate ALPN protocol Help	5	17178	March 1, 2020
Error:unauthorized :: Cannot negotiate ALPN protocol Help	5	2957	December 10, 2023
Tls-alpn-01 with acme4j -> unauthorized Help	19	2563	January 10, 2021
PN protocol "acme-tls/1" for tls-alpn-01 challenge, url: [www.peak.codes] acme: error: 403 :: urn:ietf:params:acme:error:unauthorized :: Cannot negotiat Help	8	3270	May 4, 2019

Cannot negotiate alpn protocol "acme-tls/1" for tls-alpn-01 challenge

Related topics