Can't generate a certificate when using acme.sh - OpenSSL error

Help Aide (en français)
3

Hello MikeMcQ
Thank you for your answer.
I am using the tutorial you are talking about
I have followed it from the beginning.
Everything was fine :

  • Acme client installation (acme.sh from github)

  • Acme account generation from letsencrypt_test server --> ACCOUNT_THUMBPRINT has been copied

  • I have configured HAProxy to respond to HTTP challenges with settings provided in the tutorial
    see below my haproxy.cfg file:

    haproxy.cfg.txt (1.8 KB)
    Some specific lines for HTTPS

global

stats socket /run/haproxy/admin.sock mode 660 level admin
stats timeout 30s
setenv ACCOUNT_THUMBPRINT 'NWxeJzCNW93KTMaW4sMbB9sL1cZT7sadzzcYF2AMtcM'

frontend navidrome_https
bind *:443 ssl crt /etc/haproxy/certs/ strict-sni
http-request return status 200 content-type text/plain lf-string "%[path,field(-1,/)].${ACCOUNT_THUMBPRINT}\n" if { path_beg '/.well-known/acme-challenge/'

  • I have successfully restarted haproxy
    Obviously, haproxy cannot manage HTTPS because there is no certificate yet
    Remark:
    The 1st time I restarted haproxy, I met an error talking about Low Balancer problem.
    I fixed it by opening the port 80 on my router according to the Let'Encrypt recommendation.

Everything was fine until i try to generate a certificate with acme client from the Let's Encrypt test server
I am meeting this OPEN_SSL error
Fetching https://savoye.duckdns.org/.well-known/acme-challenge/TWOAevQyMg96YUmHsOopu93j0HQEnIaZD8aPRRzRcco: remote error: tls: unrecognized name","status": 400'
[jeu. 29 oct. 2026 12:02:34 CET] errordetail='176.147.60.50: Fetching https://savoye.duckdns.org/.well-known/acme-challenge/TWOAevQyMg96YUmHsOopu93j0HQEnIaZD8aPRRzRcco: remote error: tls: unrecognized name'
[jeu. 29 oct. 2026 12:02:34 CET] savoye.duckdns.org: Invalid status. Verification error details: 176.147.60.50: Fetching https://savoye.duckdns.org/.well-known/acme-challenge/TWOAevQyMg96YUmHsOopu93j0HQEnIaZD8aPRRzRcco: remote error: tls: unrecognized name

TLSv1.3 (IN), TLS alert, unrecognized name (624):
Info: OpenSSL/3.0.13: error:0A000458:SSL routines::tlsv1 unrecognized name
Here is the curl dump log:
[jeu. 29 oct. 2026 12:02:34 CET] == Info: Host savoye.duckdns.org:80 was resolved.
== Info: IPv6: (none)
== Info: IPv4: 176.147.60.50
== Info: Trying 176.147.60.50:80...
== Info: Connected to savoye.duckdns.org (176.147.60.50) port 80
=> Send header, 199 bytes (0xc7)
0000: GET /.well-known/acme-challenge/TWOAevQyMg96YUmHsOopu93j0HQEnIaZ
0040: D8aPRRzRcco HTTP/1.1
0056: Host: savoye.duckdns.org
0070: User-Agent: acme.sh/3.1.7 (https://github.com/acmesh-official/ac
00b0: me.sh)
00b8: Accept: /
00c5:
<= Recv header, 32 bytes (0x20)
0000: HTTP/1.1 301 Moved Permanently
<= Recv header, 19 bytes (0x13)
0000: content-length: 0
<= Recv header, 109 bytes (0x6d)
0000: location: https://savoye.duckdns.org/.well-known/acme-challenge/
0040: TWOAevQyMg96YUmHsOopu93j0HQEnIaZD8aPRRzRcco
<= Recv header, 2 bytes (0x2)
0000:
== Info: Connection #0 to host savoye.duckdns.org left intact
== Info: Issue another request to this URL: 'https://savoye.duckdns.org/.well-known/acme-challenge/TWOAevQyMg96YUmHsOopu93j0HQEnIaZD8aPRRzRcco'
== Info: Host savoye.duckdns.org:443 was resolved.
== Info: IPv6: (none)
== Info: IPv4: 176.147.60.50
== Info: Trying 176.147.60.50:443...
== Info: Connected to savoye.duckdns.org (176.147.60.50) port 443
== Info: ALPN: curl offers h2,http/1.1
=> Send SSL data, 5 bytes (0x5)
0000: .....
== Info: TLSv1.3 (OUT), TLS handshake, Client hello (1):
=> Send SSL data, 512 bytes (0x200)
0000: ........u.K.s]IZ.fRZ.G..B."..z&;.7... ...:..y.....`U.
kQ..&.h*
0040: ..h^....>.......,.0.........+./...$.(.k.#.'.g.....9.....3.....=.
0080: <.5./.....u.........savoye.duckdns.org..........................
00c0: ...............h2.http/1.1.........1.....*.(....................
0100: .....................+........-.....3.&.$... ...G-..........i.$
0140: d..H.N.....w+...................................................
0180: ................................................................
01c0: ................................................................
== Info: CAfile: /etc/ssl/certs/ca-certificates.crt
== Info: CApath: /etc/ssl/certs
<= Recv SSL data, 5 bytes (0x5)
0000: .....
== Info: TLSv1.3 (IN), TLS alert, unrecognized name (624):
<= Recv SSL data, 2 bytes (0x2)
0000: .p
== Info: OpenSSL/3.0.13: error:0A000458:SSL routines::tlsv1 unrecognized name
== Info: Closing connection

I don't know exactly what all that means and what is the reason of the failure
If you have some idea, do not hesitate to answer this post
Regards
Yannick Savoye