Can't issue SSL sertificate

Help
1

Hello!
I'm using Hetzner VPS and have few apps on my server with Dokku.
When I used sslip.io free domains for my applications everything was fine, I could get SSL certificates without any issue.
Now I bought domain name for one of my sites on websupport.sk and trying to get SSL with Letsencrypt and having 403\404 errors in command output.

In the DNS settings of my domain I setup A and CNAME records with my hosting IP address:
A:
*.opravacomp.sk 23.88.117.56
opravacomp.sk 23.88.117.56

CNAME:
autodiscover.opravacomp.sk 23.88.117.56
autoconfig.opravacomp.sk 23.88.117.56

My domain is:
opravacomp.sk

I ran this command:
dokku letsencrypt:enable oprava

It produced this output:
=====> Enabling letsencrypt for oprava
-----> Enabling ACME proxy for oprava...
-----> Getting letsencrypt certificate for oprava via HTTP-01
- Domain 'opravacomp.sk'
2023/07/25 09:15:00 [INFO] [opravacomp.sk] acme: Obtaining bundled SAN certificate
2023/07/25 09:15:01 [INFO] [opravacomp.sk] AuthURL: https://acme-v02.api.letsencrypt.org/acme/authz-v3/248814995157
2023/07/25 09:15:01 [INFO] [opravacomp.sk] acme: Could not find solver for: tls-alpn-01
2023/07/25 09:15:01 [INFO] [opravacomp.sk] acme: use http-01 solver
2023/07/25 09:15:01 [INFO] [opravacomp.sk] acme: Trying to solve HTTP-01
2023/07/25 09:15:06 [INFO] Deactivating auth: https://acme-v02.api.letsencrypt.org/acme/authz-v3/248814995157
2023/07/25 09:15:06 Could not obtain certificates:
error: one or more domains had a problem:
[opravacomp.sk] acme: error: 403 :: urn:ietf:params:acme:error:unauthorized :: 2a00:4b40:aaaa:2007::5: Invalid response from http://opravacomp.sk/.well-known/acme-challenge/CveR4WO409y6E4Wo-EcF0_XhQYiCs0zN-U9Q-hbg2Ws: 404
-----> Certificate retrieval failed!
-----> Disabling ACME proxy for oprava...
! Failed to setup letsencrypt
! Check log output for further information on failure

dokku version 0.30.9

My web server is (include version):
nginx-vhosts 0.30.9
The operating system my web server runs on is (include version):
Ubuntu 20.04.4 LTS

My hosting provider, if applicable, is:
Hetzner VPS

I can login to a root shell on my machine (yes or no, or I don't know):
Yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel):
No

root@ubuntu-2gb-fsn1-2:~# dokku domains:report
=====> oprava domains information
Domains app enabled: true
Domains app vhosts: opravacomp.sk
Domains global enabled: false
Domains global vhosts:
=====> plants domains information
Domains app enabled: true
Domains app vhosts: plants.23.88.117.56.sslip.io
Domains global enabled: false
Domains global vhosts:
=====> web domains information
Domains app enabled: true
Domains app vhosts: web.23.88.117.56.sslip.io
Domains global enabled: false
Domains global vhosts:

root@ubuntu-2gb-fsn1-2:~# dokku proxy:report
=====> oprava proxy information
Proxy enabled: true
Proxy port map: http:80:5000 https:443:5000
Proxy type: nginx
=====> plants proxy information
Proxy enabled: true
Proxy port map: http:80:5000 https:443:5000
Proxy type: nginx
=====> web proxy information
Proxy enabled: true
Proxy port map: http:80:5000 https:443:5000
Proxy type: nginx

nslookup opravacomp.sk
Server: 127.0.0.53
Address: 127.0.0.53#53

Non-authoritative answer:
Name: opravacomp.sk
Address: 23.88.117.56
Name: opravacomp.sk
Address: 2a00:4b40:aaaa:2007::5

2

Hi, http validation requires whichever host is responding on your domain to answer http (TCP port 80) challenges, so you need to firewall open on port 80, and port 80 requests need to get to whichever server is handling the challenge responses: Let's Debug

3 Likes
3

Hi, thank you.
I forgot that I was editing my UFW settings. Port 80 wasn't allowed.
Now I added http to ufw and this test in Let's Debug show different result.

But letsencrypt enable in dokku still produces this error output:

root@ubuntu-2gb-fsn1-2:~# dokku letsencrypt:enable oprava
=====> Enabling letsencrypt for oprava
-----> Enabling ACME proxy for oprava...
-----> Getting letsencrypt certificate for oprava via HTTP-01
- Domain 'opravacomp.sk'
2023/07/25 12:57:09 [INFO] [opravacomp.sk] acme: Obtaining bundled SAN certificate
2023/07/25 12:57:09 [INFO] [opravacomp.sk] AuthURL: https://acme-v02.api.letsencrypt.org/acme/authz-v3/248859525737
2023/07/25 12:57:09 [INFO] [opravacomp.sk] acme: Could not find solver for: tls-alpn-01
2023/07/25 12:57:09 [INFO] [opravacomp.sk] acme: use http-01 solver
2023/07/25 12:57:09 [INFO] [opravacomp.sk] acme: Trying to solve HTTP-01
2023/07/25 12:57:14 [INFO] Deactivating auth: https://acme-v02.api.letsencrypt.org/acme/authz-v3/248859525737
2023/07/25 12:57:14 Could not obtain certificates:
error: one or more domains had a problem:
[opravacomp.sk] acme: error: 403 :: urn:ietf:params:acme:error:unauthorized :: 2a00:4b40:aaaa:2007::5: Invalid response from http://opravacomp.sk/.well-known/acme-challenge/LFEhQEeKHhvBI7enehlfQZFDpVCbOEl_mo4h8AZ7c6E: 404
-----> Certificate retrieval failed!
-----> Disabling ACME proxy for oprava...
! Failed to setup letsencrypt
! Check log output for further information on failure

How can we interpret this result?

1 Like
4

You have an A record for IPv4 but you also have an AAAA record for IPv6. These two point to different servers. Your A record points to nginx server but AAAA points to an openresty server.

Let's Encrypt servers prefer the AAAA address. Since that gives a faulty 404 Not Found response your request fails.

You need to correct the AAAA record or remove it if you don't have IPv6 available

nslookup opravacomp.sk
A    Address: 23.88.117.56
AAAA Address: 2a00:4b40:aaaa:2007::5
6 Likes
5

I think I should refresh and improve my DNS knowledge.
Now test is all green and I was able to generate SSL certificate with letsencrypt in dokku, website now available via https

@MikeMcQ and @webprofusion thank you so much :heart:

2 Likes
6

Terrific. You even got it working with IPv6. Many people just quickly delete the AAAA record but it is best if you correct it like you did.

5 Likes
7

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.