Certbot failing in AWS Elastic Beanstalk ngix extension

gclaret · May 23, 2019, 3:08pm

Hello, first of all, apoloogies for being a noob on the subject, but im stuck and need some help

I have an EC2 instance, behind Elastic Beanstalk, and I found a script online, that is a NGIX extension, to be able to generate the certificates for the domain in question...

First of all, I went to Route 53, and added the information of my domain (sdk.bigfootgaming.net), and also in GoDaddy, added an A dns rule to forward sdk.bigfootgaming.net to my EC2 instance's IP. That is working.

Now, in my NGIX script, Im running the following

container_commands:
00_createdir:
command: "mkdir /opt/certbot || true"
10_installcertbot:
command: "wget https://dl.eff.org/certbot-auto -O /opt/certbot/certbot-auto"
20_permission:
command: "chmod a+x /opt/certbot/certbot-auto"
30_getcert:
command: "sudo /opt/certbot/certbot-auto certonly --debug --non-interactive --email gaston@bigfootgaming.net --agree-tos --standalone --domains sdk.bigfootgaming.net --keep-until-expiring"
40_link:
command: "ln -sf /etc/letsencrypt/live/sdk.bigfootgaming.net /etc/letsencrypt/live/ebcert"
50_config:
command: "mv /etc/nginx/conf.d/https_custom.pre /etc/nginx/conf.d/https_custom.conf"
90_cronjob_renew:
command: "cat .ebextensions/certificate_renew.txt > /etc/cron.d/certificate_renew && chmod 644 /etc/cron.d/certificate_renew"

The GetCert part of this is failing, with the following message:

The following errors were reported by the server:

Domain: sdk.bigfootgaming.net
Type:   unauthorized
Detail: Invalid response from
http://sdk.bigfootgaming.net/.well-known/acme-challenge/LzhUFJG8JtK0ncGzrwljmKCF-fs1DJFetiztRuiInwI
[160.153.52.71]: "<!DOCTYPE HTML PUBLIC \"-//IETF//DTD HTML
2.0//EN\">\n<html><head>\n<title>500 Internal Server
Error</title>\n</head><body>\n<h1>Inter"

Im not sure here what its doing. I know it cant seem to access the files, and if I FTP into the site, I dont see them created there.

Any help with this is greatly appreciated

Gaston

JuergenAuer · May 23, 2019, 3:25pm

Hi @gclaret

looks like that doesn't work.

Your dns entries ( https://check-your-website.server-daten.de/?q=sdk.bigfootgaming.net ):

Host	T	IP-Address	is auth.	∑ Queries	∑ Timeout
sdk.bigfootgaming.net	A	35.160.69.173	yes	1	0
	AAAA		yes
www.sdk.bigfootgaming.net		Name Error	yes	1	0

A different ip address.

Your name servers:

bigfootgaming.net
	•  ns73.domaincontrol.com / p21
		•
	•  ns74.domaincontrol.com / p06
		•

But there is a new certificate, created today:

CertSpotter-Id	Issuer	not before	not after	Domain names	LE-Duplicate	next LE
927605971	CN=Let's Encrypt Authority X3, O=Let's Encrypt, C=US	2019-05-23 13:25:50	2019-08-21 13:25:50	sdk.bigfootgaming.net
1 entries	duplicate nr. 1

This certificate isn't used, instead, there is the

CN=www.bigfootgaming.net
	16.05.2019
	14.08.2019
expires in 83 days	bigfootgaming.net, www.bigfootgaming.net - 2 entries

used. Looks like you have created a certificate and changed your settings.

gclaret · May 23, 2019, 3:29pm

Thanks for the super quick reply!

I’m not quite sure I follow thought

There is a new certificate, which I created today, but I created that by hand on ZeroSSL.com… That works perfectly if my A record for sdk.bigfootgaming.net points to my own hosting, but when I make that record point to the EC2 instance (35.160.69.173), it gives me unsecure again… thats why I wanted to run this from a script from inside the deployment of my EC2 instance.

Sorry again if it’s clear whats wrong, but I dont quite understand, and am stuck for weeks on this

JuergenAuer · May 23, 2019, 3:43pm

Ok, then this certificate isn't relevant.

That's the ip address I see. But why has the error a different ip address - 160.153.52.71?

The main configuration looks ok:

Domainname	Http-Status	Sec.	G
• http://sdk.bigfootgaming.net/
35.160.69.173	404	0.370	M
Not Found

• https://sdk.bigfootgaming.net/
35.160.69.173	404	1.833	N
Not Found
Certificate error: RemoteCertificateNameMismatch

• http://sdk.bigfootgaming.net/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de
35.160.69.173	404	0.363	A
Not Found
Visible Content: Cannot GET /.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de

If there is a running instance, webroot (not standalone) should always work. Find your nginx root (in your vHost definition), then use it.

certbot run -a webroot -i nginx -w yourRoot -d sdk.bigfootgaming.net

standalone is hard to debug, webroot is easier.

gclaret · May 23, 2019, 4:02pm

Which error has a different IP? And thats the original’s domain IP (the one from godaddy, and my actual website, www.bigfootgaming.net)

I don’t really understand how to change this to use webroot… I have a file that tries to do all of this for me, is it posible to do from there? just changing the command in get_cert?

The problem Im seeing is not that it’s not finding the files, is that it’s not creating them at all…

Here is my code, in case it helps you (I cant thank you enough Juergen!!!)

# Dont forget to set the env variable "certdomain", and either fill in your email below or use an env variable for that too.
# Also note that this config is using the LetsEncrypt staging server, remove the flag when ready!

files:

  # The Nginx config forces https, and is meant as an example only.
  /etc/nginx/conf.d/000_http_redirect_custom.conf:
    mode: "000644"
    owner: root
    group: root
    content: |
      server {
        listen 8080;
        return 301 https://$host$request_uri;
      }

  # The Nginx config forces https, and is meant as an example only.
  /etc/nginx/conf.d/https_custom.pre:
    mode: "000644"
    owner: root
    group: root
    content: |
      # HTTPS server
      server {
        listen       443 default ssl;
        server_name  localhost;
        error_page  497 https://$host$request_uri;

        ssl_certificate      /etc/letsencrypt/live/ebcert/fullchain.pem;
        ssl_certificate_key  /etc/letsencrypt/live/ebcert/privkey.pem;

        ssl_session_timeout  5m;
        ssl_protocols  TLSv1.1 TLSv1.2;
        ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";
        ssl_prefer_server_ciphers   on;

        location / {
            proxy_pass  http://nodejs;
            proxy_set_header   Connection "";
            proxy_http_version 1.1;
            proxy_set_header        Host            $host;
            proxy_set_header        X-Real-IP       $remote_addr;
            proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header        Upgrade         $http_upgrade;
            proxy_set_header        Connection      "upgrade";
        }
      }

packages:
  yum:
    epel-release: []

container_commands:
  00_createdir:
    command: "mkdir /opt/certbot || true"
  10_installcertbot:
    command: "wget https://dl.eff.org/certbot-auto -O /opt/certbot/certbot-auto"
  20_permission:
    command: "chmod a+x /opt/certbot/certbot-auto"
  30_getcert:
    command: "sudo /opt/certbot/certbot-auto certonly --debug --non-interactive --email gaston@bigfootgaming.net --agree-tos --standalone --domains sdk.bigfootgaming.net --keep-until-expiring"
  40_link:
    command: "ln -sf /etc/letsencrypt/live/sdk.bigfootgaming.net /etc/letsencrypt/live/ebcert"
  50_config:
    command: "mv /etc/nginx/conf.d/https_custom.pre /etc/nginx/conf.d/https_custom.conf"
  90_cronjob_renew:
    command: "cat .ebextensions/certificate_renew.txt > /etc/cron.d/certificate_renew && chmod 644 /etc/cron.d/certificate_renew"

JuergenAuer · May 23, 2019, 4:14pm

That's

the error message Letsencrypt sees and sends back.

There is the ip address visible. Checking that ip - https://check-your-website.server-daten.de/?q=160.153.52.71

there is a different certificate.

CN=*.prod.phx3.secureserver.net, OU=Domain Control Validated (2440)
	18.09.2018
	18.09.2020
expires in 484 days	
*.prod.phx3.secureserver.net, prod.phx3.secureserver.net - 2 entries

So I don't understand why Letsencrypt sees that ip address.

But I don't think your instance can create a file under 160.153.52.71. So the result must be invalid.

gclaret · May 23, 2019, 4:39pm

Found a way to do the webroot command

sudo ./certbot-auto certonly --debug --non-interactive --email gaston@bigfootgaming.net --agree-tos --authenticator webroot --webroot-path /var/www/acme-challenge --domains sdk.bigfootgaming.net --keep-until-expiring --installer nginx

but now Im getting the following…

Activity execution failed, because: ./certbot-auto has insecure permissions!

Any idea why that is? looked at the suggested help (Certbot-auto deployment best practices), but not sure what most of them mean

JuergenAuer · May 23, 2019, 6:09pm

Is that

really your webroot?

So

/var/www/acme-challenge/.well-known/acme-challenge/1234

should be visible via

http://sdk.bigfootgaming.net/.well-known/acme-challenge/1234

gclaret · May 23, 2019, 6:45pm

Let go back a bit if we can Juergen, to make sure we can move forward, and I dont keep running in circles…

My server functionality is in my EC2 instance (35.160.69.173)
I also have a domain/hosting, in GoDaddy, for my website (bigfootgaming.net, 160.153.52.71)

What Im trying to achieve, is to:

call sdk.bigfootgaming.net, and get the funcionality inside of the EC2 instance
make this a secure connection

To make the “redirection” work, I created a DNS rule in GoDaddy, type A, with host: sdk, and value: 35.160.69.173. This seems to work ok

The part Im lost now, is the following:

The cert-auto commands, im running when I deploy de EC2 instance, BUT, it asks me for a domain… should I use sdk.bigfootgaming.net? is this the correct thing to do?

JuergenAuer · May 23, 2019, 7:31pm

This isn't a redirect, it's a normal A-record pointing to a server. That's the ip Letsencrypt must check.

Yes. Certbot runs on this ip, so Certbot can create the validation file.

gclaret · May 24, 2019, 11:24pm

After another whole day of searching, still stuck, but at least I understand where the problem is…

Relevant info in my nginx extension file:

 /etc/nginx/conf.d/001_allow_LetsEncrypt_verification.conf:
    mode: "000644"
    owner: root
    group: root
    content: |
      server {
        location /.well-known/acme-challenge {
          allow all;
          root /var/www/acme-challenge/;
        }
      }

command: "sudo /usr/local/bin/certbot-auto certonly --debug --non-interactive --email gaston@bigfoootgaming.net --agree-tos --authenticator webroot --webroot-path /var/www/acme-challenge --domains sdk.bigfootgaming.net --keep-until-expiring --installer nginx"

From what I understand of the above, it will try to put the certs in /var/www/acme-challenge/, and then when it tries to fetch them for the challenge, using the above rule, it replaces /.well-known/acme-challenge with var/www/acme-challenge

This of course, does not work. So I followed your advice, and added a file by hand ini var/www/acme-challenge, and tried to get it this way:

http://sdk.bigfootgaming.net/acme-challenge/atfyF39_CeEVB9kE4Y4AM2u2OQ0lP9Hmv0RRGh4tkHU

That was giving me 'cannot GET …" error. So I kept on reading, and found that maybe its an issue of static files… I tried to set them up this way, still doesnt work, but now I get a 404 error.

path: /acme-challenge
directory: var/www/acme-challenge

(I tried like 10 variations of the above, with var/www, without, with traiiling /, nothing seems to work)

Any ideas come to mind?

JuergenAuer · May 25, 2019, 5:28am

That's

the wrong path.

You must use

http://sdk.bigfootgaming.net/.well-known/acme-challenge/atfyF39_CeEVB9kE4Y4AM2u2OQ0lP9Hmv0RRGh4tkHU

these are the two subfolders Letsencrypt checks.

gclaret · May 25, 2019, 7:43am

That doesnt make sense…

Fiirst, I put that file BY HAND ini var/www/acme-challenge, why would I look for it in .well-know/…

And second, like I said, doesnt this directive, when it does go looking for the actual file, replace .well-know/acme-challenge for var/www/acme-challenge?

server {
        location /.well-known/acme-challenge {
          allow all;
          root /var/www/acme-challenge/;
        }
      }

Anyways, by putting the file by hand in var/www/acmee-challenge is not workiing, so 'm not sure whats going on anymore

JuergenAuer · May 25, 2019, 7:47am

/.well-known/acme-challenge/ is fixed, if you want to use http - 01 validation.

Read

https://www.rfc-editor.org/rfc/rfc8555.html#section-8.3

The path at which the resource is provisioned is comprised of the
fixed prefix "/.well-known/acme-challenge/", followed by the "token"
value in the challenge. The value of the resource MUST be the ASCII
representation of the key authorization.

GET /.well-known/acme-challenge/LoqXcYV8...jxAjEuX0
Host: example.org

So

http://sdk.bigfootgaming.net/.well-known/acme-challenge/atfyF39_CeEVB9kE4Y4AM2u2OQ0lP9Hmv0RRGh4tkHU

must answer with the correct value. This isn't optional, this isn't something you can select.

If your configuration doesn't work, then your configuration is buggy. Remove all these additional location definitions.

JuergenAuer · May 25, 2019, 4:26pm

A post was split to a new topic: Starting a new topic

gclaret · May 26, 2019, 11:41pm

Ok, I was able to get the creation of everything working, now I seem to have a different problem

Everytime I try to read the created certs from my NodeJS app, I get the following:

Error: EACCES: permission denied, open '/etc/letsencrypt/live/sdk.bigfootgaming.net/privkey.pem'

I’ve read a ton of posts that mention that its a permissions issue, and that if I grant permissions to /etc/letsencrypt/live/ and /etc/letsencrypt/archive it should work, but its not.

These are my permissions:

This is all running in AWS, in Elastic Beanstalk & EC2, thats why the user is ec2-user.

JuergenAuer · May 27, 2019, 7:57am

Happy to read that you have created a certificate.

Not only one, 4 identical.

Yes, now it's only a permission problem. Depends on your NodeJS app, may have not enough rights.

system · June 26, 2019, 7:57am

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Elastic Beanstalk node challenge failing Help	8	1840	July 23, 2019
Amazons-aws-elasticbeanstalk-lets-encrypt Server	1	3045	July 28, 2018
Get certificate for AWS Elastic Beanstalk without Beanstalk Load Balancer on NodeJS Help	4	6324	February 23, 2018
Certbot, nginx centos 7 renew error Help	3	1179	May 5, 2021
Can´t generate new SSL certificates and dont know why Help	5	484	July 7, 2023

Certbot failing in AWS Elastic Beanstalk ngix extension

Related topics