Creating SSL cert using Azure automation account fails

Help
1

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: X.X.tech

I ran this command: I followed the below process,

It produced this output: Type :
Url :
Token :
Status :
Error :
Identifier : dns:X.X.tech
Data :

ResourceUrl : https://acme-v02.api.letsencrypt.org/acme/order/1460432416/228620585156
Status : invalid
Expires : 2023-12-19T06:31:37Z
NotBefore :
NotAfter :
Identifiers : {dns:X.X.tech}
AuthorizationUrls : {https://acme-v02.api.letsencrypt.org/acme/authz-v3/292840342806}
FinalizeUrl : https://acme-v02.api.letsencrypt.org/acme/finalize/1460432416/228620585156
CertificateUrl :
CSROptions : AcmeCsrOptions

My web server is (include version): Using application gateway

The operating system my web server runs on is (include version):

My hosting provider, if applicable, is: NA

I can login to a root shell on my machine (yes or no, or I don't know):

I'm using a control panel to manage my site (no, or provide the name and version of the control panel): NA

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot):

2

Here you can find the actual error:

104.40.147.146: Fetching http://acona-dev.bosch.tech/.well-known/acme-challenge/flxT3fv0kTjJqTNgJdllj-9ZTAvUfug2cki-OL2qdA4: Timeout during connect (likely firewall problem)

You need to make sure that IP address is reachable on port 80 from the public internet.

2 Likes
3

Thanks!! which IP i have to whitelist? My automation account is not inside the network. So can you please suggest which IP needs to be whitelisted?

1 Like
4

There's nothing to whitelist: Let's Encrypt validates from multiple vantage points and these IP addresses can and do change without warning.

2 Likes
5

Again I have received the same error. So with Azure can you please confirm what do i need to allow?

Trying to get a new certificate for X.X.tech

ResourceUrl : https://acme-v02.api.letsencrypt.org/directory
NewAccount : https://acme-v02.api.letsencrypt.org/acme/new-acct
NewAuthz :
NewNonce : https://acme-v02.api.letsencrypt.org/acme/new-nonce
NewOrder : https://acme-v02.api.letsencrypt.org/acme/new-order
KeyChange : https://acme-v02.api.letsencrypt.org/acme/key-change
RevokeCert : https://acme-v02.api.letsencrypt.org/acme/revoke-cert
Meta : AcmeDirectoryMeta

KeyId

UimiYl39npsXtxCevCss1pF71YMuVbydkpxH3e5OOOoRORwqhw4

Type : http-01
Token : pqU0kEg5LEKEJ-wS2XkltIdZLNZdBNFzxJTaER7qA
Filename : pqU0kEg5LEKEJ-wS2XkltIdZLNZdBNFzxJTaER7qA
RelativeUrl : /.well-known/acme-challenge/pqU0kEg5LEKEJ-wS2XkltIdZLNZdBNFzxJTaER7qA
AbsoluteUrl : acona-dev.bosch.tech/.well-known/acme-challenge/pqU0kEg5LEKEJ-wS2XkltIdZLNZdBNFzxJTaER7qA
Content : pqU0kEg5LEKEJ-wS2XkltIdZLNZdBNFzxJTaER7qA.mzG7rcIn7OKVLf_1cq06n3bxxMUpt-3yIBiPMlIaJkI

ICloudBlob : Microsoft.Azure.Storage.Blob.CloudBlockBlob
BlobType : BlockBlob
Length : 87
IsDeleted : False
BlobClient : Azure.Storage.Blobs.BlobClient
BlobBaseClient : Azure.Storage.Blobs.Specialized.BlockBlobClient
BlobProperties : Azure.Storage.Blobs.Models.BlobProperties
RemainingDaysBeforePermanentDelete :
ContentType : application/octet-stream
LastModified : 12/12/2023 12:06:47 PM +00:00
SnapshotTime :
ContinuationToken :
VersionId :
IsLatestVersion :
AccessTier : Hot
TagCount : 0
Tags :
Context : Microsoft.WindowsAzure.Commands.Storage.AzureStorageContext
Name : .well-known/acme-challenge/pqU0kEg5LEKEJ-wS2XkltIdZLNZdBNFzxJTaER7qA

Type :
Url :
Token :
Status :
Error :
Identifier : dns:X.X.tech
Data :

ResourceUrl : https://acme-v02.api.letsencrypt.org/acme/order/1460914116/228675213766
Status : invalid
Expires : 2023-12-19T12:06:43Z
NotBefore :
NotAfter :
Identifiers : {dns:X.X.tech}
AuthorizationUrls : {https://acme-v02.api.letsencrypt.org/acme/authz-v3/292914842866}
FinalizeUrl : https://acme-v02.api.letsencrypt.org/acme/finalize/1460914116/228675213766
CertificateUrl :
CSROptions : AcmeCsrOptions

6

Source: 0.0.0.0/0
port: 80

4 Likes
7

But if we allow all the IPs then its a risk right? to the application

8

If you allow access to 443 from anywhere, also allowing access to 80 isn't really more of a risk.

If your site is closed and only allows internal users to connect, then you need to either (1) script allowing for anyone to be able to connect when doing a renewal, or (2) use the DNS-01 challenge method instead which requires scripting updates to your DNS server.

4 Likes
9

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.