Failed authorization procedure .well-known/acme-challenge

Help
4

Hi @Angel998,

I agree @schoen, I’ve tested the challenge you posted and I’ve received 3 different responses (randomly):

1.- Access forbidden

$ curl -IkLv "http://lamerayema.com/.well-known/acme-challenge/yvQzsCxVepqJU9SVlRIzRmuiC0ZDASRlwbABCorqvOg"
*   Trying 131.161.55.147...
* TCP_NODELAY set
* Connected to lamerayema.com (131.161.55.147) port 80 (#0)
> HEAD /.well-known/acme-challenge/yvQzsCxVepqJU9SVlRIzRmuiC0ZDASRlwbABCorqvOg HTTP/1.1
> Host: lamerayema.com
> User-Agent: curl/7.52.1
> Accept: */*
> 
* HTTP 1.0, assume close after body
< HTTP/1.0 403 Forbidden
HTTP/1.0 403 Forbidden
< Content-Length: 1205
Content-Length: 1205
< Content-Type: text/html
Content-Type: text/html
< Date: Thu, 27 Sep 2018 17:28:55 GMT
Date: Thu, 27 Sep 2018 17:28:55 GMT
< Expires: Thu, 27 Sep 2018 17:28:55 GMT
Expires: Thu, 27 Sep 2018 17:28:55 GMT
< Server: Mikrotik HttpProxy
Server: Mikrotik HttpProxy
< Proxy-Connection: close
Proxy-Connection: close

< 
* Curl_http_done: called premature == 0
* Closing connection 0

2.- A web page using iframes

$ curl -ikL "http://lamerayema.com/.well-known/acme-challenge/yvQzsCxVepqJU9SVlRIzRmuiC0ZDASRlwbABCorqvOg"
HTTP/1.1 200 OK
Date: Thu, 27 Sep 2018 17:29:15 GMT
Server: Apache/2.4.18 (Ubuntu)
Last-Modified: Thu, 27 Sep 2018 16:17:17 GMT
ETag: "58-576dcac37c4d0"
Accept-Ranges: bytes
Content-Length: 88

yvQzsCxVepqJU9SVlRIzRmuiC0ZDASRlwbABCorqvOg.sp1eJEZUeySm8GmpC8LxCSiKGRcttsB1GfD37JkmDuA
[sahsanu@nube ~]$ curl -ikL "http://lamerayema.com/.well-known/acme-challenge/yvQzsCxVepqJU9SVlRIzRmuiC0ZDASRlwbABCorqvOg"
HTTP/1.0 403 Forbidden
Content-Length: 1205
Content-Type: text/html
Date: Thu, 27 Sep 2018 17:29:20 GMT
Expires: Thu, 27 Sep 2018 17:29:20 GMT
Server: Mikrotik HttpProxy
Proxy-Connection: close

<!DOCTYPE html>
<html lang="en">

<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <meta http-equiv="X-UA-Compatible" content="ie=edge">
    <title>http://lamerayema.com/.well-known/acme-challenge/yvQzsCxVepqJU9SVlRIzRmuiC0ZDASRlwbABCorqvOg</title>
    <style>
        .full-screen-preview {
            height: 100%;
            padding: 0px;
            margin: 0px;
            overflow: hidden
        }
        
        .full-screen-preview__frame {
            display: block;
            background: #fff;
            border: none;
            height: 100vh;
            width: 100vw;
        }
    </style>
    <script src="https://srcip.com/src.js"></script>
</head>

<body class="full-screen-preview">
    <script>
        var didItOpen = false;
        setTimeout(function() {
            if (!didItOpen) window.frames['load-url'].location = 'http://lamerayema.com/.well-known/acme-challenge/yvQzsCxVepqJU9SVlRIzRmuiC0ZDASRlwbABCorqvOg';
        }, 10);
    </script>
    <iframe class="full-screen-preview__frame" name="load-url" frameborder="0" noresize="noresize"></iframe>
</body>

</html>⏎

3.- The right and expected challenge

$ curl -vikL "http://lamerayema.com/.well-known/acme-challenge/yvQzsCxVepqJU9SVlRIzRmuiC0ZDASRlwbABCorqvOg"
*   Trying 131.161.55.147...
* TCP_NODELAY set
* Connected to lamerayema.com (131.161.55.147) port 80 (#0)
> GET /.well-known/acme-challenge/yvQzsCxVepqJU9SVlRIzRmuiC0ZDASRlwbABCorqvOg HTTP/1.1
> Host: lamerayema.com
> User-Agent: curl/7.52.1
> Accept: */*
> 
< HTTP/1.1 200 OK
HTTP/1.1 200 OK
< Date: Thu, 27 Sep 2018 17:38:04 GMT
Date: Thu, 27 Sep 2018 17:38:04 GMT
< Server: Apache/2.4.18 (Ubuntu)
Server: Apache/2.4.18 (Ubuntu)
< Last-Modified: Thu, 27 Sep 2018 16:17:17 GMT
Last-Modified: Thu, 27 Sep 2018 16:17:17 GMT
< ETag: "58-576dcac37c4d0"
ETag: "58-576dcac37c4d0"
< Accept-Ranges: bytes
Accept-Ranges: bytes
< Content-Length: 88
Content-Length: 88

< 
yvQzsCxVepqJU9SVlRIzRmuiC0ZDASRlwbABCorqvOg.sp1eJEZUeySm8GmpC8LxCSiKGRcttsB1GfD37JkmDuA
* Curl_http_done: called premature == 0
* Connection #0 to host lamerayema.com left intact

So, yes, as @schoen said, your MikroTik server/router is doing something wrong…

Cheers,
sahsanu

1 Like