Getting certificates for home server


#1

Hello !
Here is my problem :
I’m setting up a home server (but remotely accessible from the internet) and I’d like to put https on it, but I have trouble getting certificates from Let’s Encrypt.

My domain name is :
tartopum.freeboxos.fr
I got this domain name from my ISP (https://free.fr) through my router panel. I know that this domain is eligible for https use because my router offers to get me let’s encrypt certificates (unfortunately only usable for my router, not my server).

My OS and web server :
I’m running under ArchLinux with Nginx 1.12.2

I ran the command :
sudo certbot --nginx

It produced the output :
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator nginx, Installer nginx

Which names would you like to activate HTTPS for?

1: tartopum.freeboxos.fr

Select the appropriate numbers separated by commas and/or spaces, or leave input
blank to select all options shown (Enter ‘c’ to cancel): 1
Obtaining a new certificate
/usr/lib/python3.6/site-packages/josepy/jwa.py:107: CryptographyDeprecationWarning: signer and verifier have been deprecated. Please use sign and verify instead.
signer = key.signer(self.padding, self.hash)
Performing the following challenges:
http-01 challenge for tartopum.freeboxos.fr
2018/04/18 06:59:07 [warn] 906#906: could not build optimal types_hash, you should increase either types_hash_max_size: 1024 or types_hash_bucket_size: 64; ignoring types_hash_bucket_size
2018/04/18 06:59:07 [notice] 906#906: signal process started
Waiting for verification…
/usr/lib/python3.6/site-packages/josepy/jwa.py:107: CryptographyDeprecationWarning: signer and verifier have been deprecated. Please use sign and verify instead.
signer = key.signer(self.padding, self.hash)
Cleaning up challenges
2018/04/18 06:59:22 [warn] 909#909: could not build optimal types_hash, you should increase either types_hash_max_size: 1024 or types_hash_bucket_size: 64; ignoring types_hash_bucket_size
2018/04/18 06:59:22 [notice] 909#909: signal process started
Failed authorization procedure. tartopum.freeboxos.fr (http-01): urn:acme:error:connection :: The server could not connect to the client to verify the domain :: Fetching http://tartopum.freeboxos.fr/.well-known/acme-challenge/4cqz4hwc43MxwgzFxhQMAlKRTnrqI9bWhrbQsEfeedM: Timeout

IMPORTANT NOTES:

  • The following errors were reported by the server:

    Domain: tartopum.freeboxos.fr
    Type: connection
    Detail: Fetching
    http://tartopum.freeboxos.fr/.well-known/acme-challenge/4cqz4hwc43MxwgzFxhQMAlKRTnrqI9bWhrbQsEfeedM:
    Timeout

    To fix these errors, please make sure that your domain name was
    entered correctly and the DNS A/AAAA record(s) for that domain
    contain(s) the right IP address. Additionally, please check that
    your computer has a publicly routable IP address and that no
    firewalls are preventing the server from communicating with the
    client. If you’re using the webroot plugin, you should also verify
    that you are serving files from the webroot path you provided.

Additional information :
I checked that my home server is accessible from the internet, i have forwarded ports 80 and 443 through my router to my server, and my firewall does not block these ports.
I also checked that files in the webroot/.well-known/acme-challenge were accessible by putting a dummy file and accessing it through URL.
I think my Nginx configuration is OK, but I can post it if necessary.

Thanks for helping !


#2
tartopum.freeboxos.fr.  3414    IN      A       88.183.18.22
tartopum.freeboxos.fr.  3578    IN      AAAA    2a01:e35:8b71:2160::1

The host indicated by your domain’s IPv6 record is not accessible.

$ curl --connect-timeout 10 -i -6 tartopum.freeboxos.fr
curl: (28) Connection timed out after 10002 milliseconds

Either make your domain accessible via IPv6 or withdraw your AAAA record.


#3

Thanks for your answer.
That’s strange, I don’t see any AAAA record using the dig utility :

;; ANSWER SECTION:
tartopum.freeboxos.fr.	3565	IN	A	88.183.18.22

I don’t know where this record comes from…


#4

I tried to obtain a certificate through my router’s panel and it worked. Then I revoked it and tried again to obtain a certificate on my server, but I couldn’t (same error). Is it really this AAAA record (which I can’t see) that causes the Timeout error ?


#5

That’s because dig’s default question is for A.

If you tell dig to ask an AAAA question, then it will show an AAAA answer.

Yes. This can also be proven by looking at the result of a validation attempt.

From https://acme-staging-v02.api.letsencrypt.org/acme/challenge/tK8kJQQ6UA23eq63L3B_tBryFomcHB1ANaIwAOC1mQs/118834306 ,

  "addressUsed": "2a01:e35:8b71:2160::1"

#6

Ok, thanks a lot, I’ll figure this out !


#7

I tried to make the domain accessible via IPv6, but it’s quite difficult, and I won’t use it. Withdrawing my AAAA record is quite complicated too.
Is there some way to ask let’s encrypt a certificate only for my A record, thus having https for my domain in ipv4 and leaving the AAAA record as it is ?


#8

Unfortunately for you no, that behavior is fixed.


#9

Okay… I guess I have work to do :wink:
Thank you for your help !


#10

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.