I think my home IP is blocked for my Caddy server

erfianugrah · May 10, 2024, 4:02pm

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: erfianugrah.com

I ran this command:
echo | openssl s_client -connect acme-v02.api.letsencrypt.org:443 | head
cat /usr/share/ca-certificates/mozilla/ISRG_Root_X1.crt

It produced this output:

22849863120704:error:02002071:system library:connect:No route to host:crypto/bio/b_sock2.c:110:
22849863120704:error:2008A067:BIO routines:BIO_connect:connect error:crypto/bio/b_sock2.c:111:
22849863120704:error:02002065:system library:connect:Network is unreachable:crypto/bio/b_sock2.c:110:
22849863120704:error:2008A067:BIO routines:BIO_connect:connect error:crypto/bio/b_sock2.c:111:
connect:errno=101

My web server is (include version):
Caddy v2.7.6

The operating system my web server runs on is (include version):
Unraid 6.12.10

My hosting provider, if applicable, is:
Home usage

I can login to a root shell on my machine (yes or no, or I don't know):
Yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel):
No

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot):
Caddy server

petercooperjr · May 10, 2024, 4:05pm

This is an error from your side, not from Let's Encrypt side. Are you trying to use IPv4 or IPv6 to connect? What's your routing table or a traceroute look like? We've seen some cases where firewalls or networks were misconfigured and thought that Let's Encrypt's server IP was in their own private network instead of being a normal public IP.

Bruce5051 · May 10, 2024, 4:59pm

Side Note: Using the online tool Let's Debug yields these results
https://letsdebug.net/erfianugrah.com/1943315

CloudflareCDN
WARNING
The domain erfianugrah.com is being served through Cloudflare CDN. Any Let's Encrypt certificate installed on the origin server will only encrypt traffic between the server and Cloudflare. It is strongly recommended that the SSL option 'Full SSL (strict)' be enabled.
https://support.cloudflare.com/hc/en-us/articles/200170416-What-do-the-SSL-options-mean-

rg305 · May 10, 2024, 5:03pm

What show?:

dig acme-v02.api.letsencrypt.org
traceroute -T -p 443 acme-v02.api.letsencrypt.org

Bruce5051 · May 10, 2024, 5:09pm

Side note: here is a list of issued certificates crt.sh | erfianugrah.com, the latest being 2024-05-10 issued from "C=AT, O=ZeroSSL, CN=ZeroSSL ECC Domain Secure Site CA"

The latest Let’s Encrypt issued certificate was 2024-05-07.

And this is shows the presently being severed certificate SSL Checker
is this certificate crt.sh | 12979582034

erfianugrah · May 10, 2024, 6:01pm

Think you're right, this didn't happen before but when I update the Caddy compose, one of my other docker networks had the same IP range as LE one, so it was going to the private network gateway instead of to the internet

petercooperjr · May 10, 2024, 6:03pm

Not the first time we've seen a system confused about which IPs are in private IP space.

Glad you got it figured out!

danb35 · May 11, 2024, 3:14pm

Just for the sake of posterity, "Let's Encrypt is blocking my IP" is (almost) never the reason you can't get a cert. I kind of wish I knew why people are so inclined to jump to this conclusion, because it's vanishingly rare that it's actually the case.

rg305 · May 11, 2024, 3:20pm

Agreed, they have stated that they [LE] only ever block a handful of IPs [and not forever].
So, the odds are staggeringly against such a thing ever happening.
Yet... that is their [customers] obvious conclusion.

erfianugrah · May 11, 2024, 5:00pm

I just saw a case whereby it was actually the case and this hasn't happened to me before (I did get rate-limited before cause I hosted a lot of applications at home), and in my Caddy config, I specifically used an external resolver (1.1.1.1 in this case) but somehow it got routed to the gateway instead, but lesson learnt.

MikeMcQ · May 11, 2024, 5:20pm

"just" as in recent? And on this forum?

Because I think I've read every thread for many months and don't recall a recent legit case of Let's Encrypt blocking an IP. Yes, there have been some long ago but it is exceedingly rare as already noted.

People sometimes claim that's what happened to avoid admitting an error of their own. We see that more often than LE blocking an IP

erfianugrah · May 11, 2024, 5:35pm

Just as in me just finding as opposed to the post being recent, I think it was from 2021, and the problem statement is very similar to mine. And I didn't immediately think it would be a PEBCAK since I made no changes to my router or the Caddy config as of late, so that's why the post. But ya in this case, it was somehow routed to an internal gateway even though an external resolver was set, and I didn't use any PBRs on the router side of things to route DNS queries.

system · June 10, 2024, 5:35pm

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Need unblock IP Help	32	3787	November 14, 2019
Need unblock my IP---thanks for your help Help	9	917	November 10, 2019
My IP is blocked Help	4	510	September 3, 2022
Unblock IP address Help	32	1964	August 29, 2022
I think my Server IP is blocked or something Help	11	534	September 15, 2023

I think my home IP is blocked for my Caddy server

Related topics