the mistake was: messages with s, not message.
sudo grep letsencrypt /var/log/message
Returns:
2016-11-14T10:01:57+01:00 Backup synoscgi_SYNO.Core.Certificate.LetsEncrypt_1_create[32525]: certificate.cpp:957 syno-letsencrypt failed. 1 [syno-letsencrypt output is not a json: { “error”: 102, “msg”: "Invalid response from http://fms-data.dk/.well-known/acme-challenge/pdmhOfBhfCRcupia3DzN0HjaX4Nq7ccc6otKPfoFJ_8: "<!doctype html>http://fms-data.dk/.well-known/acme-challenge/pdmhOfBhfCRcupia3DzN0HjaX4Nq7ccc6otKPfoFJ_8: "<!doctype html>http://backup.fms-data.dk/.well-known/acme-challenge/b2UGx73k5xmOlw93b_KcfnD7u8vL8OaAG1D5Vlk3_3A: "http://backup.fms-data.dk/.well-known/acme-challenge/b2UGx73k5xmOlw93b_KcfnD7u8vL8OaAG1D5Vlk3_3A: "http://backup.fms-data.dk/.well-known/acme-challenge/lE35L9fH4DuLQxv3RWv-OJaB3Q5aH7s_3hxMd0CZjKc: "http://backup.fms-data.dk/.well-known/acme-challenge/lE35L9fH4DuLQxv3RWv-OJaB3Q5aH7s_3hxMd0CZjKc: "http://backup.fms-data.dk/.well-known/acme-challenge/s7jX2D7--sWJKheLCmHuHRuOiuj-iN_oGlpyOvq6Yx0: "http://backup.fms-data.dk/.well-known/acme-challenge/Dn8cAHXbYNXOx6VdYjZRNQatIS1K31VdTpvVHtX-nvw: "
ls -l /var/log
returns:
total 3716
great, thanks - the "sudo grep letsencrypt /var/log/message" is the useful stuff
The key thing is ...
"Invalid response from http://backup.fms-data.dk/.well-known/acme-challenge/Dn8cAHXbYNXOx6VdYjZRNQatIS1K31VdTpvVHtX-nvw: "
to validate your domain (and hence obtain a certificate), your system needs to display a given token ( in this case backup.fms-data.dk/.well-known/acme-challenge/Dn8cAHXbYNXOx6VdYjZRNQatIS1K31VdTpvVHtX-nvw ) which Let's Encrypt needs to connect to - and can't (hence the error message, and no certificate).
This is where @sahsanu was referring to
sahsanu:
Yesterday I check your domain and I saw that it was served by a web server named "web station" or something like that and you were redirecting it to yourdomain:5050. Today it is served by nginx and it does not redirect to any other port so don't know whether this nginx server is a proxy server redirecting request to another machine or it is a web server running in your Synology NAS. Also, don't know what is the default web server used by your NAS nor if syno-letsencrypt can work with it...
and
sahsanu:
Once you have created the dirs (keep in mind that /usr/share/nginx/html/ is just an example and you should change it for the right path) you should create a test file with whatever text.
echo "This is a test" > /usr/share/nginx/html/.well-known/acme-challenge/test
Now you should check that you can get the file with your browser: http://backup.fms-data.dk/.well-known/acme-challenge/test
sahsanu
February 2, 2017, 12:42am
24
Hello @Franky13 ,
Again, sorry for the delay. I see @serverco is here fighting with you to solve the problem (thanks Andy) ;).
Just a comment, Let’s Encrypt follows redirects but as far as I know, it doesn’t follow them if they point to a non web standard port (80 and 443).
I mean, your web server is redirecting http://backup.fms-data.dk to https://backup.fms-data.dk:5050 and that won’t work. Let’s encrypt doesn’t like it, your redirect should go to 443 instead of 5050.
$ curl -IkL http://backup.fms-data.dk
HTTP/1.1 302 Moved temporarily
Server: nginx
Date: Thu, 02 Feb 2017 00:25:41 GMT
Connection: keep-alive
Keep-Alive: timeout=20
Cache-control: no-store
Location: https://backup.fms-data.dk:5050/ <-- here is the redirect
HTTP/1.1 200 OK
Server: nginx
Date: Thu, 02 Feb 2017 00:25:42 GMT
Content-Type: text/html; charset="UTF-8"
Connection: keep-alive
Keep-Alive: timeout=20
Cache-control: no-store
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
X-Frame-Options: SAMEORIGIN
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Content-Security-Policy: base-uri 'self'; connect-src *; default-src 'self' 'unsafe-eval' data: blob: https://*.synology.com; font-src 'self' data:; form-action 'self'; frame-ancestors 'self' https://gofile.me http://gofile.me; frame-src 'self' data: blob: https://*.synology.com http://*.synology.com http://*.synology.cn; img-src 'self' data: blob:; media-src 'self' data: about:; report-uri webman/csp_report.cgi; script-src 'self' 'unsafe-eval' data: blob: https://*.synology.com; style-src 'self' 'unsafe-inline';
Strict-Transport-Security: max-age=15768000; includeSubdomains; preload
I’ve just tested it on my own server and I’m not able to issue a certificate if my domain redirects to https://domain:5050 , if i use 443 instead of 5050 it works as expected. Don’t know if you are starting your service on port 5050 for any reason but if you want a Let’s Encrypt cert you should think about move it to 443 instead of 5050 or try to use the DNS challenge, but that is another story.
Also, as @serverco reminded you, you need to be sure that your web server process this request correctly http://backup.fms-data.dk/.well-known/acme-challenge/test (remember to create the dirs and the test file as I commented on previous posts).
Cheers,
Hi Guys!
The Synology OS will not allow me to redirect to any port under 1000 as it tells me it is unsecure or to common. Somehow it worked for me in the setup fase with the :5050… Don’t know how to get around this, but I have contacted Synology as well who is looking at the log files right now.
I feel silly to ask for this, but although I’m pretty confident with DOS and the likes, and know zero about using the SSH client.
I had to search how to make dirs on the SSH. But what is the right path, and how do I create the testfile?
Is it this way?
echo “This is a test” > /usr/share/nginx/html/.well-known/acme-challenge/test
Many thanks again!
This is my router setup.
Synology is set to: HTTP :5500 HTTPS :5050
it will not allow my to use 80 or 443
Guys?
Synology support told me that I should just make sure that my server could be hit from port 80 from outside. So I forwarded port 80 directly, and now it just shows the blank “webstation” logo" when you type backup.fms-data.dk . So the path is straight as an arrow, but its been almost 48 hours, and my certificate will still not update.
I can’t belive I’ve hit a brick wall on this. I just followed the simple 3 step wizardguide when I set it up, and it all worked, and I haven’t changed a setting since then, and now I’m in so deep trouble that no one seems to be able to help me?
Please tell me how to create the folder you recommend, and how to create the files. When I type help in SSH it makes a list of commands, but none for dirs and files it seems. And what is the right folder path. I don’t want to screw anything up in the system?
I’m sorry if I am a moron… but my SSH experience is limited to finding a link in a forum, and installing the client. I’ve had no reason to get experience, since it all just worked out of the box…
Thank you in advance, and your time.
ahaw021
February 6, 2017, 10:39am
28
why not just use the DNS challenge with an online client such as zero ssl?
also a rough network map might help out
e.g. Internet -> Router -> Web Server?
Andrei
Thanks guys. It’s working now. Did as follows:
restarted router and NAS (which allowed port 80 and 443 to work correctly)
Had to gain root access in order to make the renewal command work.
Thanks for a lot of advice. I would never have made it without your inputs!
1 Like
my certificate is not automatically renewed.
Are you also using a Synology NAS? If so what DSM version?
Yes, DSM versione is 6.0.2-8451…
Okay.
Has it auto opdated before?
Never. Port 80 and 443 are open properly. I’ve scanned it…
How long until it expires?
It only tries to auto renew once a week, and if you run this command from an SSH client you will see which dates it tries:
sudo grep letsencrypt /var/log/messages
It is expire from 10 days.
system
March 20, 2017, 10:18pm
37
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.
