Ngrok endpoint keeps failing challenge

I'm developing a application that I want to expose locally and I'm using ngrok to do that. My server will connects to a 3rd party that requires SSL certificate. So I'm trying to generate an SSL certificate by starting my ngrok => ngrok http --host-header="teamspoc.ngrok.io" --subdomain="teamspoc" 80 (teamspoc.ngrok.io is domain name that resolves to endpoint https://teamspoc.eu.ngrok.io) but I keep running into error below. Is this to do with ngrok and how they route traffic? Am I missing something?

My domain is: https://teamspoc.eu.ngrok.io

I ran this command:
certbot certonly --config config.ini --standalone --preferred-challenges http
config.ini:
email=xxxx
domain=teamspoc.eu.ngrok.io

It produced this output:
Certbot failed to authenticate some domains (authenticator: standalone). The Certificate Authority reported these problems:
Domain: teamspoc.eu.ngrok.io
Type: unauthorized
Detail: 2600:1f16:d83:1202::6e:5: Invalid response from https://acme.ngrok.com/.well-known/acme-challenge/vh9X-yspvulLmT2r309ag710wh3EIRO8nPo8P7BbDRI?host=teamspoc.eu.ngrok.io: 404Hint: The Certificate Authority failed to download the challenge files from the temporary standalone webserver started by Certbot on port 80. Ensure that the listed domains point to this machine and that it can accept inbound connections from the internet.Some challenges have failed.
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile C:\Certbot\log\letsencrypt.log or re-run Certbot with -v for more details.
Could not open file or uri for loading private key from -inkey file from C:/Certbot/live/teamspoc.ngrok.io/privkey1.pem
9C0C0000:error:80000002:system library:file_open:No such file or directory:../openssl-3.1.4/providers/implementations/storemgmt/file_store.c:267:calling stat(C:/Certbot/live/teamspoc.ngrok.io/privkey1.pem)
9C0C0000:error:1608010C:STORE routines:inner_loader_fetch:unsupported:../openssl-3.1.4/crypto/store/store_meth.c:353:No store loader found. For standard store loaders you need at least one of the default or base providers available. Did you forget to load them? Info: Global default library context, Scheme (C : 0), Properties ()

My web server is (include version): N/A

The operating system my web server runs on is (include version): Windows 11 Pro

My hosting provider, if applicable, is: N/A

I can login to a root shell on my machine (yes or no, or I don't know): N/A

I'm using a control panel to manage my site (no, or provide the name and version of the control panel): N/A

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): certbot 2.8.0

I don't think you're supposed to get the certificate yourself while using ngrok.com:

3 Likes

How did the HTTP request to the domain teamspoc.eu.ngrok.io change to an HTTPS request to a completely different domain (acme.ngrok.com)?

3 Likes

So turns out ngrok uses Let's Encrypt for certificate management, which means that by default, they intercept the ACME request.

Their Agent API allows to remove the cert policy and it did the trick.

2 Likes

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.