$ telnet sub.domain.eu 80
Trying xxx.xxx.xxx.xxx...
Connected to sub.domain.eu.
Escape character is '^]'.
GET /.well-known/acme-challenge/test
Yihaaa!
Connection closed by foreign host.
The reason I was asking what the curl command gave, is that shows me the headers. So that you can tell it’s in plain text rather than anything else. What response do you get with the curl command ?
Thanks That all looks OK, I don’t use the letsencrypy.sh script myself, so may be worth asking directly on that clients support pages. I’d check though that;
the WELLKNOWN variable is defined and pointing to the correct location of where the token files should be
( i.e. is there a typo in the path for /var/www/domain/.well-known/acme-challenge/ ) This may be shown in the log file you edited above.
Check the permissions on the /well-known/acme-challenge are all OK ( they should be as your test file is readable, and in plain text )
There are no firewall rules that could be blocking the check from certain IP’s
Thanks for the response!
About the client, I thought that was actually the official client on freebsd.
It’s the only shell client available on pkg. (there’s also a python client…)
On the variables, I thought those were optional?
There’s a firewall definitely, but as long the whole transaction goes through port 80, there should be no issues.
And the permissions should be fine also, first thing I checked.
I’ll look about the env vars, and come back with my findings
It's one of the unofficial letsencrypt clients. Here is a list of alternative clients - of which any of the bash clients should work ( I wrote / use the getssl one - which is a bash script designed for installing certs on remote servers where you can't run any client, but you have SSH access )
I suspect they are if the location is the normal default. The script needs to somehow know where to write the token file in xxxxx/.well-known/acme-challenge/token
The default configuration file requires some changes, these are stored in /usr/local/etc/letsencrypt.sh/config.sh
BASEDIR="/usr/local/etc/letsencrypt.sh"
WELLKNOWN="/usr/jails/http/usr/local/www/.well-known/acme-challenge"
alias openssl='/usr/local/bin/openssl'
From the error I'd double check your WELLKNOWN setting.
Hi Jyrki, I'm on FreeBSD 10.2 as well. The official client is actually called py27-letsencrypt, and it's currently version 0.5. The one you're using became available in ports/pkg a few months after the official one.
It's a silly name to call it, I know. Very confusing. And just to make life more confusing, the next official client version (0.6) will change it's name to certbot!
I've successfully used the official client, though there is a bug in 0.5 where is mixes up your domains in the cert. You might want to wait for certbot 0.6 (already two weeks overdue) or perhaps install the official py27-letsencrypt 0.4.2.
So that extra 's' has thrown me off for few hours.
On the other hand, The guide from Bernar Spil, does install the client on the base box, not the jail. Which is something I'm trying to avoid for the time being. Maybe It will have to be that way to have a single termination point for all the subdomains? maybe. I'll find out for sure soon enough! Thanks for the client list!
@DarkSteve: I did actually take a look at the python client, but it wanted to install a **** of dependencies in a prod machine (well, my own, but it will be live at some point...) and I suspect that is the reason why letsencrypt.sh does exist...
When the bug free version comes along, I'll take a look.
Thanks for the client list!