My domain is: events.shongololo.xyz I ran this command: env HOOK_SECRET=REDACTED HOOK_SERVER_PORT=8999 /usr/local/bin/resty-auto-ssl/dehydrated --cron --accept-terms --no-lock --domain events.shongololo.xyz --challenge http-01 --config /etc/resty-auto-ssl/letsencrypt/config --hook /usr/local/bin/r…

It looks to me like dehydrated does the right thing for asynchronous finalization already: dehydrated-io/dehydrated/blob/e3ef43c816f73d443f32410862d9253d35cf3f99/dehydrated#L1276-L1296 result="$(signed_request "${finalize}" '{"csr": "'"${csr64}"'"}' | jsonsh)" …

[image] ashleyk: post for ; curl returned with 3 You configured something incorrectly. My guess is that you did not configure which ACME server to use. I'm not familiar with that OpenResty plugin, but if you share it I can take a look. the curl error code 3 is for a malformed url, and the d…

This was working, it only stopped working today, and I have not changed any configuration.

OpenResty relies on the dehydrated ACME client, and it doesn't look like dehydrated supports this new async business being enabled for eight hours today: Enabling Asynchronous Order Finalization - #5 by aarongable

Yeah, it looks to me like the client tried to unconditionally extract the Certificate URL from the Finalize response, and when it wasn't there, made a request for the empty-string url "" (which "resolved" to 0.0.0.0:443) which obviously didn't work. Instead, it should poll (with exponential backoff…

I believe the 0.0.0.0:443 is just my OpenResty web server which listens on port 443 on all interfaces and not what dehydrated client is actually connecting to.

[image] aarongable: Does Resty use an older version of dehydrated than that? A quick search didn't immediately reveal to me the dependency chain from Resty to dehydrated. It uses version 0.6.5 and not the latest 0.7.1 release, and hasn't had a new release in more than 3 years ( https://github…

Thank you! I copied the 0.7.1 dehydrated client over /usr/local/bin/resty-auto-ssl/dehydrated and its working again.

[image] Enabling Asynchronous Order Finalization API Announcements T… We've disabled the brownout early because of problems like this

Any chance that the rate limits can be reset for affected certs? We have a lot of clients who are holding events who are impacted by this.

I'm afraid we do not have the technical means in Boulder to reset rate limits in that sort of way.

OpenResty with resty.auto-ssl failing with curl error 3

Help

mcpherrinm April 5, 2023, 10:44pm 10

We've disabled the brownout early because of problems like this

Topic		Replies	Views
Curl returned with 35 error Help	5	1396	January 25, 2023
Openresty lua fails to renew / re-issue Help	6	3727	November 25, 2019
Issuing new certificate failed: dehydrated failure Help	5	3555	October 13, 2018
Renewal with lua-resty-auto-ssl and dehydrated client Help	4	1652	July 17, 2018
Trying to understand urn:acme:error:badNonce Help	20	21126	November 7, 2019

OpenResty with resty.auto-ssl failing with curl error 3

Related topics