Pfsense / Acme Error

mrvmlab · April 4, 2024, 10:28pm

Hello,

I cannot get Acme to issue a new key for the key and cert created using cloudflare DNS. I have entered all the cloudflare ApI Keys, Token e-mal etc. I can post the a part or the full acme_issuecert.log here if needed. I admit i am a very new to this and in need of some direction.

Thank you,
Mrvmlab

My domain is: myvmlab.net

I ran this command: installed Acme Plugin for pfSense 2.7.2

It produced this output:

WEBGUI_CERT3
Renewing certificate
account: WEBGUI_KEY3
server: letsencrypt-staging-2

My web server is (include version):

The operating system my web server runs on is (include version): pfSense 2.7.2

My hosting provider, if applicable, is: Cloudflare

I can login to a root shell on my machine (yes or no, or I don't know): Yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel): pfSense 2.7.2

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): pfsense 2.7.2

pfsense-01WEBGUI_CERT
Renewing certificate
account: pfsense-01WEBGUI_KEY
server: letsencrypt-staging-2

/usr/local/pkg/acme/acme.sh --issue --domain 'pfsense-01.myvmlab.net' --dns 'dns_cf' --home '/tmp/acme/pfsense-01WEBGUI_CERT/' --accountconf '/tmp/acme/pfsense-01WEBGUI_CERT/accountconf.conf' --force --always-force-new-domain-key --reloadCmd '/tmp/acme/pfsense-01WEBGUI_CERT/reloadcmd.sh' --log-level 3 --log '/tmp/acme/pfsense-01WEBGUI_CERT/acme_issuecert.log'
Array
(
[path] => /etc:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin/
[PATH] => /etc:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin/
[CF_Key] => REDACTED
[CF_Email] => REDACTED
[CF_Token] => REDACTED
[CF_Account_ID] => REDACTED
[CF_Zone_ID] => REDACTED
)
[Thu Apr 4 17:18:31 CDT 2024] Using CA: https://acme-staging-v02.api.letsencrypt.org/directory
[Thu Apr 4 17:18:31 CDT 2024] Using pre generated key: /tmp/acme/pfsense-01WEBGUI_CERT/pfsense-01.myvmlab.net/pfsense-01.myvmlab.net.key.next
[Thu Apr 4 17:18:31 CDT 2024] Generate next pre-generate key.
[Thu Apr 4 17:18:32 CDT 2024] Single domain='pfsense-01.myvmlab.net'
[Thu Apr 4 17:18:32 CDT 2024] Getting domain auth token for each domain
[Thu Apr 4 17:18:34 CDT 2024] Getting webroot for domain='pfsense-01.myvmlab.net'
[Thu Apr 4 17:18:34 CDT 2024] Adding txt value: _yGrGOMNPFus31fhmTpQ0qHSrlkmfrLgvcH4JForCZ8 for domain: _acme-challenge.pfsense-01.myvmlab.net
[Thu Apr 4 17:18:34 CDT 2024] Adding record
[Thu Apr 4 17:18:35 CDT 2024] Add txt record error.
[Thu Apr 4 17:18:35 CDT 2024] Error add txt for domain:_acme-challenge.pfsense-01.myvmlab.net
[Thu Apr 4 17:18:35 CDT 2024] Please check log file for more details: /tmp/acme/pfsense-01WEBGUI_CERT/acme_issuecert.log

linkp · April 4, 2024, 10:58pm

If those are your real API credentials and email, you should edit them out of your post immediately and rotate your API key and any exposed API tokens at Cloudflare. I also recommend adding 2FA to your Cloudflare account if you have not already.

I have access to both pfSense and Cloudflare to help you test, but you really need to deal with your credential leak first. Let us know when that is done and we can revist helping you with your certificate.

JamesLE · April 4, 2024, 11:01pm

Thanks for spotting that! I've administratively redacted the credentials. @mrvmlab, you should still rotate them immediately.

mrvmlab · April 4, 2024, 11:26pm

I have done as sugested and rotated the keys.

mrvmlab · April 4, 2024, 11:34pm

Thank you so much for that! I have taken the security steps to protect the account as suggested.

linkp · April 4, 2024, 11:43pm

I'll follow up in a little while when I am at location where I can sign in to a pfSense and review some settings with you.

mrvmlab · April 5, 2024, 12:11am

Thank you I am looking foward to it.

mrvmlab · April 5, 2024, 1:20am

I did a reconfig and checked all my settings and added new key & cert. This is the most upto date error / output from certbot on pfSense.

pfsense-01_cert
Renewing certificate
account: pfsense-01_test_key
server: letsencrypt-staging-2

/usr/local/pkg/acme/acme.sh --issue --domain 'pfsense-01.myvmlab.com' --dns 'dns_cf' --home '/tmp/acme/pfsense-01_cert/' --accountconf '/tmp/acme/pfsense-01_cert/accountconf.conf' --force --always-force-new-domain-key --reloadCmd '/tmp/acme/pfsense-01_cert/reloadcmd.sh' --log-level 3 --log '/tmp/acme/pfsense-01_cert/acme_issuecert.log'
Array
(
[path] => /etc:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin/
[PATH] => /etc:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin/
[CF_Key] =>
[CF_Email] =>
[CF_Token] =>
[CF_Account_ID] =>
[CF_Zone_ID] =>
)
[Thu Apr 4 20:18:54 CDT 2024] Using CA: https://acme-staging-v02.api.letsencrypt.org/directory
[Thu Apr 4 20:18:55 CDT 2024] Using pre generated key: /tmp/acme/pfsense-01_cert/pfsense-01.myvmlab.com/pfsense-01.myvmlab.com.key.next
[Thu Apr 4 20:18:55 CDT 2024] Generate next pre-generate key.
[Thu Apr 4 20:18:55 CDT 2024] Single domain='pfsense-01.myvmlab.com'
[Thu Apr 4 20:18:55 CDT 2024] Getting domain auth token for each domain
[Thu Apr 4 20:18:56 CDT 2024] Getting webroot for domain='pfsense-01.myvmlab.com'
[Thu Apr 4 20:18:57 CDT 2024] Adding txt value: rOnyQoAVJk36EKXR5qoCBARy0OnyZHbMab3amsIHOPs for domain: _acme-challenge.pfsense-01.myvmlab.com
[Thu Apr 4 20:18:58 CDT 2024] Adding record
[Thu Apr 4 20:18:58 CDT 2024] Add txt record error.
[Thu Apr 4 20:18:58 CDT 2024] Error add txt for domain:_acme-challenge.pfsense-01.myvmlab.com
[Thu Apr 4 20:18:58 CDT 2024] Please check log file for more details: /tmp/acme/pfsense-01_cert/acme_issuecert.log

linkp · April 5, 2024, 2:06am

It looks like you are not creating the TXT record in Cloudflare.

Are you using your email and global API key or a token?
Tokens are safer, but you need to scope them appropriately.
You aren't trying to use both at the same time, are you?

Good job doing your testing in the Let's Encrypt Staging environment!

rg305 · April 5, 2024, 2:13am

Be sure and remember to remove the excess force when you switch from staging to production.

mrvmlab · April 5, 2024, 2:14am

I think I am using both API Key and API Token to values when authenticating to cloudflare within the ACME CERT ( it’s self). I thought all fields were required. if that is to the area you are referring to. If something else please let me know.

Thank you,

mrvmlab

linkp · April 5, 2024, 2:19am

The pfSense ACME client is a web GUI to acme.sh. I don't see the force switch exposed anywhere in the web UI. I have been running it for years without issue. While I know (and appreciate) your reasons for mentioning it, I don't expect that to flag to cause any problems.

linkp · April 5, 2024, 2:24am

You should only use one or the other.

For the sake of expedience, can you test with just the email and global key (without the token)?

If that works, we can try again, using only the token for authentication.

mrvmlab · April 5, 2024, 2:40am

This is what i get when using e-mail and glabal ket w/o token.

pfsense-01_cert
Renewing certificate
account: pfsense-01_test_key
server: letsencrypt-staging-2

/usr/local/pkg/acme/acme.sh --issue --domain 'pfsense-01.myvmlab.com' --dns 'dns_cf' --home '/tmp/acme/pfsense-01_cert/' --accountconf '/tmp/acme/pfsense-01_cert/accountconf.conf' --force --always-force-new-domain-key --reloadCmd '/tmp/acme/pfsense-01_cert/reloadcmd.sh' --log-level 3 --log '/tmp/acme/pfsense-01_cert/acme_issuecert.log'
Array
(
[path] => /etc:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin/
[PATH] => /etc:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin/
[CF_Key] =>
[CF_Email] =>
[CF_Token] =>
[CF_Account_ID] =>
[CF_Zone_ID] =>
)
[Thu Apr 4 21:38:51 CDT 2024] Using CA: https://acme-staging-v02.api.letsencrypt.org/directory
[Thu Apr 4 21:38:51 CDT 2024] Using pre generated key: /tmp/acme/pfsense-01_cert/pfsense-01.myvmlab.com/pfsense-01.myvmlab.com.key.next
[Thu Apr 4 21:38:51 CDT 2024] Generate next pre-generate key.
[Thu Apr 4 21:38:51 CDT 2024] Single domain='pfsense-01.myvmlab.com'
[Thu Apr 4 21:38:51 CDT 2024] Getting domain auth token for each domain
[Thu Apr 4 21:38:53 CDT 2024] Getting webroot for domain='pfsense-01.myvmlab.com'
[Thu Apr 4 21:38:53 CDT 2024] Adding txt value: CATkNkT7j0erF_F89uolSOtPpBxel3txzhUxQiodAz4 for domain: _acme-challenge.pfsense-01.myvmlab.com
[Thu Apr 4 21:38:54 CDT 2024] invalid domain
[Thu Apr 4 21:38:54 CDT 2024] Error add txt for domain:_acme-challenge.pfsense-01.myvmlab.com
[Thu Apr 4 21:38:54 CDT 2024] Please check log file for more details: /tmp/acme/pfsense-01_cert/acme_issuecert.log

linkp · April 5, 2024, 2:50am

You are not using the same domain name that you mentioned in your first post. I didn't catch it the first time you switched domains, but it could be the root of your problem.

myvmlab.net uses Cloudflare DNS while myvmlab.com does not.

mrvmlab · April 5, 2024, 2:56am

Yes, i fixed that type in acme cert and re ran it

linkp · April 5, 2024, 2:59am

Did you have better results after fixing the domain name?

mrvmlab · April 5, 2024, 3:00am

This is the output now

pfsense-01_cert
Renewing certificate
account: pfsense-01_test_key
server: letsencrypt-staging-2

/usr/local/pkg/acme/acme.sh --issue --domain 'pfsense-01.myvmlab.net' --dns 'dns_cf' --home '/tmp/acme/pfsense-01_cert/' --accountconf '/tmp/acme/pfsense-01_cert/accountconf.conf' --force --always-force-new-domain-key --reloadCmd '/tmp/acme/pfsense-01_cert/reloadcmd.sh' --log-level 3 --log '/tmp/acme/pfsense-01_cert/acme_issuecert.log'
Array
(
[path] => /etc:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin/
[PATH] => /etc:/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin/
[CF_Key] =>
[CF_Email] =>
[CF_Token] =>
[CF_Account_ID] =>
[CF_Zone_ID] =>
)
[Thu Apr 4 21:59:27 CDT 2024] Using CA: https://acme-staging-v02.api.letsencrypt.org/directory
[Thu Apr 4 21:59:27 CDT 2024] Using pre generated key: /tmp/acme/pfsense-01_cert/pfsense-01.myvmlab.net/pfsense-01.myvmlab.net.key.next
[Thu Apr 4 21:59:27 CDT 2024] Generate next pre-generate key.
[Thu Apr 4 21:59:27 CDT 2024] Single domain='pfsense-01.myvmlab.net'
[Thu Apr 4 21:59:27 CDT 2024] Getting domain auth token for each domain
[Thu Apr 4 21:59:29 CDT 2024] Getting webroot for domain='pfsense-01.myvmlab.net'
[Thu Apr 4 21:59:29 CDT 2024] Adding txt value: _POe5Gq-bT4khwhJ6UC8MBzTRsUao_JzAEuYN-mlTsk for domain: _acme-challenge.pfsense-01.myvmlab.net
[Thu Apr 4 21:59:31 CDT 2024] Adding record
[Thu Apr 4 21:59:31 CDT 2024] Add txt record error.
[Thu Apr 4 21:59:31 CDT 2024] Error add txt for domain:_acme-challenge.pfsense-01.myvmlab.net
[Thu Apr 4 21:59:31 CDT 2024] Please check log file for more details: /tmp/acme/pfsense-01_cert/acme_issuecert.log

linkp · April 5, 2024, 3:05am

The TXT record is there.

dig txt _acme-challenge.pfsense-01.myvmlab.net. +short

"_POe5Gq-bT4khwhJ6UC8MBzTRsUao_JzAEuYN-mlTsk"

Try putting a delay into the DNS-Sleep field. Start with 30 and see if that is sufficient.

mrvmlab · April 5, 2024, 3:19am

Very nice

[Thu Apr 4 22:15:48 CDT 2024] Cert success.

Now do i put it on a Production for use now that it's working or do we work with the API Keys / Token first?