Hello I'm having trouble to receive a certificate. I don't know exactly where to troubleshoot. My configs for the acme-client and httpd are equivalent to this Secure Webserver (httpd+SSL) | OpenBSD Handbook.
Here is a list of issued certificates crt.sh | vega4.net, all have "Matching Identities" (i.e. SANs) of vega4.net and www.vega4.net. Since acme-client(1) - OpenBSD manual pages only implements the “http-01” challenge type of the Challenge Types - Let's Encrypt. The Let's Encrypt implementation of the HTTP-01 challenge follows redirects, up to 10 redirects deep. It only accepts redirects to “http:” or “https:”, and only to ports 80 or 443. Both vega4.net and www.vega4.net have to be challenged and respond properly (including the above mentioned DNS CAA records; as shown here https://letsdebug.net/vega4.net/1435352)
The error you've quoted is from the Let's Encrypt validation server. The URL shown in that error message is the final URL and not the first request, which always uses HTTP indeed. But if there is a HTTP to HTTPS redirect, the Boulder error message shows the https:// URL. So that's why you can see a HTTPS request in a http-01 error message.
Currently your HTTP port 80 webserver shows a 404 file not found which is to be expected, but your HTTPS port 443 webserver returns a "Connection refused", so we cannot debug that any longer.
But the redirect loop is most likely due to incorrect redirect logic on the webserver configuration level.
Thanks for finding the typo! letsdebug.net and unboundtest.com are really helpful as well. It seems to work now. I guess next time i have to triple check every entry and config before posting
acme-client: /etc/ssl/vega4.net.crt: created
acme-client: /etc/ssl/vega4.net.fullchain.pem: created
