RadioFeed returns Challenge Fail

Help
1

My domain is: scanner.lgauge.com

I ran this command: Tried using RadioFeed app to get a certificate

It produced this output: Challenge Fail

My web server is (include version): RadioFeed 8.1

The operating system my web server runs on is (include version): Windows 10

My hosting provider, if applicable, is: home PC

I can login to a root shell on my machine (yes or no, or I don't know): I don't know

I'm using a control panel to manage my site (no, or provide the name and version of the control panel): N/A. RadioFeed is the Host

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): N/A

2

I am not familiar with RadioFeed. And, I don't see any instructions for getting a cert on their website. Do you have a link that gives instructions?

I can see a RadioFeed server replying to HTTP requests. But, when I try a sample HTTP Challenge request to your domain I get a login page for RadioFeed. I would expect a 404 Not Found error for this test. Maybe when the Let's Encrypt auth server sent the actual HTTP Challenge to your domain you also sent it a login page incorrectly? IDK

Is there any more detail error description? You haven't given us much to work with

image
image1329×1257 191 KB

3 Likes
3

Much like the error message shared in the original post, the directions I found are also light on details.

5 Likes
4

Ouch.

@TomCook Without any more info there isn't much we can help with.

Ask on the RadioFeed support channels. Or, if there is an error message shown let us know what that is. Maybe that will help

  1. Click the 'Get a Let's Encrypt Certificate' button. If no error messages then the 'letsencrypt' certificate file will be ...
3 Likes
5

Thanks guys. It does provide this error message, but not sure it helps much:

Error
Error460×160 4.85 KB

HTTP-01 challenge fail

Check port 80 not blocked and the Router Port Forwarding setup

1 Like
6

Supplemental information: I find Port 80 accessible,
however Port 443 is accessible but not for HTTPS only HTTP!

Port 80 HTTP Access works

$ curl -Ii http://scanner.lgauge.com:80
HTTP/1.1 200 OK
Server: RadioFeed 8.1
Content-Type: text/html
Content-Length: 14441
Connection: Keep-Alive

Port 443 HTTPS Access fails; also see Hardenize Report: scanner.lgauge.com

$ curl -Ii https://scanner.lgauge.com:443
curl: (35) OpenSSL/3.0.13: error:0A00010B:SSL routines::wrong version number

Port 443 HTTP Access works

$ curl -Ii http://scanner.lgauge.com:443
HTTP/1.1 200 OK
Server: RadioFeed 8.1
Content-Type: text/html
Content-Length: 14441
Connection: Keep-Alive

Edit

Also this curl command received a HTTP Response of HTTP/1.1 200 OK - 200 OK - HTTP | MDN
would have expected 404 Not Found - HTTP | MDN for a nonexistent file (token).

$ curl -Ii http://scanner.lgauge.com/.well-known/acme-challenge/PjMbYBkhz2ukqI-R-QfyQ_24qfmIsa-ZUNSmL_RxMTv
HTTP/1.1 200 OK
Server: RadioFeed 8.1
Content-Type: text/html
Content-Length: 14441
Connection: Keep-Alive

Second different filename (token)

$ curl -Ii http://scanner.lgauge.com/.well-known/acme-challenge/s1wbS7FvG1mp4Sjst_ps7rV2o4kizAxu3XZ-2JNpyyG -A "Mozilla/5.0 (compatible; Let's Encrypt validation server; +https://www.letsencrypt.org)"
HTTP/1.1 200 OK
Server: RadioFeed 8.1
Content-Type: text/html
Content-Length: 14441
Connection: Keep-Alive

This is why Let's Debug gets results of "OK" https://letsdebug.net/scanner.lgauge.com/2327461

2 Likes
7

No, it doesn't help much. Those are two common examples of why it might fail but neither seems to match your situation. The RadioFeed support is probably best option.

Roughly what happens with an HTTP Challenge is your system prepares a unique "token" and requests a cert from the Let's Encrypt server. The LE server sends an HTTP request to your domain asking for this "token". There are (currently) 5 LE servers around the world that make the same request but never mind that for now.

Your system is not replying with the correct token value to the LE server(s). If you have logs to view inbound requests to your system that would help. Or, even the exact error the LE server sent to your system. The LE server does send a nice message but your system doesn't show it :frowning:

3 Likes
8

Hi @TomCook,

Would you be willing to share screen shots like those shown here https://www.proscan.org/radiofeed_screen_shots.html?

If yes, the please share Source Client and Web Server screen shots.

1 Like
9

Looks like this is a Visual Basic program that's using .net 4 and a version of the Certes library.

I'd suggest tying to set Web Server > Secure (HTTPS) > Server Type to "Secure (HTTPS)" and enable https redirection, then try again. If that fails try it without https redirection.

The server currently returns the same html page regardless, so perhaps its bug in the app or in the configuration. Best thing to do is to contact the developer, or put the app behind a proxy and configure the certs there.

[Edit: based on inspection with dotpeek it looks like the app waits for any authorization status then proceeds, most likely it's just not waiting long enough for the validation to transition from pending > processing > valid]

2 Likes
10

Tried "Secure (HTTPS)" with redirection on and off - no change :frowning:
Next three posts are the three requested screen shots: Source Client and two Web Server

11

Source Client
Source Client818×754 44.2 KB

1 Like
12

Web Server - Main Setup
Web Server - Main Setup818×754 36 KB

1 Like
13

Web Server - Secure (HTTPS)
Web Server - Secure (HTTPS)818×754 22.7 KB

1 Like
14

Yeah I'm pretty sure it's a bug in their code, they need to allow for authorizations to transition to the "valid" state as nowadays http validation comes from several places and can take more than 1 second.

4 Likes
15

If it's urgent you could use a different tool to get your certificate.

To do this with Certify The Web (for instance), click New Certificate, add your domain, click Request Certificate. It would require that there is nothing exclusively using port 80, but based on the tech they are using it should all work. You can then export the certificate as PFX by adding an Export Certificate deployment task under Tasks, under Task Parameters set the destination file path to C:\RadioFeed\letsencrypt.pfx then save and run the task. PFX files already contain the key file. Presumably you then need to restart the RadioFeed service to pick up the latest cert.

Really the best option is to contact the developer and get them to fix the issue.

2 Likes
16

Truly appreciate all the advice and trouble shooting.

3 Likes
17

Hopefully you'll get action at your forum post: Radiofeed and Let's Encrypt | RadioReference.com Forums

3 Likes
18

I tried Certify the Web, but received the following error:

CertifyTheWeb Error
CertifyTheWeb Error940×640 23.1 KB

19

You may need to wait for @webprofusion although he normally works Australia hours :slight_smile:

Did you have your RadioFeed server stopped when you tried Certify? Because that error reply looks like the beginning of an html page it sends.

I don't understand the Windows system shared listener as well as Christopher. But, while waiting you could try stopping RadioFeed and then running Certify. I think I saw a screen where you then import the cert manually. Or, just wait for him to reply.

4 Likes
20

I was hoping they were using a .net http listener which would allow port 80 sharing, if they're doing something else then yes you would have to free up port 80 so presumably just stop the radiofeed server first.

[Edit: they directly use a TcpListener and implement their own basic web server instead of using the .net HttpListener, so they are not port sharing via the built in Windows http.sys functionality]

3 Likes