Domain: Trial-hardware.accessanywhere.net
Completely hand built environment.
Apache 2.4.41
OpenSSL 1.1.1l
mod_md: 2.4.0
httpd.conf
MDCertificateAgreement accepted
WatchdogInterval 1
MDCertificateAuthority https://acme-v02.api.letsencrypt.org/directory
Protocols h2 http/1.1 acme-tls/1
ServerName trial-hardware.accessanywhere.net
This environment sometime the past worked. But it's been a while since I've played with it. I cannot be certain when it last worked but https://crt.sh/?q=trial-hardware.accessanywhere.net implies as recently as Sept 2022.
I've tried clearing out the md directories to force from scratch. But whenever I try to use the tls-alpn method now I always get the following error in my httpd error logs
ACME server authz: challenge 'invalid' for trial-hardware.accessanywhere.net at https://acme-v02.api.letsencrypt.org/acme/authz-v3/164530956286. Exact response was: {"identifier":{"type":"dns","value":"trial-hardware.accessanywhere.net"},"status":"invalid","expires":"2022-10-21T17:03:16Z","challenges":[{"type":"tls-alpn-01","status":"invalid","error":{"type":"urn:ietf:params:acme:error:unauthorized","detail":"Incorrect validation certificate for tls-alpn-01 challenge. Requested trial-hardware.accessanywhere.net from 72.139.112.98:443. Received certificate with unexpected extensions: \\"Required extension OID 1.3.6.1.5.5.7.1.31 is not present\\"","status":403},"url":"https://acme-v02.api.letsencrypt.org/acme/chall-v3/164530956286/inkPlg","token":"xxxxxxxx","validationRecord":[{"hostname":"trial-hardware.accessanywhere.net","port":"443","addressesResolved":["72.139.112.98"],"addressUsed":"72.139.112.98"}],"validated":"2022-10-14T17:03:18Z"}]}
The challenge crt.pem has the OID in it.
X509v3 extensions:
X509v3 Basic Constraints: critical
CA:FALSE
X509v3 Subject Alternative Name:
DNS:trial-hardware.accessanywhere.net
1.3.6.1.5.5.7.1.31: critical
. p.(......W.xl.57.....&.c..</..07
Signature Algorithm: sha256WithRSAEncryption
- Although I'm a little suspicious of the odd characters in the line after the OID
>> Can curl to API fine
/opt/aa/conf# curl -v https://acme-v02.api.letsencrypt.org/directory
* Trying 172.65.32.248:443...
* TCP_NODELAY set
* Connected to acme-v02.api.letsencrypt.org (172.65.32.248) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
* CAfile: /etc/ssl/certs/ca-certificates.crt
CApath: none
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384
* ALPN, server accepted to use h2
* Server certificate:
* subject: CN=acme-v02.api.letsencrypt.org
* start date: Sep 8 19:39:52 2022 GMT
* expire date: Dec 7 19:39:51 2022 GMT
* subjectAltName: host "acme-v02.api.letsencrypt.org" matched cert's "acme-v02.api.letsencrypt.org"
* issuer: C=US; O=Let's Encrypt; CN=R3
* SSL certificate verify ok.
* Using HTTP2, server supports multi-use
* Connection state changed (HTTP/2 confirmed)
* Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0
* Using Stream ID: 1 (easy handle 0x8081770)
> GET /directory HTTP/2
> Host: acme-v02.api.letsencrypt.org
> User-Agent: curl/7.66.0
> Accept: */*
>
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* old SSL session ID is stale, removing
* Connection state changed (MAX_CONCURRENT_STREAMS == 128)!
< HTTP/2 200
< server: nginx
< date: Fri, 14 Oct 2022 17:12:26 GMT
< content-type: application/json
< content-length: 659
< cache-control: public, max-age=0, no-cache
< x-frame-options: DENY
< strict-transport-security: max-age=604800
<
{
"E8oLuBbs8IM": "https://community.letsencrypt.org/t/adding-random-entries-to-the-directory/33417",
"keyChange": "https://acme-v02.api.letsencrypt.org/acme/key-change",
"meta": {
"caaIdentities": [
"letsencrypt.org"
],
"termsOfService": "https://letsencrypt.org/documents/LE-SA-v1.3-September-21-2022.pdf",
"website": "https://letsencrypt.org"
},
"newAccount": "https://acme-v02.api.letsencrypt.org/acme/new-acct",
"newNonce": "https://acme-v02.api.letsencrypt.org/acme/new-nonce",
"newOrder": "https://acme-v02.api.letsencrypt.org/acme/new-order",
"revokeCert": "https://acme-v02.api.letsencrypt.org/acme/revoke-cert"
* Connection #0 to host acme-v02.api.letsencrypt.org left intact
