Domain: kalmiya.com, can log into a root shell.
Updating the letsencrypt certificate through the synology webinterface, clicking "renew" leads to "Please check if your IP address, reverse proxy rules and firewall settings are correctly configured and try again". I don't have any reverse proxy rules, firewall disabled and "all allowed".
Updating the letsencrypt certificate from the shell:
sudo syno-letsencrypt new-cert -d www.kalmiya.com -m site@kalmiya.com -vvv
gives:
...
"challenges": [ { "type": "http-01", "status": "invalid", "error": { "type": "urn:ietf:params:acme:error:unauthorized", "detail": "xx.xx.xx.xx: Invalid response from http://www.kalmiya.com/.well-known/acme-challenge/xyz: 404", "status": 403 },
...
Copied a file to /var/lib/letsencrypt/.well-known/acme-challenge#/index.html and verified opening of with both http and https in a browser (e.g. (https://www.kalmiya.com/.well-known/acme-challenge/index.html ) shows the content of the index.html.
Running letsdebug.net on www.kalmiya.com.com gives a green box with "All OK!" No issues were found"
Checking /var/log/messages it contains:
syno-letsencrypt[23362]: client_v2-disk.cpp:117 Failed to open port
cortana syno-letsencrypt[23362]: client_v2-base.cpp:603 Failed to do new authorization, may retry with another type. [{"error":110,"file":"client_v2-base.cpp","msg":"83.86.147.193: Invalid response from http://www.kalmiya.com/.well-known/acme-challenge/xyz: 404"}
Additional info:
- Router forwards ports 80, 443 and 5001 to the NAS (80->80, 443->443, 5001->5001)
- Websites are accessible with old certificates (which are still valid), and those were originally fetched by the dsm webfrontend
- Auto-redirect HTTP connection to HTTPS for DSM Desktop (Login Portal, DSM) -> disabled
- Latest DSM 7.2.1
- curl https://community.letsencrypt.org/ -> works (contents listed)
- Cleared the ip-blocklist, to rule out that (somehow) the letsencrypt ip ended up on it.
So there seems to be a permissions issue, but I'm not sure how to fix it.
Any ideas anyone?
.