I can login to a root shell on my machine (yes or no, or I don’t know):
yes
The problem is, that configuring the plugin for the first time (about 80 days ago), everything worked ok, I needed to allow 80 TCP and 443 TCP from external so that the http challenge was able to contact the firewall and issue the first certificate onto the firewall. Now the automated renewal doesn’t seem to work, neither does the manual renewal. But I don’t think we’ve changed any firewall rules which would conflict in any wasy. We added some more, changed the “LAN to any allow” ruleset to “LAN only allow HTTP/HTTPS and DNS” and the VMs behind the firewall are able to connect to the internet.
So I SSHd into the firewall and looked at the log and found the following log info under /var/log/acme.sh.log:
Can someone explain to me while this is not working? It looks like the connections are established successfully, but somehow it doesn’t make its way through the firewall.
I’m using the plugin version 1.23, not sure if it helps, though.
If you need any more info, please ask, I will do my best to give you the information.
Thanks in advance!
On the OPNsense we also have HAProxy running with an Exchange 2016 as Backend so that the customer can access OWA without a certificate warning. Is it possible that the problem is, that nothing is listening on port 80? HAProxy only listens on 443, which is pointing to Exchange (“owa.dachverband-dbt.de:443”.
How is it possible that access via owa.dach… is working while office.dach… is not? They are pointing to the same IP address. We use office.dach… to access the OPNsense via WAN and VPN-address.
running your command from the OPNsense gives a HTML 403 forbidden error.
Also: I changed the production to stage environment to be able to issue a few certificates for testing. But now I get a different error:
The production and staging environments have separate account databases -- to test things in the staging environment, you have to repeat the registration process in the staging environment too.
Hello,
so with a combination of creating a listener on port 80 and installing the latest OPNsense firmware I managed to renew the certificate successfully. I created a “80front” public service, listening on 0.0.0.0:80 with just the acme_redirect_rule active.
Thanks for you help, guys!
