Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. https://crt.sh/?q=example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.
My domain is: portal.viaem.de
I ran this command: certbot certonly --webroot --webroot-path /var/www/viaem -d portal.viaem.de --test-cert --dry-run -v
It produced this output:
“type”: “http-01”,
“status”: “invalid”,
“error”: {
“type”: “urn:acme:error:connection”,
“detail”: “Fetching http://portal.viaem.de/.well-known/acme-challenge/zi1wco-EDJOYHfXXDYHwCkjfQE-wBkJbIR4jkyD_kKU: Timeout”,
“status”: 400
My web server is (include version):
docker nginx/latest
The operating system my web server runs on is (include version):
debian stretch
My hosting provider, if applicable, is:
dynamic ip to server at home
I can login to a root shell on my machine (yes or no, or I don’t know):
yes
I’m using a control panel to manage my site (no, or provide the name and version of the control panel)
I see the contact of the letsencrypt server in the logs of the reverse proxy:
52.29.173.72 - - [18/Dec/2017:21:56:12 +0000] “GET /.well-known/acme-challenge/zi1wco-EDJOYHfXXDYHwCkjfQE-wBkJbIR4jkyD_kKU HTTP/1.1” 200 87 “-” “Mozilla/5.0 (compatible; Let’s Encrypt validation server; +https://www.letsencrypt.org)” “-”
I placed a file test.txt in
/var/www/viaem/.well-known/acme-challenge
And if I connect from outside to
portal.viaem.de/.well-known/acme-challenge/test.txt
I get the content “Hello”
the configuration file of my reverse proxy:
server {
listen 80;
server_name portal.viaem.de;
location / {
proxy_pass http://portal.viaem.de:8080;
proxy_redirect off;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Host $server_name;
}
location /.well-known/acme-challenge {
default_type “text/plain”;
root /var/www/viaem;
}
}
server {
listen 443;
server_name portal.viaem.de;
ssl on;
ssl_certificate /etc/nginx/certs/letsencrypt/live/portal.viaem.de/fullchain.pem;
ssl_certificate_key /etc/nginx/certs/letsencrypt/live/portal.viaem.de/privkey.pem;
ssl_trusted_certificate /etc/nginx/certs/letsencrypt/live/portal.viaem.de/chain.pem;
location / {
proxy_pass https://portal.viaem.de:445;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Host $server_name;
}
location /.well-known/acme-challenge {
default_type "text/plain";
root /var/www/viaem;
}
}
I used to have a separate certbot container that I started to renew the certificates. I had to stop the reverse proxy for that so that I could forward the ports 80 and 443 to the certbot container. I didn’t want to do that any longer so I installed the certbot in the reverse proxy nginx container and used docker exec to start certbot. Unfortunately my old setup doesn’t work any longer. I have no idea why.
The old certbot container Dockerfile:
FROM debian:latest
RUN apt-get update && apt-get install -y
certbot coreutils iputils-ping
WORKDIR /root
EXPOSE 80 443
ENTRYPOINT ["/usr/bin/certbot"]
The part in the docker-compose.yml file
certbot:
build:
context: ./certbot
container_name: certbot
ports:
- “80:80”
- "443:443"
volumes:
- vol_letsencrypt_viaem:/var/www/viaem
- ./certbot/etc_letsencrypt:/etc/letsencrypt
- ./certbot/lib_letsencrypt:/var/lib/letsencrypt
During the last attempts I added a --test-cert but the result was the same.
Setup:
I’ve got a DSL router and a pfsense firewall behind that. Port forwarding is configured in both to the virtual machine that contains the docker containers.