Unable to issue a certificate

Good day! I configured the web server on FreeBSD 12.0-RELEASE-p13, installed certbot according to the instructions https://certbot.eff.org/, but the py36-certbot package is no longer supported by the system, instead py37-certbot-1.3.0,1. When trying to check request, i get the following error:

certbot certonly --webroot --dry-run -w /usr/local/www/htdocs -d mail.mydomain.com
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator webroot, Installer None
An unexpected error occurred:
Traceback (most recent call last):
File “/usr/local/lib/python3.7/site-packages/urllib3/contrib/pyopenssl.py”, line 485, in wrap_socket
cnx.do_handshake()
File “/usr/local/lib/python3.7/site-packages/OpenSSL/SSL.py”, line 1915, in do_handshake
self._raise_ssl_error(self._ssl, result)
File “/usr/local/lib/python3.7/site-packages/OpenSSL/SSL.py”, line 1647, in _raise_ssl_error
_raise_current_error()
File “/usr/local/lib/python3.7/site-packages/OpenSSL/_util.py”, line 54, in exception_from_error_queue
raise exception_type(errors)
OpenSSL.SSL.Error: [(‘SSL routines’, ‘tls_process_server_certificate’, ‘certificate verify failed’)]

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File “/usr/local/lib/python3.7/site-packages/urllib3/connectionpool.py”, line 672, in urlopen
chunked=chunked,
File “/usr/local/lib/python3.7/site-packages/urllib3/connectionpool.py”, line 376, in _make_request
self._validate_conn(conn)
File “/usr/local/lib/python3.7/site-packages/urllib3/connectionpool.py”, line 994, in validate_conn
conn.connect()
File “/usr/local/lib/python3.7/site-packages/urllib3/connection.py”, line 394, in connect
ssl_context=context,
File "/usr/local/lib/python3.7/site-packages/urllib3/util/ssl
.py", line 370, in ssl_wrap_socket
return context.wrap_socket(sock, server_hostname=server_hostname)
File “/usr/local/lib/python3.7/site-packages/urllib3/contrib/pyopenssl.py”, line 491, in wrap_socket
raise ssl.SSLError(“bad handshake: %r” % e)
ssl.SSLError: (“bad handshake: Error([(‘SSL routines’, ‘tls_process_server_certificate’, ‘certificate verify failed’)])”,)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File “/usr/local/lib/python3.7/site-packages/requests/adapters.py”, line 449, in send
timeout=timeout
File “/usr/local/lib/python3.7/site-packages/urllib3/connectionpool.py”, line 720, in urlopen
method, url, error=e, _pool=self, _stacktrace=sys.exc_info()[2]
File “/usr/local/lib/python3.7/site-packages/urllib3/util/retry.py”, line 436, in increment
raise MaxRetryError(_pool, url, error or ResponseError(cause))
urllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host=‘acme-staging-v02.api.letsencrypt.org’, port=443): Max retries exceeded with url: /directory (Caused by SSLError(SSLError(“bad handshake: Error([(‘SSL routines’, ‘tls_process_server_certificate’, ‘certificate verify failed’)])”)))

During handling of the above exception, another exception occurred:

requests.exceptions.SSLError: HTTPSConnectionPool(host=‘acme-staging-v02.api.letsencrypt.org’, port=443): Max retries exceeded with url: /directory (Caused by SSLError(SSLError(“bad handshake: Error([(‘SSL routines’, ‘tls_process_server_certificate’, ‘certificate verify failed’)])”)))
Please see the logfiles in /var/log/letsencrypt for more details.

The following information is in the log:

2020-06-05 18:24:50,685:DEBUG:certbot._internal.main:certbot version: 1.3.0
2020-06-05 18:24:50,686:DEBUG:certbot._internal.main:Arguments: [’–webroot’, ‘–dry-run’, ‘-w’, ‘/usr/local/www/htdocs’, ‘-d’, ‘mail.mydomain.com’]
2020-06-05 18:24:50,686:DEBUG:certbot._internal.main:Discovered plugins: PluginsRegistry(PluginEntryPoint#manual,PluginEntryPoint#nginx,PluginEntryPoint#null,PluginEntryPoint#standalone,PluginEntryPoint#webroot)
2020-06-05 18:24:50,730:DEBUG:certbot._internal.log:Root logging level set at 20
2020-06-05 18:24:50,731:INFO:certbot._internal.log:Saving debug log to /var/log/letsencrypt/letsencrypt.log
2020-06-05 18:24:50,732:DEBUG:certbot._internal.plugins.selection:Requested authenticator webroot and installer None
2020-06-05 18:24:50,740:DEBUG:certbot._internal.plugins.selection:Single candidate plugin: * webroot
Description: Place files in webroot directory
Interfaces: IAuthenticator, IPlugin
Entry point: webroot = certbot._internal.plugins.webroot:Authenticator
Initialized: <certbot._internal.plugins.webroot.Authenticator object at 0x8034f5dd0>
Prep: True
2020-06-05 18:24:50,741:DEBUG:certbot._internal.plugins.selection:Selected authenticator <certbot._internal.plugins.webroot.Authenticator object at 0x8034f5dd0> and installer None
2020-06-05 18:24:50,741:INFO:certbot._internal.plugins.selection:Plugins selected: Authenticator webroot, Installer None
2020-06-05 18:24:50,986:DEBUG:acme.client:Sending GET request to https://acme-staging-v02.api.letsencrypt.org/directory.
2020-06-05 18:24:50,991:DEBUG:urllib3.connectionpool:Starting new HTTPS connection (1): acme-staging-v02.api.letsencrypt.org:443
2020-06-05 18:24:51,802:DEBUG:certbot._internal.log:Exiting abnormally:
Traceback (most recent call last):
File “/usr/local/lib/python3.7/site-packages/urllib3/contrib/pyopenssl.py”, line 485, in wrap_socket
cnx.do_handshake()
File “/usr/local/lib/python3.7/site-packages/OpenSSL/SSL.py”, line 1915, in do_handshake
self._raise_ssl_error(self._ssl, result)
File “/usr/local/lib/python3.7/site-packages/OpenSSL/SSL.py”, line 1647, in _raise_ssl_error
_raise_current_error()
File “/usr/local/lib/python3.7/site-packages/OpenSSL/_util.py”, line 54, in exception_from_error_queue
raise exception_type(errors)
OpenSSL.SSL.Error: [(‘SSL routines’, ‘tls_process_server_certificate’, ‘certificate verify failed’)]

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File “/usr/local/lib/python3.7/site-packages/urllib3/connectionpool.py”, line 672, in urlopen
chunked=chunked,
File “/usr/local/lib/python3.7/site-packages/urllib3/connectionpool.py”, line 376, in _make_request
self._validate_conn(conn)
File “/usr/local/lib/python3.7/site-packages/urllib3/connectionpool.py”, line 994, in validate_conn
conn.connect()
File “/usr/local/lib/python3.7/site-packages/urllib3/connection.py”, line 394, in connect
ssl_context=context,
File "/usr/local/lib/python3.7/site-packages/urllib3/util/ssl
.py", line 370, in ssl_wrap_socket
return context.wrap_socket(sock, server_hostname=server_hostname)
File “/usr/local/lib/python3.7/site-packages/urllib3/contrib/pyopenssl.py”, line 491, in wrap_socket
raise ssl.SSLError(“bad handshake: %r” % e)
ssl.SSLError: (“bad handshake: Error([(‘SSL routines’, ‘tls_process_server_certificate’, ‘certificate verify failed’)])”,)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File “/usr/local/lib/python3.7/site-packages/requests/adapters.py”, line 449, in send
timeout=timeout
File “/usr/local/lib/python3.7/site-packages/urllib3/connectionpool.py”, line 720, in urlopen
method, url, error=e, _pool=self, _stacktrace=sys.exc_info()[2]
File “/usr/local/lib/python3.7/site-packages/urllib3/util/retry.py”, line 436, in increment
raise MaxRetryError(_pool, url, error or ResponseError(cause))
urllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host=‘acme-staging-v02.api.letsencrypt.org’, port=443): Max retries exceeded with url: /directory (Caused by SSLError(SSLError(“bad handshake: Error([(‘SSL routines’, ‘tls_process_server_certificate’, ‘certificate verify failed’)])”)))

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File “/usr/local/bin/certbot”, line 11, in
load_entry_point(‘certbot==1.3.0’, ‘console_scripts’, ‘certbot’)()
File “/usr/local/lib/python3.7/site-packages/certbot/main.py”, line 15, in main
return internal_main.main(cli_args)
File “/usr/local/lib/python3.7/site-packages/certbot/_internal/main.py”, line 1347, in main
return config.func(config, plugins)
File “/usr/local/lib/python3.7/site-packages/certbot/_internal/main.py”, line 1217, in certonly
le_client = _init_le_client(config, auth, installer)
File “/usr/local/lib/python3.7/site-packages/certbot/_internal/main.py”, line 603, in _init_le_client
acc, acme = _determine_account(config)
File “/usr/local/lib/python3.7/site-packages/certbot/_internal/main.py”, line 519, in _determine_account
config, account_storage, tos_cb=_tos_cb)
File “/usr/local/lib/python3.7/site-packages/certbot/_internal/client.py”, line 174, in register
acme = acme_from_config_key(config, key)
File “/usr/local/lib/python3.7/site-packages/certbot/_internal/client.py”, line 44, in acme_from_config_key
return acme_client.BackwardsCompatibleClientV2(net, key, config.server)
File “/usr/local/lib/python3.7/site-packages/acme/client.py”, line 808, in init
directory = messages.Directory.from_json(net.get(server).json())
File “/usr/local/lib/python3.7/site-packages/acme/client.py”, line 1141, in get
self._send_request(‘GET’, url, **kwargs), content_type=content_type)
File “/usr/local/lib/python3.7/site-packages/acme/client.py”, line 1091, in _send_request
response = self.session.request(method, url, *args, **kwargs)
File “/usr/local/lib/python3.7/site-packages/requests/sessions.py”, line 533, in request
resp = self.send(prep, **send_kwargs)
File “/usr/local/lib/python3.7/site-packages/requests/sessions.py”, line 646, in send
r = adapter.send(request, **kwargs)
File “/usr/local/lib/python3.7/site-packages/requests/adapters.py”, line 514, in send
raise SSLError(e, request=request)
requests.exceptions.SSLError: HTTPSConnectionPool(host=‘acme-staging-v02.api.letsencrypt.org’, port=443): Max retries exceeded with url: /directory (Caused by SSLError(SSLError(“bad handshake: Error([(‘SSL routines’, ‘tls_process_server_certificate’, ‘certificate verify failed’)])”)))
2020-06-05 18:24:51,810:ERROR:certbot._internal.log:An unexpected error occurred:

When checking certificates
curl -v https://acme-v02.api.letsencrypt.org/directory

  • Trying 172.65.32.248:443…
  • TCP_NODELAY set
  • Connected to acme-v02.api.letsencrypt.org (172.65.32.248) port 443 (#0)
  • ALPN, offering h2
  • ALPN, offering http/1.1
  • successfully set certificate verify locations:
  • CAfile: /usr/local/share/certs/ca-root-nss.crt
    CApath: none
  • TLSv1.2 (OUT), TLS handshake, Client hello (1):
  • TLSv1.2 (IN), TLS handshake, Server hello (2):
  • TLSv1.2 (IN), TLS handshake, Certificate (11):
  • TLSv1.2 (IN), TLS handshake, Server key exchange (12):
  • TLSv1.2 (IN), TLS handshake, Server finished (14):
  • TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
  • TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1):
  • TLSv1.2 (OUT), TLS handshake, Finished (20):
  • TLSv1.2 (IN), TLS change cipher, Change cipher spec (1):
  • TLSv1.2 (IN), TLS handshake, Finished (20):
  • SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384
  • ALPN, server accepted to use h2
  • Server certificate:
  • subject: CN=acme-v01.api.letsencrypt.org
  • start date: May 11 18:09:21 2020 GMT
  • expire date: Aug 9 18:09:21 2020 GMT
  • subjectAltName: host “acme-v02.api.letsencrypt.org” matched cert’s “acme-v02.api.letsencrypt.org
  • issuer: C=XX; ST=City; O=STS; OU=HQ; CN=Intermediate for USIAG; emailAddress=support@mail.domain
  • SSL certificate verify ok.
  • Using HTTP2, server supports multi-use
  • Connection state changed (HTTP/2 confirmed)
  • Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0
  • Using Stream ID: 1 (easy handle 0x80142b800)

GET /directory HTTP/2
Host: acme-v02.api.letsencrypt.org
user-agent: curl/7.68.0
accept: /

Please Help me!

1 Like

Hi @vladislav,

I don’t know who USIAG is, but it looks to me like there is an HTTPS intercepting proxy on your network that proxies your outbound connections, and perhaps some of the software on your server is configured to allow this, but other software isn’t?

1 Like

If there were not such a proxy intercepting your connections, the expected output would include

  • issuer: C=US; O=Let’s Encrypt; CN=Let’s Encrypt Authority X3

instead of what you saw.

1 Like

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.