2

I'm testing with Whoami and get an issue generating the certificates.

No certificate is generated into the acme.json file and the sites are using a default certificate from Traefik that is considered as invalid by the navigators.

Here is the error:

traefik         | time="2019-10-14T21:16:15Z" level=error msg="Unable to obtain ACME certificate for domains \"inner-whoami.mysite.com\": unable to generate a certificate for the domains [inner-whoami.mysite.com]: acme: Error -> One or more domains had a problem:\n[inner-whoami.mysite.com] acme: error: 403 :: urn:ietf:params:acme:error:unauthorized :: Invalid response from https://inner-whoami.mysite.com/.well-known/acme-challenge/xxxxxxxxxxxxxxxxxxxx [51.75.207.100]: \"Hostname: xxxxxxxxxx\\nIP: 127.0.0.1\\nIP: 172.18.0.2\\nRemoteAddr: 172.18.0.3:55692\\nGET /.well-known/acme-challenge/xxxxxxxxxx\", url: \n" rule="Host(`inner-whoami.mysite.com`)" routerName=inner-whoami-secured providerName=myhttpchallenge.acme
traefik         | time="2019-10-14T21:16:17Z" level=debug msg="legolog: [INFO] Unable to deactivate the authorization: https://acme-v02.api.letsencrypt.org/acme/authz-v3/xxxxxxxxxx"

Here is the docker-compose.yml file. Evrything is inside. As you can see, this is a test for preparing further deployement. Not an actual production file.I need to solve this issue before being able to use Traefik server wide...

version: "3.3"

networks:
    # Allow the use of traefik in other docker-compose.yml files
    traefik:
        external: true

services:

  traefik:
    image: "traefik:v2.0"
    container_name: "traefik"
    command:
      # Only for development environment
      - "--log.level=DEBUG"
      - "--api.insecure=true"
      # Get Docker as the provider
      - "--providers.docker=true"
      # Avoid that all containers are exposed
      - "--providers.docker.exposedbydefault=false"
      # Settle the ports for the entry points
      - "--entrypoints.web.address=:80"
      - "--entrypoints.web-secure.address=:443"
      # Settle the autentification method to http challenge
      - "--certificatesresolvers.myhttpchallenge.acme.httpchallenge=true"
      - "--certificatesresolvers.myhttpchallenge.acme.httpchallenge.entrypoint=web-secure"
      # Uncomment this to get a fake certificate when testing
      #- "--certificatesresolvers.myhttpchallenge.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory"
      # Settle letsencrypt as the certificate provider
      - "--certificatesresolvers.myhttpchallenge.acme.email=me@mail.com"
      - "--certificatesresolvers.myhttpchallenge.acme.storage=/letsencrypt/acme.json"
    ports:
      - "80:80"
      - "443:443"
      - "8080:8080"
    networks:
      - "traefik"
    volumes:
      # Store certificates in ./letsencrypt/acme.json
      - "./letsencrypt:/letsencrypt"
      # Connect to Doker socket
      - "/var/run/docker.sock:/var/run/docker.sock:ro"

  inner-whoami:
    image: "containous/whoami"
    container_name: "inner-whoami"
    networks:
      - "traefik"
    labels:
      - "traefik.enable=true"
      # Get the routes from http
      - "traefik.http.routers.inner-whoami.rule=Host(`inner-whoami.mysite.com`)"
      - "traefik.http.routers.inner-whoami.entrypoints=web"
      # Redirect these routes to https
      - "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"
      - "traefik.http.routers.inner-whoami.middlewares=redirect-to-https@docker"
      # Get the routes from https
      - "traefik.http.routers.inner-whoami-secured.rule=Host(`inner-whoami.mysite.com`)"
      - "traefik.http.routers.inner-whoami-secured.entrypoints=web-secure"
      # Apply autentificiation with http challenge
      - "traefik.http.routers.inner-whoami-secured.tls=true"
      - "traefik.http.routers.inner-whoami-secured.tls.certresolver=myhttpchallenge"

3 Answers 3

7

You probably need to change the entry point for http challenge from web-secure to web, i.e.:

- "--certificatesresolvers.myhttpchallenge.acme.httpchallenge.entrypoint=web"

Or use TLS Challenge instead:

- "--certificatesresolvers.myhttpchallenge.acme.tlschallenge=true"

2

Did you examine the json in the link of the second line your error output?

https://acme-v02.api.letsencrypt.org/acme/authz-v3/xxxxxxxxxx

This link contains more info about the challenge not passing. If it complains about an A record not being found I might have a solution. In my case I needed to add an MX record to my DNS settings for my domain. Otherwise some DNS servers wouldn't pick it up. I tested this with dig sub.mydomain.com @8.8.8.8 which gave a SERVFAIL without the MX record.

0

Have you tried with your real url instead of mysite.com?

2
  • 1
    ok, write-access for docker at - "./letsencrypt:/letsencrypt" ?
    – mapa0402
    Oct 15, 2019 at 11:53
  • Docker created the folder so I guess yes. It was on root rw. I tried to chown it to myuser. It did not change the behavior.
    – Xiiryo
    Oct 15, 2019 at 13:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.