Xiiryo
Xiiryo

Reputation: 3257

Traefik V2.0 with Letsencrypt is unable to generate a certificate for the domains

I'm testing with Whoami and get an issue generating the certificates.

No certificate is generated into the acme.json file and the sites are using a default certificate from Traefik that is considered as invalid by the navigators.

Here is the error:

traefik         | time="2019-10-14T21:16:15Z" level=error msg="Unable to obtain ACME certificate for domains \"inner-whoami.mysite.com\": unable to generate a certificate for the domains [inner-whoami.mysite.com]: acme: Error -> One or more domains had a problem:\n[inner-whoami.mysite.com] acme: error: 403 :: urn:ietf:params:acme:error:unauthorized :: Invalid response from https://inner-whoami.mysite.com/.well-known/acme-challenge/xxxxxxxxxxxxxxxxxxxx [51.75.207.100]: \"Hostname: xxxxxxxxxx\\nIP: 127.0.0.1\\nIP: 172.18.0.2\\nRemoteAddr: 172.18.0.3:55692\\nGET /.well-known/acme-challenge/xxxxxxxxxx\", url: \n" rule="Host(`inner-whoami.mysite.com`)" routerName=inner-whoami-secured providerName=myhttpchallenge.acme
traefik         | time="2019-10-14T21:16:17Z" level=debug msg="legolog: [INFO] Unable to deactivate the authorization: https://acme-v02.api.letsencrypt.org/acme/authz-v3/xxxxxxxxxx"

Here is the docker-compose.yml file. Evrything is inside. As you can see, this is a test for preparing further deployement. Not an actual production file.I need to solve this issue before being able to use Traefik server wide...

version: "3.3"

networks:
    # Allow the use of traefik in other docker-compose.yml files
    traefik:
        external: true

services:

  traefik:
    image: "traefik:v2.0"
    container_name: "traefik"
    command:
      # Only for development environment
      - "--log.level=DEBUG"
      - "--api.insecure=true"
      # Get Docker as the provider
      - "--providers.docker=true"
      # Avoid that all containers are exposed
      - "--providers.docker.exposedbydefault=false"
      # Settle the ports for the entry points
      - "--entrypoints.web.address=:80"
      - "--entrypoints.web-secure.address=:443"
      # Settle the autentification method to http challenge
      - "--certificatesresolvers.myhttpchallenge.acme.httpchallenge=true"
      - "--certificatesresolvers.myhttpchallenge.acme.httpchallenge.entrypoint=web-secure"
      # Uncomment this to get a fake certificate when testing
      #- "--certificatesresolvers.myhttpchallenge.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory"
      # Settle letsencrypt as the certificate provider
      - "[email protected]"
      - "--certificatesresolvers.myhttpchallenge.acme.storage=/letsencrypt/acme.json"
    ports:
      - "80:80"
      - "443:443"
      - "8080:8080"
    networks:
      - "traefik"
    volumes:
      # Store certificates in ./letsencrypt/acme.json
      - "./letsencrypt:/letsencrypt"
      # Connect to Doker socket
      - "/var/run/docker.sock:/var/run/docker.sock:ro"

  inner-whoami:
    image: "containous/whoami"
    container_name: "inner-whoami"
    networks:
      - "traefik"
    labels:
      - "traefik.enable=true"
      # Get the routes from http
      - "traefik.http.routers.inner-whoami.rule=Host(`inner-whoami.mysite.com`)"
      - "traefik.http.routers.inner-whoami.entrypoints=web"
      # Redirect these routes to https
      - "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"
      - "traefik.http.routers.inner-whoami.middlewares=redirect-to-https@docker"
      # Get the routes from https
      - "traefik.http.routers.inner-whoami-secured.rule=Host(`inner-whoami.mysite.com`)"
      - "traefik.http.routers.inner-whoami-secured.entrypoints=web-secure"
      # Apply autentificiation with http challenge
      - "traefik.http.routers.inner-whoami-secured.tls=true"
      - "traefik.http.routers.inner-whoami-secured.tls.certresolver=myhttpchallenge"

Upvotes: 3

Views: 19500

Answers (3)

Seb T
Seb T

Reputation: 902

You probably need to change the entry point for http challenge from web-secure to web, i.e.:

- "--certificatesresolvers.myhttpchallenge.acme.httpchallenge.entrypoint=web"

Or use TLS Challenge instead:

- "--certificatesresolvers.myhttpchallenge.acme.tlschallenge=true"

Upvotes: 7

Bart Joosten
Bart Joosten

Reputation: 129

Did you examine the json in the link of the second line your error output?

https://acme-v02.api.letsencrypt.org/acme/authz-v3/xxxxxxxxxx

This link contains more info about the challenge not passing. If it complains about an A record not being found I might have a solution. In my case I needed to add an MX record to my DNS settings for my domain. Otherwise some DNS servers wouldn't pick it up. I tested this with dig sub.mydomain.com @8.8.8.8 which gave a SERVFAIL without the MX record.

Upvotes: 2

mapa0402
mapa0402

Reputation: 484

Have you tried with your real url instead of mysite.com?

Upvotes: 0

Related Questions