mirror of
https://github.com/dehydrated-io/dehydrated.git
synced 2026-01-14 07:33:34 +01:00
Challenge validation has failed #530
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @kshah37 on GitHub (Apr 19, 2021).
Hi, I am trying to renewing my let's encrypt dehydrated certificated by running ./letsencrypt .sh script.
But, It gives me this error. Some how it's not putting the validating challenge in to the directory. So it gives me http-01 error.
root@fusionpbx:/usr/src/fusionpbx-install.sh/debian/resources# ./letsencrypt.sh
Domain Name: lab.smartipcloud.com
Email Address: tfernnadez@smartip.ca
fatal: destination path 'dehydrated' already exists and is not an empty directory.
INFO: Using main config file /etc/dehydrated/config
INFO: Using main config file /etc/dehydrated/config
Processing lab.smartipcloud.com
ERROR: Challenge is invalid! (returned: invalid) (result: ["type"] "http-01"
["status"] "invalid"
["error","type"] "urn:ietf:params:acme:error:connection"
["error","detail"] "Fetching http://lab.smartipcloud.com/.well-known/acme-challenge/fldIKdGzgAEWBsKn0UVC4Q_fwk3zrq8o8QUg2cTrfqU: Timeout during connect (likely firewall problem)"
["error","status"] 400
["error"] {"type":"urn:ietf:params:acme:error:connection","detail":"Fetching http://lab.smartipcloud.com/.well-known/acme-challenge/fldIKdGzgAEWBsKn0UVC4Q_fwk3zrq8o8QUg2cTrfqU: Timeout during connect (likely firewall problem)","status":400}
["url"] "https://acme-v02.api.letsencrypt.org/acme/chall-v3/12460660075/zDKxIw"
["token"] "fldIKdGzgAEWBsKn0UVC4Q_fwk3zrq8o8QUg2cTrfqU"
["validationRecord",0,"url"] "http://lab.smartipcloud.com/.well-known/acme-challenge/fldIKdGzgAEWBsKn0UVC4Q_fwk3zrq8o8QUg2cTrfqU"
["validationRecord",0,"hostname"] "lab.smartipcloud.com"
["validationRecord",0,"port"] "80"
["validationRecord",0,"addressesResolved",0] "159.203.20.180"
["validationRecord",0,"addressesResolved"] ["159.203.20.180"]
["validationRecord",0,"addressUsed"] "159.203.20.180"
["validationRecord",0] {"url":"http://lab.smartipcloud.com/.well-known/acme-challenge/fldIKdGzgAEWBsKn0UVC4Q_fwk3zrq8o8QUg2cTrfqU","hostname":"lab.smartipcloud.com","port":"80","addressesResolved":["159.203.20.180"],"addressUsed":"159.203.20.180"}
["validationRecord"] [{"url":"http://lab.smartipcloud.com/.well-known/acme-challenge/fldIKdGzgAEWBsKn0UVC4Q_fwk3zrq8o8QUg2cTrfqU","hostname":"lab.smartipcloud.com","port":"80","addressesResolved":["159.203.20.180"],"addressUsed":"159.203.20.180"}]
["validated"] "2021-04-19T14:59:34Z")
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful
Does anyone have the same issue?
@KamilKeski commented on GitHub (Apr 19, 2021):
Your endpoint is returning a 400. Impossible to troubleshoot that without knowledge of the setup. I would dig into why you are returning a 400
["error","detail"] "Fetching http://lab.smartipcloud.com/.well-known/acme-challenge/fldIKdGzgAEWBsKn0UVC4Q_fwk3zrq8o8QUg2cTrfqU: Timeout during connect (likely firewall problem)"
["error","status"] 400
If it can't place the challenge in your dir you should be checking folder permissions against the user you are running dehydrated as.
@jobe1986 commented on GitHub (Apr 19, 2021):
I get a timeout attempting to connect to the httpd on lab.smartipcloud.com so can only conclude that either connections to ports 80 and 443 are blocked by your firewall, or there is no httpd running.
@kshah37 commented on GitHub (Apr 19, 2021):
I tried to put test file "Index.txt" in the same directory (/var/www/dehydrated) and it worked. I was able to get the file.
https://lab.smartipcloud.com/.well-known/acme-challenge/index.txt
I also double checked my firewall .
@KamilKeski commented on GitHub (Apr 19, 2021):
No one from the outside can reach lab.smartipcloud.com. Unless you are whitelisting only letsencrypt source ip's it looks like you are blocking all external traffic atm. I'd recommend you open to 0.0.0.0, verify it's accessible. Sort your renewal, verify success. Then pair down your access if needed.
@kshah37 commented on GitHub (Apr 19, 2021):
I made these two changes and it worked. Thank you all for your support