Unable to Validate SSL Certificate

[stvhanna]

After upgrading to latest version, the http traffic is automatically redirected to https and thus unable to validate the SSL certificate and end up with invalid certificate.

I tried deleting the content of the /data directory and re-launching the docker containers proxy-web, docker-gen, and letsencrypt-companion to recreate the /data content but that did not help.

Any ideas on how to fix this issue?

Below is the log from letsencrypt-companion.

[Wed May 12 17:39:49 UTC 2021] Using CA: https://acme-v02.api.letsencrypt.org/directory
[Wed May 12 17:39:49 UTC 2021] Creating domain key
[Wed May 12 17:39:52 UTC 2021] The domain key is here: /etc/acme.sh/emailme@mydomain.com/mysub.mydomain.com/mysub.mydomain.com.key
[Wed May 12 17:39:52 UTC 2021] Single domain='mysub.mydomain.com'
[Wed May 12 17:39:52 UTC 2021] Getting domain auth token for each domain
[Wed May 12 17:39:54 UTC 2021] Getting webroot for domain='mysub.mydomain.com'
[Wed May 12 17:39:55 UTC 2021] Verifying: mysub.mydomain.com
[Wed May 12 17:39:59 UTC 2021] Pending
[Wed May 12 17:40:01 UTC 2021] Pending
[Wed May 12 17:40:04 UTC 2021] Pending
[Wed May 12 17:40:07 UTC 2021] Pending
[Wed May 12 17:40:10 UTC 2021] Pending
[Wed May 12 17:40:12 UTC 2021] Pending
[Wed May 12 17:40:15 UTC 2021] Pending
[Wed May 12 17:40:18 UTC 2021] Pending
[Wed May 12 17:40:21 UTC 2021] Pending
[Wed May 12 17:40:23 UTC 2021] Pending
[Wed May 12 17:40:26 UTC 2021] Pending
[Wed May 12 17:40:29 UTC 2021] Pending
[Wed May 12 17:40:32 UTC 2021] Pending
[Wed May 12 17:40:34 UTC 2021] Pending
[Wed May 12 17:40:37 UTC 2021] Pending
[Wed May 12 17:40:40 UTC 2021] Pending
[Wed May 12 17:40:43 UTC 2021] Pending
[Wed May 12 17:40:46 UTC 2021] Pending
[Wed May 12 17:40:48 UTC 2021] Pending
[Wed May 12 17:40:51 UTC 2021] Pending
[Wed May 12 17:40:54 UTC 2021] Pending
[Wed May 12 17:40:57 UTC 2021] Pending
[Wed May 12 17:40:59 UTC 2021] Pending
[Wed May 12 17:41:02 UTC 2021] Pending
[Wed May 12 17:41:05 UTC 2021] Pending
[Wed May 12 17:41:08 UTC 2021] Pending
[Wed May 12 17:41:11 UTC 2021] Pending
[Wed May 12 17:41:14 UTC 2021] Pending
[Wed May 12 17:41:16 UTC 2021] Pending
[Wed May 12 17:41:16 UTC 2021] mysub.mydomain.com:Timeout
[Wed May 12 17:41:17 UTC 2021] Please check log file for more details: /dev/null

Log from proxy-web

mysub.mydomain.com 54.189.22.122 - - [12/May/2021:17:39:56 +0000] "GET /.well-known/acme-challenge/8t-kTc2CxFrLtjNWqZD5z43irvXkWjhqKiCt82IgUvE HTTP/1.1" 200 87 "-" "Mozilla/5.0 (compatible; Let's Encrypt validation server; +https://www.letsencrypt.org)"
  mysub.mydomain.com 3.142.122.14 - - [12/May/2021:17:39:56 +0000] "GET /.well-known/acme-challenge/8t-kTc2CxFrLtjNWqZD5z43irvXkWjhqKiCt82IgUvE HTTP/1.1" 200 87 "-" "Mozilla/5.0 (compatible; Let's Encrypt validation server; +https://www.letsencrypt.org)"
  mysub.mydomain.com 64.78.149.164 - - [12/May/2021:17:39:56 +0000] "GET /.well-known/acme-challenge/8t-kTc2CxFrLtjNWqZD5z43irvXkWjhqKiCt82IgUvE HTTP/1.1" 200 87 "-" "Mozilla/5.0 (compatible; Let's Encrypt validation server; +https://www.letsencrypt.org)"
  mysub.mydomain.com 3.122.178.200 - - [12/May/2021:17:39:56 +0000] "GET /.well-known/acme-challenge/8t-kTc2CxFrLtjNWqZD5z43irvXkWjhqKiCt82IgUvE HTTP/1.1" 200 87 "-" "Mozilla/5.0 (compatible; Let's Encrypt validation server; +https://www.letsencrypt.org)"
  mysub.mydomain.com 3.19.56.43 - - [12/May/2021:17:41:17 +0000] "GET /.well-known/acme-challenge/8t-kTc2CxFrLtjNWqZD5z43irvXkWjhqKiCt82IgUvE HTTP/1.1" 404 153 "-" "Mozilla/5.0 (compatible; Let's Encrypt validation server; +https://www.letsencrypt.org)"
  mysub.mydomain.com 52.39.4.59 - - [12/May/2021:17:41:17 +0000] "GET /.well-known/acme-challenge/8t-kTc2CxFrLtjNWqZD5z43irvXkWjhqKiCt82IgUvE HTTP/1.1" 404 153 "-" "Mozilla/5.0 (compatible; Let's Encrypt validation server; +https://www.letsencrypt.org)"
  mysub.mydomain.com 66.133.109.36 - - [12/May/2021:17:41:17 +0000] "GET /.well-known/acme-challenge/8t-kTc2CxFrLtjNWqZD5z43irvXkWjhqKiCt82IgUvE HTTP/1.1" 404 153 "-" "Mozilla/5.0 (compatible; Let's Encrypt validation server; +https://www.letsencrypt.org)"
  mysub.mydomain.com 3.122.178.200 - - [12/May/2021:17:41:18 +0000] "GET /.well-known/acme-challenge/8t-kTc2CxFrLtjNWqZD5z43irvXkWjhqKiCt82IgUvE HTTP/1.1" 404 153 "-" "Mozilla/5.0 (compatible; Let's Encrypt validation server; +https://www.letsencrypt.org)"

[evertramos]

The issue seems to be in your DNS @stvhanna... are you using Cloudflare? Or any other DNS proxy?

[stvhanna]

@evertramos Thanks for the reply. I'm using NextDNS, but as my default DNS (preference set at the router) and not as a proxy. How is the DNS affecting this? I checked the NextDNS log and it does not seem to be blocking anything that could affect this.

[evertramos]

CloudFlare uses proxies to hide your ip address... if you are at the server and ping your domain the ip address must be the public ip address of your server.

This error you are getting when it happens? Could you send the docker-compose of command line you are using it to put up this container?

The container must be in the same network of the proxy as well so it can reach the container.

[stvhanna]

@evertramos It turned out to be a firewall problem and after resolving the issue, the certs get generated properly. Thanks again for your help!