"ACME challenge invalid" please help!

[Aerialflame7125]

Hello, i have just started working with proxmox, pretty new. But i have found more posts in regards to my situation, but cannot find a proper answer. Here is what Shell reports when I do

root@HomeProx:~# pvenode acme cert order

Loading ACME account details

Placing ACME order

Order URL: https://acme-staging-v02.api.letsencrypt.org/acme/order/101356984/8649915344



Getting authorization details from 'https://acme-staging-v02.api.letsencrypt.org/acme/authz-v3/6411004364'

The validation for aerial.com is pending!

Setting up webserver

Triggering validation

Sleeping for 5 seconds

validating challenge 'https://acme-staging-v02.api.letsencrypt.org/acme/authz-v3/6411004364' failed - status: invalid

Task validating challenge 'https://acme-staging-v02.api.letsencrypt.org/acme/authz-v3/6411004364' failed - status: invalid

Now i am no geek, but I know this has to do with something with the certificate or my web address or something.

Also, just to save time, i read the link above. Here is what it says.

{

  "identifier": {

    "type": "dns",

    "value": "aerial.com"

  },

  "status": "invalid",

  "expires": "2023-05-16T01:20:19Z",

  "challenges": [

    {

      "type": "http-01",

      "status": "invalid",

      "error": {

        "type": "urn:ietf:params:acme:error:unauthorized",

        "detail": "2606:4700:3036::ac43:bbd3: Invalid response from http://aerial.com/.well-known/acme-challenge/Z_mhvb08mFqU2Qi56K1O-50_Lw8jF6OZ5tRG9uyvBcs: 404",

        "status": 403

      },

      "url": "https://acme-staging-v02.api.letsencrypt.org/acme/chall-v3/6411004364/QkLY1A",

      "token": "Z_mhvb08mFqU2Qi56K1O-50_Lw8jF6OZ5tRG9uyvBcs",

      "validationRecord": [

        {

          "url": "http://aerial.com/.well-known/acme-challenge/Z_mhvb08mFqU2Qi56K1O-50_Lw8jF6OZ5tRG9uyvBcs",

          "hostname": "aerial.com",

          "port": "80",

          "addressesResolved": [

            "104.21.72.236",

            "172.67.187.211",

            "2606:4700:3036::ac43:bbd3",

            "2606:4700:3034::6815:48ec"

          ],

          "addressUsed": "2606:4700:3036::ac43:bbd3"

        }

      ],

      "validated": "2023-05-09T01:23:51Z"

    }

  ]

}

Please help.
Edit: gonna try and use another link.

 

[Chris]

Hello, i have just started working with proxmox, pretty new. But i have found more posts in regards to my situation, but cannot find a proper answer. Here is what Shell reports when I do

root@HomeProx:~# pvenode acme cert order

Loading ACME account details

Placing ACME order

Order URL: https://acme-staging-v02.api.letsencrypt.org/acme/order/101356984/8649915344



Getting authorization details from 'https://acme-staging-v02.api.letsencrypt.org/acme/authz-v3/6411004364'

The validation for aerial.com is pending!

Setting up webserver

Triggering validation

Sleeping for 5 seconds

validating challenge 'https://acme-staging-v02.api.letsencrypt.org/acme/authz-v3/6411004364' failed - status: invalid

Task validating challenge 'https://acme-staging-v02.api.letsencrypt.org/acme/authz-v3/6411004364' failed - status: invalid

Now i am no geek, but I know this has to do with something with the certificate or my web address or something.

Also, just to save time, i read the link above. Here is what it says.

{

  "identifier": {

    "type": "dns",

    "value": "aerial.com"

  },

  "status": "invalid",

  "expires": "2023-05-16T01:20:19Z",

  "challenges": [

    {

      "type": "http-01",

      "status": "invalid",

      "error": {

        "type": "urn:ietf:params:acme:error:unauthorized",

        "detail": "2606:4700:3036::ac43:bbd3: Invalid response from http://aerial.com/.well-known/acme-challenge/Z_mhvb08mFqU2Qi56K1O-50_Lw8jF6OZ5tRG9uyvBcs: 404",

        "status": 403

      },

      "url": "https://acme-staging-v02.api.letsencrypt.org/acme/chall-v3/6411004364/QkLY1A",

      "token": "Z_mhvb08mFqU2Qi56K1O-50_Lw8jF6OZ5tRG9uyvBcs",

      "validationRecord": [

        {

          "url": "http://aerial.com/.well-known/acme-challenge/Z_mhvb08mFqU2Qi56K1O-50_Lw8jF6OZ5tRG9uyvBcs",

          "hostname": "aerial.com",

          "port": "80",

          "addressesResolved": [

            "104.21.72.236",

            "172.67.187.211",

            "2606:4700:3036::ac43:bbd3",

            "2606:4700:3034::6815:48ec"

          ],

          "addressUsed": "2606:4700:3036::ac43:bbd3"

        }

      ],

      "validated": "2023-05-09T01:23:51Z"

    }

  ]

}

Please help.
Edit: gonna try and use another link.

Hi,
you are trying to validate your domain using a http challenge. For this to work, the letsencrypt side has to be able to access the challenge url on port 80, as shown in your output. It seems you get a 403 error code, meaning there was an authorization error.

Are the resolved IPs correct? Do you have an other service listening on port 80?

Alternatively, you could use dns based validation, which validates your domain by writing a dns record instead of serving the challenge via http.

 

[Aerialflame7125]

Hi,
you are trying to validate your domain using a http challenge. For this to work, the letsencrypt side has to be able to access the challenge url on port 80, as shown in your output. It seems you get a 403 error code, meaning there was an authorization error.

Are the resolved IPs correct? Do you have an other service listening on port 80?

Alternatively, you could use dns based validation, which validates your domain by writing a dns record instead of serving the challenge via http.

But how so would I go through a dns record? I am thinking of going through nginx and making a site that resorts to my proxmox server, but I have no idea on where to start. I have the main site up and running, then tried a reverse proxy going to port 80, but nothing happens so far. Also quick question: If i started a reverse proxy, should i start on the main proxmox shell, or a container?

 

[Chris]

But how so would I go through a dns record? I am thinking of going through nginx and making a site that resorts to my proxmox server, but I have no idea on where to start. I have the main site up and running, then tried a reverse proxy going to port 80, but nothing happens so far. Also quick question: If i started a reverse proxy, should i start on the main proxmox shell, or a container?

For http-1 based challenges, no reverse proxy should be running on the host, as port 80 must be free for the internal webserver to bind to, see https://pve.proxmox.com/pve-docs/pve-admin-guide.html#sysadmin_certs_acme_plugins

 

[jeanphi]

can be fixed by a shell script
once a week
(in my case, i using iptables)

iptables -t nat -D PREROUTING -i vmbr0 -p tcp -m tcp --dport 80 -j DNAT --to-destination your_reverse_proxy_IP:80
service pve-daily-update restart # (force renew the certificate)
sleep 10 # (can be less, but must be tested)
iptables -t nat -I PREROUTING -i vmbr0 -p tcp -m tcp --dport 80 -j DNAT --to-destination your_reverse_proxy_IP:80