ACME client includes private IP in request

D

d1nuc0m

New Member
Dec 6, 2024
13
3
3
Hi, I am trying to get a TLS certificate with ACME on PDM.
The machine has a private IPv4 and the certificate request fails because the IP is included in the request (and almost no public CA releases a certificate for a private IP):

1782299536183.png

Hostname is configured correctly both in hostnamectl and /etc/hosts

Packages:
Code: 
libproxmox-acme-plugins/stable,now 1.7.1 all [installed]
proxmox-archive-keyring/stable,now 4.0 all [installed]
proxmox-datacenter-manager-client/stable,now 1.1.4 amd64 [installed]
proxmox-datacenter-manager-docs/stable,now 1.1.4 all [installed]
proxmox-datacenter-manager-meta/stable,now 1.1.0 all [installed]
proxmox-datacenter-manager-ui/stable,now 1.1.2 amd64 [installed]
proxmox-datacenter-manager/stable,now 1.1.4 amd64 [installed]
proxmox-default-kernel/stable,now 2.1.0 all [installed]
proxmox-enterprise-support-keyring/stable,now 1.0 all [installed]
proxmox-geojson-data/stable,now 1.1 all [installed]
proxmox-kernel-7.0.2-6-pve-signed/stable,now 7.0.2-6 amd64 [installed]
proxmox-kernel-7.0.6-2-pve-signed/stable,now 7.0.6-2 amd64 [installed,automatic]
proxmox-kernel-7.0/stable,now 7.0.6-2 amd64 [installed,upgradable to: 7.0.12-1]
proxmox-kernel-helper/stable,now 9.2.0 all [installed]
proxmox-mail-forward/stable,now 1.0.3 amd64 [installed]
proxmox-mini-journalreader/stable,now 1.6 amd64 [installed]
proxmox-offline-mirror-docs/stable,now 0.7.4 all [installed]
proxmox-offline-mirror-helper/stable,now 0.7.4 amd64 [installed]
proxmox-termproxy/stable,now 2.1.0 amd64 [installed]
 
Hi @d1nuc0m

thanks for posting on the forum!

Can you please share your (sanitized) ACME cert configuration file and in case DNS validation is used the plugins file.
Code: 
cat /etc/proxmox-datacenter-manager/acme/certificate.cfg
cat /etc/proxmox-datacenter-manager/acme/plugins.cfg

Yours sincerely
Jonas
 
  • Like
Reactions: d1nuc0m
@j.theisen thanks, using HTTP-01 challenge, so there are no DNS files

Code: 
cat /etc/proxmox-datacenter-manager/acme/certificate.cfg
acme: account=acme.example.com
acmedomain0: my-pdm.example.com

cat /etc/proxmox-datacenter-manager/acme/plugins.cfg
cat: /etc/proxmox-datacenter-manager/acme/plugins.cfg: No such file or directory

Btw, I am not using Let's Encrypt, but added another CA with

Code: 
proxmox-datacenter-manager-admin acme account register acme.example.com my-email@example.com --directory https://acme.example.com/directory
 
Thanks for the information!

Could you please also provide the Output of the "Order Certificate" task you posted earlier.

Yours
Jonas
 
@j.theisen here it is

Code: 
2026-06-24T17:04:03+02:00: Placing ACME order
2026-06-24T17:04:03+02:00: Order URL: https://acme.example.com/order/urn:uuid:18580321-df88-4645-a7c3-b667fd049c6a
2026-06-24T17:04:03+02:00: Getting authorization details from 'https://acme.example.com/authorization/urn:uuid:2f0c6897-207d-4701-9d05-119b75e4d60e'
2026-06-24T17:04:03+02:00: The validation for my-pdm.example.com is pending
2026-06-24T17:04:03+02:00: Setting up validation plugin
2026-06-24T17:04:03+02:00: Triggering validation
2026-06-24T17:04:03+02:00: TASK ERROR: urn:ietf:params:acme:error:rejectedIdentifier: ('rejectedIdentifier', '172.18.X.Y not in allowed ranges')
 
Hey, thanks for the provided information. This seems a little weird to me. Would you mind providing the account config for this ACME server? It should be located in /etc/proxmox-datacenter-manager/acme/accounts/<acount-name>.

It would also be helpful if you could provide uncensored config files here. Since you don't want to post them publicly, which is understandable, would you mind sending them to me via private message?

Also, if this is a public ACME provider, would you mind sharing which one you are using? Thank you!
 
Ah sorry about that, send you a message now, hope that works.
 
  • Like
Reactions: d1nuc0m
As discussed privately, I am posting the results of my investigation here to help other users running into the same issue. What confused me, is that it complained about an IP identifier, which is odd, because we only allow DNS identifiers in the first place [1]. So where did the IP come from if we, by definition, have no way of adding it?

Since you stated (privately) that you are using a Serles certificate proxy, I took a look at the code there. It seems that this error originates with the proxy and is entirely based on a check within the validation logic of the Serles proxy. When verifying an http-01 challenge [2] it calls this function unconditionally:

Python: 
    reject = additional_ip_address_checks(config, remote_ip, host, is_ipaddress)
    if reject:
        return "rejectedIdentifier", reject
#[..]
def additional_ip_address_checks(config, remote_ip, host, is_ipaddress=False):
    """ perform additional checks on the remote IP address

    These are useful in an enterprise setting, but not required by spec.

    Args:
        remote_ip (str): the IP address which we connected to for challenge
            verification
        host (str): dNSname which we resolved to get `remote_ip`
        is_ipaddress (bool): whether `host` is an IP address (skips verifyPTR)

    Returns:
        Optional[str]: An error, if one occured, or None.
    """
    if is_ipaddress:
        remote_ip = host

    if config["allowedServerIpRanges"] and not ip_in_ranges(
        remote_ip, config["allowedServerIpRanges"]
    ):
        return "rejectedIdentifier", f"{remote_ip} not in allowed ranges"
#[..]

So it will always check if the host that is making the ACME request is within the ranges configured in its config. Please add the IP address range of your PDM to the Serles configuration. You should likely also disable verifyPTR unless your Serles host can find an appropriate PTR DNS record for the PDM's IP address.

Note that remote_ip is the IP of your PDM host from Serles' perspective. There is no way for us to “correct” this from the PDM-side. You can either give the PDM host an IP address that is already valid from Serles' perspective or add the IP range to Serles' allowed server IP ranges.

Hope that helps!

[1]: https://git.proxmox.com/?p=proxmox....1d7b845292929f9e340b26a093e454608;hb=HEAD#l59
[2]: https://github.com/dvtirol/serles-acme/blob/master/serles/challenge.py#L127
 
  • Like
Reactions: j.theisen
You must log in or register to reply here.
Top Bottom
Back