Certificate using Let's Encrypt - HTTP daemon failing

R

rg2

Active Member
Jul 18, 2014
27
4
43
Hi,

I've set up two PMG servers in a cluster a couple months ago. I'm using the enterprise repositories on both servers.

I've also set up the certificates (API and SMTP) using HTTP challenge (type: standalone), which is the most simple way to do it.

I'm trying to manually renew the certificates (19 days to expire - it should have automatically renewed) and I'm getting the following error:

Loading ACME account details
Placing ACME order
Order URL: https://acme-v02.api.letsencrypt.org/acme/order/710640737/141730515077

Getting authorization details from 'https://acme-v02.api.letsencrypt.org/acme/authz-v3/173346676977'
The validation for *edited* is pending!
Setting up webserver
TASK ERROR: Failed to initialize HTTP daemon

I believe this happened because I've followed this article to allow quarantine access for users:

https://pmg.proxmox.com/wiki/index.php/Quarantine_Web_Interface_Via_Nginx_Proxy

There is a note at the end of that article: NOTE: if you're using the integrated ACME implementation with the standalone plugin you need to remove the server on port 80 above, since the ACME implementation needs to bind to it during certificate renewal

I'm not a linux expert... should I just remove the following lines on my ngix configuration?

server {
listen 80 default_server;
rewrite ^(.*) https://$host$1 permanent;
}

That won't break anything on my quarantine access for users, right? I'm not sure why port 80 is used on that article since the quarantine reports use HTTPS on the hyperlinks. Any idea?

Thanks.
Rafael
 
rg2 said:
I'm not a linux expert... should I just remove the following lines on my ngix configuration?

server {
listen 80 default_server;
rewrite ^(.*) https://$host$1 permanent;
}
Click to expand...
yes this should fix the listener on port 80 - if in doubt you can check the output of `ss -tlnp` - to see which processes listen to which tcp-ports

rg2 said:
I'm not sure why port 80 is used on that article since the quarantine reports use HTTPS on the hyperlinks. Any idea?
Click to expand...
basically as a convenience feature for the users, who directly enter the address in their browser - instead of clicking on the link in the report
(arguably probably not that common with users clicking on the links in the spamreports)

I hope this helps!
 
Thanks Stoiko, but it seems I had already removed that part of the nginx configuration.. I just didn't remember.

debian@antispam-mx1:~$ sudo ss -tnlp
...
LISTEN 0 511 0.0.0.0:80 0.0.0.0:* users:(("nginx",pid=104340,fd=6),("nginx",pid=104339,fd=6),("nginx",pid=104338,fd=6))
...
LISTEN 0 511 [::]:80 [::]:* users:(("nginx",pid=104340,fd=7),...

It seems Nginx is still using port 80 even without having it set on the config file. I could manually stop nginx to renew the certificate, but that is not the perfect solution...

Any idea?
Best regards
 
rg2 said:
Thanks Stoiko, but it seems I had already removed that part of the nginx configuration.. I just didn't remember.
Click to expand...
did you restart nginx afterwards? (systemctl restart nginx)?

if yes - there still might be a different virtual server on port 80 configured.. - check with `grep -r 80 /etc/nginx`
 
Stoiko Ivanov said:
did you restart nginx afterwards? (systemctl restart nginx)?

if yes - there still might be a different virtual server on port 80 configured.. - check with `grep -r 80 /etc/nginx`
Click to expand...

Yes I did restart the service. I even restarted the server to make sure it wasn't something "stuck".

This is what I get from grep:

debian@antispam-mx1:~$ sudo grep -r 80 /etc/nginx
/etc/nginx/win-utf: 82 E2809A; # single low-9 quotation mark
/etc/nginx/win-utf: 84 E2809E; # double low-9 quotation mark
/etc/nginx/win-utf: 85 E280A6; # ellipsis
/etc/nginx/win-utf: 86 E280A0; # dagger
/etc/nginx/win-utf: 87 E280A1; # double dagger
/etc/nginx/win-utf: 89 E280B0; # per mille
/etc/nginx/win-utf: 91 E28098; # left single quotation mark
/etc/nginx/win-utf: 92 E28099; # right single quotation mark
/etc/nginx/win-utf: 93 E2809C; # left double quotation mark
/etc/nginx/win-utf: 94 E2809D; # right double quotation mark
/etc/nginx/win-utf: 95 E280A2; # bullet
/etc/nginx/win-utf: 96 E28093; # en dash
/etc/nginx/win-utf: 97 E28094; # em dash
/etc/nginx/win-utf: F0 D180; # small r
/etc/nginx/sites-available/default: listen 80 default_server;
/etc/nginx/sites-available/default: listen [::]:80 default_server;
/etc/nginx/sites-available/default:# listen 80;
/etc/nginx/sites-available/default:# listen [::]:80;
/etc/nginx/sites-available/pmg-quarantine.conf: proxy_pass https://localhost:8006;
/etc/nginx/sites-available/pmg-quarantine.conf: proxy_pass https://localhost:8006;
/etc/nginx/sites-available/pmg-quarantine.conf: proxy_pass https://localhost:8006;
/etc/nginx/sites-available/pmg-quarantine.conf: proxy_pass https://localhost:8006;
/etc/nginx/sites-available/pmg-quarantine.conf: proxy_pass https://localhost:8006;
/etc/nginx/koi-utf: 80 E282AC ; # euro
/etc/nginx/koi-utf: 95 E280A2 ; # bullet
/etc/nginx/koi-utf: D2 D180 ; # small r
/etc/nginx/koi-win: 80 88 ; # euro

But I'm not sure what I'm looking for, I've never used Nginx before :confused:
 
rg2 said:
/etc/nginx/sites-available/default: listen 80 default_server;
/etc/nginx/sites-available/default: listen [::]:80 default_server;
/etc/nginx/sites-available/default:# listen 80;
/etc/nginx/sites-available/default:# listen [::]:80;
Click to expand...
the default file is most likely the issue - you can try simply disabling it
`rm /etc/nginx/sites-enabled/default` (make a backup of the file just in case!)
`systemctl restart nginx`
 
  • Like
Reactions: rg2
You must log in or register to reply here.
Top Bottom