Certificate using Let's Encrypt - HTTP daemon failing

[rg2]

Hi,

I've set up two PMG servers in a cluster a couple months ago. I'm using the enterprise repositories on both servers.

I've also set up the certificates (API and SMTP) using HTTP challenge (type: standalone), which is the most simple way to do it.

I'm trying to manually renew the certificates (19 days to expire - it should have automatically renewed) and I'm getting the following error:

Loading ACME account details
Placing ACME order
Order URL: https://acme-v02.api.letsencrypt.org/acme/order/710640737/141730515077

Getting authorization details from 'https://acme-v02.api.letsencrypt.org/acme/authz-v3/173346676977'
The validation for *edited* is pending!
Setting up webserver
TASK ERROR: Failed to initialize HTTP daemon

I believe this happened because I've followed this article to allow quarantine access for users:

https://pmg.proxmox.com/wiki/index.php/Quarantine_Web_Interface_Via_Nginx_Proxy

There is a note at the end of that article: NOTE: if you're using the integrated ACME implementation with the standalone plugin you need to remove the server on port 80 above, since the ACME implementation needs to bind to it during certificate renewal

I'm not a linux expert... should I just remove the following lines on my ngix configuration?

server {
listen 80 default_server;
rewrite ^(.*) https://$host$1 permanent;
}

That won't break anything on my quarantine access for users, right? I'm not sure why port 80 is used on that article since the quarantine reports use HTTPS on the hyperlinks. Any idea?

Thanks.
Rafael

 

[Stoiko Ivanov]

I'm not a linux expert... should I just remove the following lines on my ngix configuration?

server {
listen 80 default_server;
rewrite ^(.*) https://$host$1 permanent;
}

yes this should fix the listener on port 80 - if in doubt you can check the output of `ss -tlnp` - to see which processes listen to which tcp-ports

I'm not sure why port 80 is used on that article since the quarantine reports use HTTPS on the hyperlinks. Any idea?

basically as a convenience feature for the users, who directly enter the address in their browser - instead of clicking on the link in the report
(arguably probably not that common with users clicking on the links in the spamreports)

I hope this helps!

 

[rg2]

Thanks Stoiko, but it seems I had already removed that part of the nginx configuration.. I just didn't remember.

debian@antispam-mx1:~$ sudo ss -tnlp
...
LISTEN 0 511 0.0.0.0:80 0.0.0.0:* users("nginx",pid=104340,fd=6),("nginx",pid=104339,fd=6),("nginx",pid=104338,fd=6))
...
LISTEN 0 511 [::]:80 [::]:* users("nginx",pid=104340,fd=7),...

It seems Nginx is still using port 80 even without having it set on the config file. I could manually stop nginx to renew the certificate, but that is not the perfect solution...

Any idea?
Best regards

 

[Stoiko Ivanov]

Thanks Stoiko, but it seems I had already removed that part of the nginx configuration.. I just didn't remember.

did you restart nginx afterwards? (systemctl restart nginx)?

if yes - there still might be a different virtual server on port 80 configured.. - check with `grep -r 80 /etc/nginx`

 

[rg2]

did you restart nginx afterwards? (systemctl restart nginx)?

if yes - there still might be a different virtual server on port 80 configured.. - check with `grep -r 80 /etc/nginx`

Yes I did restart the service. I even restarted the server to make sure it wasn't something "stuck".

This is what I get from grep:

debian@antispam-mx1:~$ sudo grep -r 80 /etc/nginx
/etc/nginx/win-utf: 82 E2809A; # single low-9 quotation mark
/etc/nginx/win-utf: 84 E2809E; # double low-9 quotation mark
/etc/nginx/win-utf: 85 E280A6; # ellipsis
/etc/nginx/win-utf: 86 E280A0; # dagger
/etc/nginx/win-utf: 87 E280A1; # double dagger
/etc/nginx/win-utf: 89 E280B0; # per mille
/etc/nginx/win-utf: 91 E28098; # left single quotation mark
/etc/nginx/win-utf: 92 E28099; # right single quotation mark
/etc/nginx/win-utf: 93 E2809C; # left double quotation mark
/etc/nginx/win-utf: 94 E2809D; # right double quotation mark
/etc/nginx/win-utf: 95 E280A2; # bullet
/etc/nginx/win-utf: 96 E28093; # en dash
/etc/nginx/win-utf: 97 E28094; # em dash
/etc/nginx/win-utf: F0 D180; # small r
/etc/nginx/sites-available/default: listen 80 default_server;
/etc/nginx/sites-available/default: listen [::]:80 default_server;
/etc/nginx/sites-available/default:# listen 80;
/etc/nginx/sites-available/default:# listen [::]:80;
/etc/nginx/sites-available/pmg-quarantine.conf: proxy_pass https://localhost:8006;
/etc/nginx/sites-available/pmg-quarantine.conf: proxy_pass https://localhost:8006;
/etc/nginx/sites-available/pmg-quarantine.conf: proxy_pass https://localhost:8006;
/etc/nginx/sites-available/pmg-quarantine.conf: proxy_pass https://localhost:8006;
/etc/nginx/sites-available/pmg-quarantine.conf: proxy_pass https://localhost:8006;
/etc/nginx/koi-utf: 80 E282AC ; # euro
/etc/nginx/koi-utf: 95 E280A2 ; # bullet
/etc/nginx/koi-utf: D2 D180 ; # small r
/etc/nginx/koi-win: 80 88 ; # euro

But I'm not sure what I'm looking for, I've never used Nginx before

 

[Stoiko Ivanov]

/etc/nginx/sites-available/default: listen 80 default_server;
/etc/nginx/sites-available/default: listen [::]:80 default_server;
/etc/nginx/sites-available/default:# listen 80;
/etc/nginx/sites-available/default:# listen [::]:80;

the default file is most likely the issue - you can try simply disabling it
`rm /etc/nginx/sites-enabled/default` (make a backup of the file just in case!)
`systemctl restart nginx`

 

[rg2]

the default file is most likely the issue - you can try simply disabling it
`rm /etc/nginx/sites-enabled/default` (make a backup of the file just in case!)
`systemctl restart nginx`

It worked

Thanks Stoiko! Best regards!