[SOLVED] PVE 5.2 Lets Encrypt: TASK ERROR: validating challenge failed

[fips]

Hi,
Yesterday I upgraded from 5.1 to 5.2, everything works like a charm
Today I wanted to setup Let's encrypt certs, but as soon as I click on "order Certificate" I receive that error:

Loading ACME account details
Placing ACME order
Order URL: https://acme-v02.api.letsencrypt.org/acme/order/35096850/5660549

Getting authorization details from 'https://acme-v02.api.letsencrypt.org/acme/authz/jNOsmFB6vh_0xLMI-QRLJyLJa5dy1imMsdqbAr3yC4M'
... pending!
Setting up webserver
Triggering validation
Sleeping for 5 seconds
TASK ERROR: validating challenge 'https://acme-v02.api.letsencrypt.org/acme/authz/jNOsmFB6vh_0xLMI-QRLJyLJa5dy1imMsdqbAr3yC4M' failed

any ideas??

 

[fabian]

if you take a look at the authorization record (
https://acme-v02.api.letsencrypt.org/acme/authz/jNOsmFB6vh_0xLMI-QRLJyLJa5dy1imMsdqbAr3yC4M) you can see the following error:

     "type": "http-01",
     "status": "invalid",
     "error": {
       "type": "urn:ietf:params:acme:error:unknownHost",
       "detail": "No valid IP addresses found for vmb1.mqmdc.fuerst.it",
       "status": 400
     },

as the docs state, for LE to work you need to fulfill the following pre-requisites:

1. Port 80 of the node needs to be reachable from the internet.
   
   
2. There must be no other listener on port 80.
   
   
3. The requested (sub)domain needs to resolve to a public IP of the Node.
   
   
4. You have to accept the ToS of Let’s Encrypt.

 

[fips]

Ah, sure. I forgot something :-D
Thanks!!

 

[macleod]

Hello!
I have some problems registering the account from the GUI interface. In the "Register Account" page, the "ACME Directory" contains nothing.

Fallback to console,
# pvenode acme account register default my@email
!!! only one time per cluster
!!! ensure you select 0, because 1 is acme staging (for tests only)
then on each node run
# pvenode config set --acme domains=my.domain.local
# pvenode acme cert order
(be sure that port 80 is open from the world)

Everything works like a charm. The domain is listed when I click "Edit domain" button.
Still, the "Register Account" page still shows nothing. Bug or lack of configuration ?

Proxmox 5.2 (upgraded from 5.1 initial was 5.0).

PS: any idea when / if the DNS challenge will be available ?

 

[arnolem]

Hello!
I have some problems registering the account from the GUI interface. In the "Register Account" page, the "ACME Directory" contains nothing.

Fallback to console,
# pvenode acme account register default my@email
!!! only one time per cluster
!!! ensure you select 0, because 1 is acme staging (for tests only)
then on each node run
# pvenode config set --acme domains=my.domain.local
# pvenode acme cert order
(be sure that port 80 is open from the world)

Everything works like a charm. The domain is listed when I click "Edit domain" button.
Still, the "Register Account" page still shows nothing. Bug or lack of configuration ?

Proxmox 5.2 (upgraded from 5.1 initial was 5.0).

PS: any idea when / if the DNS challenge will be available ?

Hi, I have the same problem with two new installations of Proxmox 5.2

 

[dcsapak]

Hi, I have the same problem with two new installations of Proxmox 5.2

which problem would that be ?

 

[arnolem]

which problem would that be ?

In the "Register Account" page, the "ACME Directory" contains nothing.

 

[dcsapak]

what does

pvesh get /cluster/acme/directories

on the node you try this show?

 

[arnolem]

what does

pvesh get /cluster/acme/directories

on the node you try this show?

200 OK
[
   {
      "name" : "Let's Encrypt V2",
      "url" : "https://acme-v02.api.letsencrypt.org/directory"
   },
   {
      "name" : "Let's Encrypt V2 Staging",
      "url" : "https://acme-staging-v02.api.letsencrypt.org/directory"
   }
]

[/CODE]

 

[dcsapak]

does the javascript console show any errors ?

 

[arnolem]

does the javascript console show any errors ?

My account is not "root", I have an "administror" account with proxmox authentication.

 

[dcsapak]

yes currently the certificate management is root only, but we will probably change that in the future

 

[Kmgish]

Are there plans to support the DNS challenge option?

 

[dcsapak]

Are there plans to support the DNS challenge option?

plans yes, but no code yet

 

[Kmgish]

plans yes, but no code yet

Thank you.

 

[elkato]

Thank you.

+ for DNS challenge...
I hope we can have it soon too

 

[Ansy]

as the docs state, for LE to work you need to fulfill the following pre-requisites:

1. Port 80 of the node needs to be reachable from the internet.
   
   
2. There must be no other listener on port 80.
   
   
3. The requested (sub)domain needs to resolve to a public IP of the Node.
   
   
4. You have to accept the ToS of Let’s Encrypt.

Well, but I'm port forwarding 80/TCP to my VMs, so I can't update certificate this way seamlessly.
Can I register only AAAA-record for host name with only IPv6 listening port 80 to get LE certificate?

 

[fabian]

in this case you either need to forward port 80 back again to the host for the acme validation subdomains, or wait for DNS challenge support in PVE, or use a third-party ACME client.