ACME, sftp upload - New Client not working (Solved)

[bensommer]

Hi
I use `acme` with HAProxy to distribute Let's Encrypt certificates via SFTP upload. This works without any issues on Ubuntu 22 clients, but it no longer works on versions 24 and 26. The certificates cannot be found on the client, even though I copied them exactly the same way as I did for Ubuntu 22. The same problem occurs with Debian 13. Does anyone have a working solution?

Regards Ben

[cookiemonster]

starting with some diagnostics? look for clues, logs, etc. Maybe some additional logging is needed somewhere to give those clues to try to figure out where is the failures, maybe on the sender, maybe on the receiver?

[keeka]

Check SSH manually from OPNsense to the respective hosts. Perhaps you're missing authorized hosts (opnsense) or public keys (ubuntu side). The keys and known_hosts used by acme automations are in /var/etc/acme-client/sftp-config/

[bensommer]

The problem was the opnsense. The ssh key was just inside /root/.ssh/known_hosts but not inside /var/etc/acme-client/sftp-config/known_hosts. After I copied the key manually, it worked with all Ubuntu Debian versions that had previously caused problems.

Regards Ben

[keeka]

The problem was the opnsense. The ssh key was just inside /root/.ssh/known_hosts but not inside /var/etc/acme-client/sftp-config/known_hosts. After I copied the key manually, it worked with all Ubuntu Debian versions that had previously caused problems.

Regards Ben

AIUI the connection test in the ACME automations page adds/updates these for you too.

[bensommer]

The connection test didn´t made it for me, that was the problem. Maybe I have this week some time to find out this behavior.