Lets Encrypt fehler : response='{"type":"urn:acme:error:malformed","detail":"Una

[choffmeister]

HAllo, ich schlage mich schon seit tagen damit rum und versuche Lets Encrypt mit HA Proxy zum laufen zu bekommen, scheitere jedoch ständig an folgendem Fehler :

Date   Message
[Mon Dec 24 04:50:59 CST 2018]   code='400'
[Mon Dec 24 04:50:59 CST 2018]   response='{"type":"urn:acme:error:malformed","detail":"Unable to update challenge :: authorization must be pending","status": 400}'
Date: Mon, 24 Dec 2018 10:50:59   GMT
Expires: Mon, 24 Dec 2018 10:50:59   GMT
Expires: Mon, 24 Dec 2018 10:50:59   GMT
[Mon Dec 24 04:50:59 CST 2018]   responseHeaders='HTTP/1.1 100 Continue
"detail": "Unable to update challenge   :: authorization must be pending",
[Mon Dec 24 04:50:59 CST 2018]   original='{
[Mon Dec 24 04:50:59 CST 2018]   _ret='0'
[Mon Dec 24 04:50:59 CST 2018]   _CURL='curl -L --silent --dump-header /var/etc/acme-client/home/http.header -g '
[Mon Dec 24 04:50:59 CST 2018]   _postContentType
[Mon Dec 24 04:50:59 CST 2018]   body='{"header": {"alg": "RS256", "jwk": {"e": "AQAB", "kty": "RSA", "n": "tktzZVVlkWQgOBysjviSosxnxCUVEWsqdii-hi-kKDUhfidz0n5F5kqaiu4V47SFlts7gaYbe8GdPJHQGiLUCNSCbBRlZeLInNZPUvgDFLdU-YbyDZhOtev_uuPChg3HK6T2whQpZgUE9asFd-lsgvgljDUjb4jKs6iV9Oe-qKW7W5gmMNTt-XJK6muTMSm-8hK6JA08KGtbiE_nUWxfRgd-MqqRn7NvW1Lt9pTM3E0ejA0vXPUVXMcyeD-Yt8QhT8gaNx5LK-UhEKtn_PJ74kPxntczPfHohf2PGmwz5GHLtjj0f8r9FB05LwLt_JH4aXFx42fgh6WoZ765vpzzRt9gn0HcxYIGY8UwzSdo8j0ebswmBhQFpVK_UTYPMlBXpqhcMfg3ua44q9RknGTZHPj8dlopAc3otdBar4Jt2iMwWC2UvEA1BoyZcummIoMVimqhiuy5RbdjIe8FRI5CSXAuVdW2bZJ-zyDsypJY1BUtFSW69sOGR-uveLTpp4KTrEYPZQBEYJQNkLt_GDllUY-DGpO54Sad4iJIu5AmdC99gjmUA1rsJDR7NIEGF-WQp_e4xTyFxLxuhrzC4yeyfb03QfVTBjlPLX6u0vWvC75YZN-iovk7GBYEETy4DAq9yKo3oYaV7xdv-0mJtw38udNoK5MdPxdtsZeCmDznCPs"}}, "protected": "eyJub25jZSI6ICJGSFpqdnB6UFlFd2pHNmlkc1dwZ3dmSmp0ZlJVeW94VXdIZHBUZWhlR3NZIiwgInVybCI6ICJodHRwczovL2FjbWUtc3RhZ2luZy5hcGkubGV0c2VuY3J5cHQub3JnL2FjbWUvY2hhbGxlbmdlL00tcG5ULUlqRXRCa3IzRU5pS1hBVkkteHZNTDY0VDBXVk1lN2h0QjluRW8vMjEyNzEwNjA3IiwgImFsZyI6ICJSUzI1NiIsICJqd2siOiB7ImUiOiAiQVFBQiIsICJrdHkiOiAiUlNBIiwgIm4iOiAidGt0elpWVmxrV1FnT0J5c2p2aVNvc3hueENVVkVXc3FkaWktaGkta0tEVWhmaWR6MG41RjVrcWFpdTRWNDdTRmx0czdnYVliZThHZFBKSFFHaUxVQ05TQ2JCUmxaZUxJbk5aUFV2Z0RGTGRVLVlieURaaE90ZXZfdXVQQ2hnM0hLNlQyd2hRcFpnVUU5YXNGZC1sc2d2Z2xqRFVqYjRqS3M2aVY5T2UtcUtXN1c1Z21NTlR0LVhKSzZtdVRNU20tOGhLNkpBMDhLR3RiaUVfblVXeGZSZ2QtTXFxUm43TnZXMUx0OXBUTTNFMGVqQTB2WFBVVlhNY3llRC1ZdDhRaFQ4Z2FOeDVMSy1VaEVLdG5fUEo3NGtQeG50Y3pQZkhvaGYyUEdtd3o1R0hMdGpqMGY4cjlGQjA1THdMdF9KSDRhWEZ4NDJmZ2g2V29aNzY1dnB6elJ0OWduMEhjeFlJR1k4VXd6U2RvOGowZWJzd21CaFFGcFZLX1VUWVBNbEJYcHFoY01mZzN1YTQ0cTlSa25HVFpIUGo4ZGxvcEFjM290ZEJhcjRKdDJpTXdXQzJVdkVBMUJveVpjdW1tSW9NVmltcWhpdXk1UmJkakllOEZSSTVDU1hBdVZkVzJiWkotenlEc3lwSlkxQlV0RlNXNjlzT0dSLXV2ZUxUcHA0S1RyRVlQWlFCRVlKUU5rTHRfR0RsbFVZLURHcE81NFNhZDRpSkl1NUFtZEM5OWdqbVVBMXJzSkRSN05JRUdGLVdRcF9lNHhUeUZ4THh1aHJ6QzR5ZXlmYjAzUWZWVEJqbFBMWDZ1MHZXdkM3NVlaTi1pb3ZrN0dCWUVFVHk0REFxOXlLbzNvWWFWN3hkdi0wbUp0dzM4dWROb0s1TWRQeGR0c1plQ21Eem5DUHMifX0", "payload": "eyJyZXNvdXJjZSI6ICJjaGFsbGVuZ2UiLCAia2V5QXV0aG9yaXphdGlvbiI6ICJYbjdyZGZ4UTk5ank3MWxqeU8xRUhCZHFqVEhNMUU0RkY0Q2pzbU1WS29NLjdDXzFMVXc3WExGUFpfekdxVXB6aWNmNEFMbkJ2cTJHc1MzR0pmbnBGUmMifQ", "signature": "H9ySbDDHt1CZ4HLHhlNNbS0ZxdrXxs4mOPBZMyGiTmyEvcyd4mT-6SYczNzF7wgu9HHfkBHaE7Jee3jsqYfUdl3ZN_3JLQ5RvxZRoIyXkJdjlqGenv61vsGoLVQcW-hqS1PYufm-Lf_s7jR53E3TBMVLQx2cSL480gzRG7ojiM-qUoSO6hhaC1ENJ8ztaimRzwm_lBEBJ-8go4pBUtdJ4dC_ksCrzEf2fZZCVXr23p6jvEyAEXQ74dtiPBe4UAaqU96o7wH4J3U8C6qZ1nGceCDfbfwQSDn7zXkENBoUOyW0rQQv5Ibu7lxYcoVzpG51EEPU0rODhBMJrK4TL99jov8eio1e04_BcGXiClM8pWuG6zMntD5WHvW6smsmlQLtUpcw-wB1wKsGB7IZ8fVMcJvWPoCplePNYil6pi9Al_oGj-14N9lwAaRwfhFEUZ1Rbf-jp-GXNSO4w2CepWfK_UCXqRVHeyUaOKeGzpQy8PG3HOG2Tu88H6f42NkrYxQGQLGh_Y_5CK2pr_OHxxzscZi_34Ng_wu0TmFuXUADCt5lC-6zvryA8m4DvB3AjYXfV2woz9m_GIpkGi4NJtkIcScPMI6YjYUsczRQEHyTL9VLdAXhCm9kcEmaIU893MmZyppgbxrGdeGiAkCDhZNS3vVfks-TbKuvu1wmgOl4WRs"}'
[Mon Dec 24 04:50:59 CST 2018]   _post_url='https://acme-staging.api.letsencrypt.org/acme/challenge/M-pnT-IjEtBkr3ENiKXAVI-xvML64T0WVMe7htB9nEo/212710607'
[Mon Dec 24 04:50:59 CST 2018]   POST
[Mon Dec 24 04:50:59 CST 2018]   nonce='FHZjvpzPYEwjG6idsWpgwfJjtfRUyoxUwHdpTeheGsY'
[Mon Dec 24 04:50:59 CST 2018]   Use _CACHED_NONCE='FHZjvpzPYEwjG6idsWpgwfJjtfRUyoxUwHdpTeheGsY'
[Mon Dec 24 04:50:59 CST 2018]   Use cached jwk for file: /var/etc/acme-client/accounts/5c2004eb9eaf27.16007696/account.key
[Mon Dec 24 04:50:59 CST 2018]   payload='{"resource": "challenge", "keyAuthorization": "Xn7rdfxQ99jy71ljyO1EHBdqjTHM1E4FF4CjsmMVKoM.7C_1LUw7XLFPZ_zGqUpzicf4ALnBvq2GsS3GJfnpFRc"}'
[Mon Dec 24 04:50:59 CST 2018]   url='https://acme-staging.api.letsencrypt.org/acme/challenge/M-pnT-IjEtBkr3ENiKXAVI-xvML64T0WVMe7htB9nEo/212710607'
[Mon Dec 24 04:50:59 CST 2018]   _t_key_authz='Xn7rdfxQ99jy71ljyO1EHBdqjTHM1E4FF4CjsmMVKoM.7C_1LUw7XLFPZ_zGqUpzicf4ALnBvq2GsS3GJfnpFRc'
[Mon Dec 24 04:50:59 CST 2018]   _t_url='https://acme-staging.api.letsencrypt.org/acme/challenge/M-pnT-IjEtBkr3ENiKXAVI-xvML64T0WVMe7htB9nEo/212710607'
[Mon Dec 24 04:50:59 CST 2018]   tigger domain validation.
[Mon Dec 24 04:50:59 CST 2018]   code='400'
[Mon Dec 24 04:50:59 CST 2018]   response='{"type":"urn:acme:error:malformed","detail":"Unable to update challenge :: authorization must be pending","status": 400}'
Date: Mon, 24 Dec 2018 10:50:59   GMT
Expires: Mon, 24 Dec 2018 10:50:59   GMT

[choffmeister]

Habe den Fehler nun selber gefunden,

1) Zu einem mag es lets encrypt nicht wenn auf der zu hörenden IP eine one-to-one Nat ist
2) IP v6 sollte man abschalten oder konfigurieren mit den Namen die im Zertifikat aufgelöst werden.
( habe es mir einfach gemacht und einfach IPv6 over DHCP auf der WAN abgeschaltet )
3) zum Schluss kam noch der Fehler

new-authz error: {"type":"urn:acme:error:unauthorized","detail":"No registration exists matching provided key","status": 403}

welchen ich dadurch gelöst habe das ich den Account in der pfsense unter /var/etc/acme-client/accounts gelöscht habe.