acme not working anymore (since 21 Dec 2023)

[Fright]

@ Hi
Hm
I tried it on 24.1 (with a small HttpOpnsense.php-patch (pr#3813) to get the interface address, but this is not your case if the address is already displayed in the log) - everything works as expected ..

I have it disabled already. Since a long time ago.

but something still redirects token request to https?

Code Select Expand

Fetching https://example.com/.well-known/acme-challenge/EREIaZNm_HFsxaz64fDfizrzUVKeGQ_0CPtkZYHmEmE: Timeout during connect

[muchacha_grande]

The interface address has been got correctly, I just obfuscated that.

Before switching to DNS-01 challenge I tried to renew the certificates a couple of times and I could see the requests on Nginx log. Then Nginx responded with a 302 code. I could not see the details of the response but the log showed a 302 code (temporary redirection).

[Fright]

ah. so the initial request is processed by nginx..
Probably "HTTPS Only" is set in the server settings in nginx.
the request is redirected to HTTPS (with 302 code).
then, if the "Enable Let's Encrypt Plugin Support" server settings are enabled, the request for /.well-known/acme-challenge/* should be sent to the acme lighttpd instance (https://github.com/opnsense/plugins/blob/cab29219d7fb43bc77bbffd8224a8a2cddb59b22/www/nginx/src/opnsense/service/templates/OPNsense/Nginx/http.conf#L253-L260).
there must be something more in the logs (access or errors) on nginx

[muchacha_grande]

@Fright, I tried to renew a certificate using HTTP-01 to catch the logs and look for clues based on your advice, but ACME skipped the HTTP-01 verification because the domain is already verified, so I couldn't see the complete process.

[MarekWojtaszek]

Same issue here :(
I can't even register any new certificate with the same challenge - I am getting the same errors.

Anybody?
Marek

[MarekWojtaszek]

Here is what I see in my syslog and what started in Dec 2023:



Any suggestion on how to troubleshoot would be greatly appreciated.
Marek

[ilfalti]

Hi, problem solved with 24.1.2
(os-acme-client 4.1)