Closed marcelser closed 3 years ago
turns out that nginx the request I saw in the logs was from acme.sh (locally) but the external request of letsencrypt always got a 401 Unauthorized because there was a wrong firewall rule sending external traffic directly to web server instead of nginx which should forward the traffic and also handle letsencrypt.
Got an e-mail from certbot that my certificates are expiring in 20 days. I checked and found out that somehow the acme cronjob got lost and therefore it was not auto renewing anymore.
So I upgraded acme.sh to latest version and tried to renew my certs but I always get a verify error
shadowsrealm.ch:Verify error:Invalid response from http://shadowsrealm.ch/.well-known/acme-challenge/_upRZQYePlSUUDEw3YxYpEJSCqIhL3HzIyNRc9o4jjk [178.83.24.132]:
But when I look into the nginx log the file is properly served see access.log and no errors in error.log:
178.83.24.132 - - [30/Mar/2021:15:11:28 +0200] "GET /.well-known/acme-challenge/_upRZQYePlSUUDEw3YxYpEJSCqIhL3HzIyNRc9o4jjk HTTP/1.1" 200 87 "-" "acme.sh/2.8.9 (https://github.com/acmesh-official/acme.sh)"
I'm using this snippet which is included in each server block from your instructions for nginx added with no caching and allow all because your script makes the files challenge files owned by root:root but nginx is running under nouser nogroup:
When using debugging I can also query the file easily. In fact also you should be able to it like this one from the debugging with:
curl http://shadowsrealm.ch/.well-known/acme-challenge/_upRZQYePlSUUDEw3YxYpEJSCqIhL3HzIyNRc9o4jjk
So I'm completely lost what is the problem now. The only thing I know is that there were several firmware upgrades to the router which is running OpenWRT in between where probably some binaries have changed. But nevertheless I don't see what has changed now also not from the logs that it's not working anymore. If the file is created and serverd what's the problem? I'm completely lost atm.
Steps to reproduce
./acme.sh --renew --domain shadowsrealm.ch --debug 2
Debug log