Closed OdyX closed 7 years ago
Neilpang
commented
7 years ago it seems you are connecting to letsencrypt CA on ipv6 network.
== Info: Connection #0 to host acme-staging.api.letsencrypt.org left intact
[Tue May 16 10:53:05 CEST 2017] _ret='52'curl returns error code 52 : Please refer to https://curl.haxx.se/libcurl/c/libcurl-errors.html for error code: 52
Can you please try:
curl -vv https://acme-staging.api.letsencrypt.org
OdyX
commented
7 years ago Here's what it gives:
curl -vv https://acme-staging.api.letsencrypt.org
* Rebuilt URL to: https://acme-staging.api.letsencrypt.org/
* Trying 2a02:26f0:3000:197::3d5...
* TCP_NODELAY set
* Connected to acme-staging.api.letsencrypt.org (2a02:26f0:3000:197::3d5) port 443 (#0)
* Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH
* successfully set certificate verify locations:
* CAfile: /usr/local/share/certs/ca-root-nss.crt
CApath: none
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
* TLSv1.2 (IN), TLS handshake, Server hello (2):
* NPN, negotiated HTTP1.1
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
* TLSv1.2 (IN), TLS handshake, Server finished (14):
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.2 (OUT), TLS change cipher, Client hello (1):
* TLSv1.2 (OUT), TLS handshake, Unknown (67):
* TLSv1.2 (OUT), TLS handshake, Finished (20):
* TLSv1.2 (IN), TLS change cipher, Client hello (1):
* TLSv1.2 (IN), TLS handshake, Finished (20):
* SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384
* Server certificate:
* subject: CN=*.api.letsencrypt.org; O=INTERNET SECURITY RESEARCH GROUP; L=Mountain View; ST=California; C=US
* start date: Jun 26 17:05:45 2015 GMT
* expire date: Jun 25 17:05:45 2018 GMT
* subjectAltName: host "acme-staging.api.letsencrypt.org" matched cert's "*.api.letsencrypt.org"
* issuer: C=US; O=IdenTrust; OU=TrustID Server; CN=TrustID Server CA A52
* SSL certificate verify ok.
> GET / HTTP/1.1
> Host: acme-staging.api.letsencrypt.org
> User-Agent: curl/7.54.0
> Accept: */*
>
< HTTP/1.1 200 OK
< Server: nginx
< Content-Type: text/html
< Content-Length: 2183
< Last-Modified: Thu, 10 Sep 2015 21:07:14 GMT
< ETag: "55f1f102-887"
< X-Frame-Options: DENY
< Strict-Transport-Security: max-age=604800
< Accept-Ranges: bytes
< Expires: Wed, 17 May 2017 05:39:32 GMT
< Cache-Control: max-age=0, no-cache, no-store
< Pragma: no-cache
< Date: Wed, 17 May 2017 05:39:32 GMT
< Connection: keep-alive
<
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8">
<meta http-equiv="X-UA-Compatible" content="IE=edge">
<meta name="viewport" content=
"width=device-width, initial-scale=1">
<title>Boulder: The Let's Encrypt CA</title>
<link href=
"//maxcdn.bootstrapcdn.com/bootstrap/3.2.0/css/bootstrap.min.css"
rel="stylesheet" type="text/css">
<link href=
"//maxcdn.bootstrapcdn.com/font-awesome/4.2.0/css/font-awesome.min.css"
rel="stylesheet" type="text/css">
</head>
<body>
<div class="container-fluid">
<div class="row">
<div class="col-xs-6 text-right">
<p style="font-size: 90px;">
<i class="fa fa-barcode"></i></p>
</div>
<div class="col-xs-6 text-left">
<h1>Boulder<br>
<small>The Let's Encrypt CA</small></h1>
</div>
</div>
<div class="row">
<div class="col-xs-8 col-xs-offset-2 text-center">
<h3>This is an <a href="https://github.com/letsencrypt/acme-spec/">ACME</a> Certificate Authority running <a href="https://github.com/letsencrypt/boulder">Boulder</a>.</h3>
<p>This is a <em>programmatic</em> endpoint, an API for a computer to talk to. You should probably be using a specialized client to utilize the service, and not your web browser. See <a href="https://letsencrypt.org/"><tt>https://letsencrypt.org/</tt></a> for help.</p>
<p>If you're trying to use this service, note that the starting point, <em>the directory</em>, is available at this URL: <a href="https://acme-staging.api.letsencrypt.org/directory"><tt>https://acme-staging.api.letsencrypt.org/directory</a></tt>.</p>
</div>
</div>
<div class="row">
<div class="col-xs-4 col-xs-offset-2 text-center">
<p><a href="https://letsencrypt.status.io" title="Twitter">
<i class="fa fa-area-chart"></i>
Service Status (letsencrypt.status.io)
</a></p>
</div>
<div class="col-xs-4 text-center">
<p><a href="https://twitter.com/letsencrypt" title="Twitter">
<i class="fa fa-twitter"></i>
Check with us on Twitter
</a></p>
</div>
</div> <!-- row -->
</div>
</body>
</html>
* Connection #0 to host acme-staging.api.letsencrypt.org left intactIndeed. Adding -4 in the _ACME_CURL definition makes the script work fine !
acme.sh should really cope with IPv6 networks though. I stay at your disposal for any debugging if you need!
Neilpang
commented
7 years ago I just tried on my ipv6 server, it seems working. How is are you doing now? Is it working for you now ?
Steps to reproduce
0.1.16package on a pfsense version2.3.4-RELEASEcurl 7.54.0 (i386-portbld-freebsd10.3) libcurl/7.54.0 OpenSSL/1.0.1s zlib/1.2.8 nghttp2/1.21.0I have tried to hack around curl options in the script, but without success.
Debug log
Ideas
_H5="Expect:"line in the_postfunction, the scripts goes further, but it then fails when updating the account, because_accUriis undefined, see:At your disposal for any help!