search

dokku / dokku-letsencrypt

Automatic Let's Encrypt TLS Certificate installation for dokku
https://blog.semicolonsoftware.de/securing-dokku-with-lets-encrypt-tls-certificates/
MIT License
1.09k stars 93 forks source link

CA marked some of the authorizations as invalid #200

Closed isakemanuel closed 3 years ago

isakemanuel commented 4 years ago

Description of problem

I get an error when attempting to obtain a TLS certificate.

CA marked some of the authorizations as invalid, which likely means it could not access http://example.com/.well-known/acme-challenge/X. Did you set correct path in -d example.com:path or --default_root? Are all your domains accessible from the internet? Please check your domains' DNS entries, your host's network/firewall setup and your webserver config. If a domain's DNS entry has both A and AAAA fields set up, some CAs such as Let's Encrypt will perform the challenge validation over IPv6. If your DNS provider does not answer correctly to CAA records request, Let's Encrypt won't issue a certificate for your domain (see https://letsencrypt.org/docs/caa/). Failing authorizations: https://acme-staging-v02.api.letsencrypt.org/acme/authz-v3/47734052
Challenge validation has failed, see error log.

How reproducible

I've attempted this twice with a fresh server using the Ubuntu Dokku 0.17.9 on 18.04 image on DigitalOcean.

Steps to Reproduce

  1. Clone heroku/ruby-getting-started repository
  2. Deploy to Dokku
  3. Run dokku domains:add-global dokku.enberg.io
  4. dokku domains:set ruby-getting-started rubygettingstarted.dokku.enberg.io
  5. Access rubygettingstarted.dokku.enberg.io via browser (works)
  6. Run dokku letsencrypt ruby-getting-started

Actual Results

=====> Let's Encrypt ruby-getting-started
-----> Updating letsencrypt docker image...
0.1.0: Pulling from dokku/letsencrypt
Digest: sha256:af5f8529c407645e97821ad28eba328f4c59b83b2141334f899303c49fc07823
Status: Image is up to date for dokku/letsencrypt:0.1.0
docker.io/dokku/letsencrypt:0.1.0
       Done updating
-----> Enabling ACME proxy for ruby-getting-started...
[ ok ] Reloading nginx configuration (via systemctl): nginx.service.
-----> Getting letsencrypt certificate for ruby-getting-started...
        - Domain 'rubygettingstarted.dokku.enberg.io'
darkhttpd/1.12, copyright (c) 2003-2016 Emil Mikulic.
listening on: http://0.0.0.0:80/
2020-04-06 09:56:54,239:INFO:__main__:1406: Generating new certificate private key
2020-04-06 09:56:56,704:ERROR:__main__:1388: CA marked some of the authorizations as invalid, which likely means it could not access http://example.com/.well-known/acme-challenge/X. Did you set correct path in -d example.com:path or --default_root? Are all your domains accessible from the internet? Please check your domains' DNS entries, your host's network/firewall setup and your webserver config. If a domain's DNS entry has both A and AAAA fields set up, some CAs such as Let's Encrypt will perform the challenge validation over IPv6. If your DNS provider does not answer correctly to CAA records request, Let's Encrypt won't issue a certificate for your domain (see https://letsencrypt.org/docs/caa/). Failing authorizations: https://acme-staging-v02.api.letsencrypt.org/acme/authz-v3/47731403
Challenge validation has failed, see error log.

Debugging tips: -v improves output verbosity. Help is available under --help.
-----> Certificate retrieval failed!
-----> Disabling ACME proxy for ruby-getting-started...
[ ok ] Reloading nginx configuration (via systemctl): nginx.service.
       done

Expected Results

Successfully obtaining a TLS certificate

Environment Information

Ubuntu Dokku 0.17.9 on 18.04 1 vCPUs 1GB / 25GB Disk

dokku report ruby-getting-started output

-----> uname: Linux dokku-1 4.15.0-52-generic #56-Ubuntu SMP Tue Jun 4 22:49:08 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux
-----> memory: 
                     total        used        free      shared  buff/cache   available
       Mem:            985         476         144          11         364         355
       Swap:             0           0           0
-----> docker version: 
       Client: Docker Engine - Community
        Version:           19.03.8
        API version:       1.40
        Go version:        go1.12.17
        Git commit:        afacb8b7f0
        Built:             Wed Mar 11 01:25:46 2020
        OS/Arch:           linux/amd64
        Experimental:      false

       Server: Docker Engine - Community
        Engine:
         Version:          19.03.8
         API version:      1.40 (minimum version 1.12)
         Go version:       go1.12.17
         Git commit:       afacb8b7f0
         Built:            Wed Mar 11 01:24:19 2020
         OS/Arch:          linux/amd64
         Experimental:     false
        containerd:
         Version:          1.2.13
         GitCommit:        7ad184331fa3e55e52b890ea95e65ba581ae3429
        runc:
         Version:          1.0.0-rc10
         GitCommit:        dc9208a3303feef5b3839f4323d9beb36df0a9dd
        docker-init:
         Version:          0.18.0
         GitCommit:        fec3683
-----> docker daemon info: 
       Client:
        Debug Mode: true

       Server:
        Containers: 21
         Running: 3
         Paused: 0
         Stopped: 18
        Images: 30
        Server Version: 19.03.8
        Storage Driver: overlay2
         Backing Filesystem: <unknown>
         Supports d_type: true
         Native Overlay Diff: true
        Logging Driver: json-file
        Cgroup Driver: cgroupfs
        Plugins:
         Volume: local
         Network: bridge host ipvlan macvlan null overlay
         Log: awslogs fluentd gcplogs gelf journald json-file local logentries splunk syslog
        Swarm: inactive
        Runtimes: runc
        Default Runtime: runc
        Init Binary: docker-init
        containerd version: 7ad184331fa3e55e52b890ea95e65ba581ae3429
        runc version: dc9208a3303feef5b3839f4323d9beb36df0a9dd
        init version: fec3683
        Security Options:
         apparmor
         seccomp
          Profile: default
        Kernel Version: 4.15.0-52-generic
        Operating System: Ubuntu 18.04.4 LTS
        OSType: linux
        Architecture: x86_64
        CPUs: 1
        Total Memory: 985.5MiB
        Name: dokku-1
        ID: IZIC:3KS3:W2XL:RPJL:JMSB:SQW7:BHNN:OANI:YR2G:BXK6:TXY7:YRW2
        Docker Root Dir: /var/lib/docker
        Debug Mode: false
        Registry: https://index.docker.io/v1/
        Labels:
        Experimental: false
        Insecure Registries:
         127.0.0.0/8
        Live Restore Enabled: false

-----> sigil version: 0.5.0
-----> herokuish version: 
       herokuish: 0.5.11
       buildpacks:
         heroku-buildpack-multi     v1.0.0
         heroku-buildpack-ruby      v214
         heroku-buildpack-nodejs    v170
         heroku-buildpack-clojure   v84
         heroku-buildpack-python    v167
         heroku-buildpack-java      v66
         heroku-buildpack-gradle    v31
         heroku-buildpack-scala     v87
         heroku-buildpack-play      v26
         heroku-buildpack-php       v173
         heroku-buildpack-go        v139
         buildpack-nginx            v12
-----> dokku version: dokku version 0.20.2
-----> dokku plugins: 
       plugn: 0.3.2
         00_dokku-standard    0.20.2 enabled    dokku core standard plugin
         20_events            0.20.2 enabled    dokku core events logging plugin
         app-json             0.20.2 enabled    dokku core app-json plugin
         apps                 0.20.2 enabled    dokku core apps plugin
         builder-dockerfile   0.20.2 enabled    dokku core builder-dockerfile plugin
         builder-herokuish    0.20.2 enabled    dokku core builder-herokuish plugin
         buildpacks           0.20.2 enabled    dokku core buildpacks plugin
         certs                0.20.2 enabled    dokku core certificate management plugin
         checks               0.20.2 enabled    dokku core checks plugin
         common               0.20.2 enabled    dokku core common plugin
         config               0.20.2 enabled    dokku core config plugin
         docker-options       0.20.2 enabled    dokku core docker-options plugin
         domains              0.20.2 enabled    dokku core domains plugin
         enter                0.20.2 enabled    dokku core enter plugin
         git                  0.20.2 enabled    dokku core git plugin
         letsencrypt          0.9.3 enabled    Automated installation of let's encrypt TLS certificates
         logs                 0.20.2 enabled    dokku core logs plugin
         network              0.20.2 enabled    dokku core network plugin
         nginx-vhosts         0.20.2 enabled    dokku core nginx-vhosts plugin
         plugin               0.20.2 enabled    dokku core plugin plugin
         postgres             1.11.2 enabled    dokku postgres service plugin
         proxy                0.20.2 enabled    dokku core proxy plugin
         ps                   0.20.2 enabled    dokku core ps plugin
         repo                 0.20.2 enabled    dokku core repo plugin
         resource             0.20.2 enabled    dokku core resource plugin
         scheduler-docker-local 0.20.2 enabled    dokku core scheduler-docker-local plugin
         shell                0.20.2 enabled    dokku core shell plugin
         ssh-keys             0.20.2 enabled    dokku core ssh-keys plugin
         storage              0.20.2 enabled    dokku core storage plugin
         tags                 0.20.2 enabled    dokku core tags plugin
         tar                  0.20.2 enabled    dokku core tar plugin
         trace                0.20.2 enabled    dokku core trace plugin
=====> ruby-getting-started app information
       App deploy source:             
       App dir:                       /home/dokku/ruby-getting-started
       App locked:                    false
=====> ruby-getting-started buildpacks information
       Buildpacks list:               
=====> ruby-getting-started ssl information
       Ssl dir:                       /home/dokku/ruby-getting-started/tls
       Ssl enabled:                   false                    
       Ssl hostnames:                                          
       Ssl expires at:                                         
       Ssl issuer:                                             
       Ssl starts at:                                          
       Ssl subject:                                            
       Ssl verified:                                           
=====> ruby-getting-started checks information
       Checks disabled list:          none                     
       Checks skipped list:           none                     
=====> ruby-getting-started docker options information
       Docker options build:          --link dokku.postgres.railsdatabase:dokku-postgres-railsdatabase 
       Docker options deploy:         --link dokku.postgres.railsdatabase:dokku-postgres-railsdatabase --restart=on-failure:10 
       Docker options run:            --link dokku.postgres.railsdatabase:dokku-postgres-railsdatabase 
=====> ruby-getting-started domains information
       Domains app enabled:           true                     
       Domains app vhosts:            rubygettingstarted.dokku.enberg.io
       Domains global enabled:        true                     
       Domains global vhosts:         dokku.enberg.io          
=====> ruby-getting-started git information
       Git deploy branch:             master                   
       Git global deploy branch:      master                   
       Git keep git dir:              false                    
       Git rev env var:               GIT_REV                  
       Git sha:                       9ddca7b                  
=====> ruby-getting-started network information
       Network attach post create:    
       Network attach post deploy:    
       Network bind all interfaces:   false
       Network web listeners:         172.17.0.4:5000
=====> ruby-getting-started nginx information
       Nginx access log path:         /var/log/nginx/ruby-getting-started-access.log
       Nginx bind address ipv4:                                
       Nginx bind address ipv6:       ::                       
       Nginx error log path:          /var/log/nginx/ruby-getting-started-error.log
       Nginx hsts:                    true                     
       Nginx hsts include subdomains: true                     
       Nginx hsts max age:            15724800                 
       Nginx hsts preload:            false                    
=====> ruby-getting-started proxy information
       Proxy enabled:                 true
       Proxy port map:                http:80:5000
       Proxy type:                    nginx
=====> ruby-getting-started ps information
       Processes:                     1                        
       Deployed:                      true                     
       Running:                       true                     
       Restore:                       true                     
       Restart policy:                on-failure:10            
       Ps can scale:                  true                     
       Status web.1:                  running    (CID: f44e5d800ba3)
=====> ruby-getting-started scheduler-docker-local information
       Scheduler docker local disable chown:                          
=====> ruby-getting-started storage information
       Storage build mounts:                                   
       Storage deploy mounts:                                  
       Storage run mounts:                                     
root@dokku-1:~#

How (deb/make/rpm) and where (AWS, VirtualBox, physical, etc.) was Dokku installed?:

Installed Dokku with the Dokku image available on DigitalOcean (Ubuntu Dokku 0.17.9 on 18.04).

Additional information

}

upstream ruby-getting-started-5000 {

server 172.17.0.4:5000; }

- Link to the exact repository being deployed (if possible/applicable):
https://github.com/heroku/ruby-getting-started

- Output of failing Dokku commands after running `dokku trace:on`
  (BEWARE: `trace:on` will print environment variables for some commands, be sure you're not exposing any sensitive information when posting issues. You may replace these values with XXXXXX):

Debugging tips: -v improves output verbosity. Help is available under --help.

decentral1se commented 4 years ago

You configured your domains after you deployed your app? You may need to re-deploy? I am reading from your steps you mentioned there... otherwise not sure what it might be... you might want to check your nginx config as well?

isakemanuel commented 4 years ago

I've ran both dokku ps:restart ruby-getting-started and dokku ps:rebuild ruby-getting-started. I've pasted the nginx config in the main issue, but I don't see what is wrong with it. I am able to access the app from my web browser, and if I try to access http://rubygettingstarted.dokku.enberg.io/.well-known/acme-challenge/ while running the command I'm presented with this.

Screenshot 2020-04-06 at 14 03 30
fmvilas commented 4 years ago

@isakemanuel In case it helps, I was having the same problem and managed to fix it by rebuilding the app (dokku ps:rebuild myapp) and setting the ports again (dokku proxy:ports-add myapp http:80:5000).

glennpjones commented 4 years ago

I was getting the same error. Apparently an extra domain was added to the application. I found out by following the final link in the error message:

2020-05-01 13:40:56,296:ERROR:__main__:1388: CA marked some of the authorizations as invalid, which likely means it could not access http://example.com/.well-known/acme-challenge/X. Did you set correct path in -d example.com:path or --default_root? Are all your domains accessible from the internet? Please check your domains' DNS entries, your host's network/firewall setup and your webserver config. If a domain's DNS entry has both A and AAAA fields set up, some CAs such as Let's Encrypt will perform the challenge validation over IPv6. If your DNS provider does not answer correctly to CAA records request, Let's Encrypt won't issue a certificate for your domain (see https://letsencrypt.org/docs/caa/). Failing authorizations: https://acme-v02.api.letsencrypt.org/acme/authz-v3/<SOME_UNIQUE_ID>

Then I could see that it was expecting a certain DNS record that didn't exist. Removing the invalid domain fixed it

boramalper commented 4 years ago

None of the above solutions has worked by me.

I have tried both what @fmvilas said and checked for extra/invlid domains as suggested by @glennpjones, and I still get the same error.

Logs

blog is a simple static website.

$ dokku letsencrypt:auto-renew blog
=====> Auto-renew blog...
=====> Let's Encrypt blog
-----> Updating letsencrypt docker image...
0.1.0: Pulling from dokku/letsencrypt
Digest: sha256:af5f8529c407645e97821ad28eba328f4c59b83b2141334f899303c49fc07823
Status: Image is up to date for dokku/letsencrypt:0.1.0
docker.io/dokku/letsencrypt:0.1.0
       Done updating
-----> Enabling ACME proxy for blog...
[ ok ] Reloading nginx configuration (via systemctl): nginx.service.
-----> Getting letsencrypt certificate for blog...
        - Domain 'blog.newsmail.today'
darkhttpd/1.12, copyright (c) 2003-2016 Emil Mikulic.
listening on: http://0.0.0.0:80/
2020-05-06 19:08:03,702:INFO:__main__:1406: Generating new certificate private key
2020-05-06 19:08:07,584:ERROR:__main__:1388: CA marked some of the authorizations as invalid, which likely means it could not access http://example.com/.well-known/acme-challenge/X. Did you set correct path in -d example.com:path or --default_root? Are all your domains accessible from the internet? Please check your domains' DNS entries, your host's network/firewall setup and your webserver config. If a domain's DNS entry has both A and AAAA fields set up, some CAs such as Let's Encrypt will perform the challenge validation over IPv6. If your DNS provider does not answer correctly to CAA records request, Let's Encrypt won't issue a certificate for your domain (see https://letsencrypt.org/docs/caa/). Failing authorizations: https://acme-v02.api.letsencrypt.org/acme/authz-v3/4408959755
Traceback (most recent call last):
  File "/simp_le/simp_le.py", line 1551, in main
    return main_with_exceptions(cli_args)
  File "/simp_le/simp_le.py", line 1535, in main_with_exceptions
    persist_new_data(args, existing_data)
  File "/simp_le/simp_le.py", line 1456, in persist_new_data
    chain=None,
  File "/simp_le/simp_le.py", line 1124, in persist_data
    plugin.save(new_data)
  File "/simp_le/simp_le.py", line 648, in save
    pems = [self.dump_cert(data.cert)]
  File "/simp_le/simp_le.py", line 468, in dump_cert
    return OpenSSL.crypto.dump_certificate(self.typ, data.wrapped).strip()
AttributeError: 'NoneType' object has no attribute 'wrapped'

Unhandled error has happened, traceback is above

Debugging tips: -v improves output verbosity. Help is available under --help.
-----> Certificate retrieval failed!
-----> Disabling ACME proxy for blog...
[ ok ] Reloading nginx configuration (via systemctl): nginx.service.
       done

Failing authorization: https://acme-v02.api.letsencrypt.org/acme/authz-v3/4408959755

My theory is that HTTP(S) requests are not forwarded to darkhttpd.

spieden commented 4 years ago

Everything checked out for me and yet still this error. I figured it was probably an issue in the zero downtime finery and decided to bypass it, which worked!

I temporarily replaced the Dockerfile for my app with one that looks like this (likely you'll need to have tried and failed to have the dokku/letsencrypt image available):

FROM dokku/letsencrypt
ENTRYPOINT []
EXPOSE 80
CMD sleep infinity

Note that the dokku proxy must be set up to use port 80. Mine incidentally did as my real image is on this port.

I added this option so the certs would be written to a volume:

dokku docker-options:add myapp deploy -v/host/storage/path/certs:/certs

After deploying this, I did docker exec -ti myapp.web.1 sh and ran (as cribbed from source of plugin):

/usr/local/bin/startme.sh -f account_key.json\
                          -f account_reg.json\
                          -f fullchain.pem\
                          -f chain.pem\
                          -f cert.pem\
                          -f key.pem\
                          -v\
                          -d mydomain.net

This succeeded and wrote out certs.

laurentlahmy commented 3 years ago

In my case (complete newbie) I wasn't redirecting dokuu-app-name.mydomain.com to my IP with an A record

Pay attention to the last sentence of the error log:

Failing authorizations: https://acme-v02.api.letsencrypt.org/acme/authz-v3/8757968021

Head there on Chrome and you can read the error json:

{
  "identifier": {
    "type": "dns",
    "value": "node-js-getting-started.mydomain.dev"
  },
  "status": "invalid",
  "expires": "2020-11-28T08:41:29Z",
  "challenges": [
    {
      "type": "http-01",
      "status": "invalid",
      "error": {
        "type": "urn:ietf:params:acme:error:dns",
        "detail": "DNS problem: NXDOMAIN looking up A for node-js-getting-started.mydomain.dev - check that a DNS record exists for this domain",
        "status": 400
      },
      "url": "https://acme-v02.api.letsencrypt.org/acme/chall-v3/8757968021/fF_LPQ",
      "token": "x9ByZ2ZJOAY-ewAsShFWIrZBEiS1SSLgbD1blB7RthE"
    }
  ]
}

The detail field is quite explanatory

"detail": "DNS problem: NXDOMAIN looking up A for node-js-getting-started.mydomain.dev - check that a DNS record exists for this domain",

reaper commented 3 years ago

I got the same issue but with the error message:

"error": {
    "type": "urn:ietf:params:acme:error:unauthorized",
    "detail": "Invalid response from http://example.com/.well-known/acme-challenge/xxxxxxxx [xxx]: \"\u003c!DOCTYPE html\u003e\\n\u003chtml\u003e\\n\u003chead\u003e\\n  \u003ctitle\u003eWe're sorry, but something went wrong (500)\u003c/title\u003e\\n  \u003cmeta name=\\\"viewport\\\" content=\\\"widt\"",
    "status": 403
}

We're sorry, but something went wrong (500) Seems that the reverse proxy is working but the server fails to serve the challenge. Anyone reproduced this issue too ? I use dokku as a docker container.

FYI it works when dokku is installed on the host, but I would use a container running dokku to avoid installing it on host... If someone can help me, that would be wonderful.

ThisIsJustUs commented 3 years ago

I've run into the same problem, this solved it for me. TL;DR you need to make sure your host port runs on 80

1. Check your host and container ports

You can do this by running the command dokku proxy:ports <YOUR APP>. This will return the ports like this

-----> Port mappings for <YOUR APP>
-----> scheme             host port                 container port
http                      8080                        5000

2. Set the host port to 80

You can do this by running the command dokku proxy:ports-set <YOUR APP> http:80:5000

This will set your host port to 80 while your container port remains 5000.

3. Verify the host port runs on 80

Again run command dokku proxy:ports <YOUR APP>. The port should then look like this:

-----> Port mappings for <YOUR APP>
-----> scheme             host port                 container port
http                      80                        5000

4. Rerun the dokku letsencrypt <YOUR APP> command

Hope that will help someone...

EyMaddis commented 3 years ago

This can also happen if you tried the dokku docker image https://hub.docker.com/r/dokku/dokku I am pretty sure this happens because the darkhttpd server is not accessible from the dokku instance. I was able to fix this for my apps by using the bridge mode for networks. For the darkhttpd service I did not manage this. I switched to directly installing dokku on the host machine.

gabrielhpugliese commented 3 years ago

I have tried to do what @ThisIsJustUs said but it does not work:

-----> Port mappings for [disclosed]
-----> scheme             host port                 container port
http                      80                        4000
Connection to [disclosed] closed.
=====> Let's Encrypt [disclosed]
-----> Updating letsencrypt docker image...
0.1.0: Pulling from dokku/letsencrypt
Digest: sha256:af5f8529c407645e97821ad28eba328f4c59b83b2141334f899303c49fc07823
Status: Image is up to date for dokku/letsencrypt:0.1.0
docker.io/dokku/letsencrypt:0.1.0
       Done updating
-----> Enabling ACME proxy for [disclosed]...
-----> Getting letsencrypt certificate for [disclosed]...
        - Domain '[disclosed]'
        - Domain '[disclosed]'
darkhttpd/1.12, copyright (c) 2003-2016 Emil Mikulic.
listening on: http://0.0.0.0:80/
2021-01-18 09:01:49,780:INFO:__main__:1406: Generating new certificate private key
2021-01-18 09:02:12,885:ERROR:__main__:1388: CA marked some of the authorizations as invalid, which likely means it could not access http://example.com/.well-known/acme-challenge/X. Did you set correct path in -d example.com:path or --default_root? Are all your domains ac
cessible from the internet? Please check your domains' DNS entries, your host's network/firewall setup and your webserver config. If a domain's DNS entry has both A and AAAA fields set up, some CAs such as Let's Encrypt will perform the challenge validation over IPv6. If
your DNS provider does not answer correctly to CAA records request, Let's Encrypt won't issue a certificate for your domain (see https://letsencrypt.org/docs/caa/). Failing authorizations: https://acme-v02.api.letsencrypt.org/acme/authz-v3/10166484299, https://acme-v02.ap
i.letsencrypt.org/acme/authz-v3/10166484300
Traceback (most recent call last):
  File "/simp_le/simp_le.py", line 1551, in main
    return main_with_exceptions(cli_args)
  File "/simp_le/simp_le.py", line 1535, in main_with_exceptions
    persist_new_data(args, existing_data)
  File "/simp_le/simp_le.py", line 1456, in persist_new_data
    chain=None,
  File "/simp_le/simp_le.py", line 1124, in persist_data
    plugin.save(new_data)
  File "/simp_le/simp_le.py", line 648, in save
    pems = [self.dump_cert(data.cert)]
  File "/simp_le/simp_le.py", line 468, in dump_cert
    return OpenSSL.crypto.dump_certificate(self.typ, data.wrapped).strip()
AttributeError: 'NoneType' object has no attribute 'wrapped'

Unhandled error has happened, traceback is above

Debugging tips: -v improves output verbosity. Help is available under --help.
-----> Certificate retrieval failed!
-----> Disabling ACME proxy for [disclosed]...
       done

Now I have been rate-limited by letsencrypt. Any other ideas around?

natanlao commented 3 years ago

@ThisIsJustUs's answer was helpful to me; in my case, my ports were configured oddly:

$ dokku proxy:ports $app
-----> Port mappings for $app
    -----> scheme  host port  container port
    http           443        443
    http           80         80
    https          443        80

I fixed the issue by removing the erroneous port mapping (i.e, dokku proxy:ports-remove $app http:443:443)

spieden commented 3 years ago

I struggled with this Dokku plugin for a while (also running in Docker), and eventually just started using certbot with the Route53 plugin and dokku certs:add. This works a charm:

~
❯ sudo -E certbot certonly --dns-route53 -d mydomain.net
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Found credentials in shared credentials file: ~/.aws/credentials
Plugins selected: Authenticator dns-route53, Installer None
Cert is due for renewal, auto-renewing...
Renewing an existing certificate for mydomain.net
...
 - Congratulations! Your certificate and chain have been saved at:
    /etc/letsencrypt/live/mydomain.net/fullchain.pem
...

/etc/letsencrypt/live/mydomain.net
❯ tar chf -\
      --transform='s|fullchain.pem|server.crt|'\
      --transform 's|privkey.pem|server.key|'\
      fullchain.pem privkey.pem\
  | docker exec -i dokku dokku certs:add my-app
server.crt
server.key
-----> Unsetting DOKKU_PROXY_SSL_PORT
-----> Setting config vars
       DOKKU_PROXY_PORT_MAP:  http:80:80
-----> Setting config vars
       DOKKU_PROXY_PORT_MAP:  http:80:80 https:443:80
-----> Configuring mydomain.net...(using built-in template)
-----> Creating https nginx.conf
       Enabling HSTS
       Reloading nginx
Freika commented 3 years ago

I got this issue and solved it by removing www.domain.com subdomain from the app. I left only domain.com and letsencrypt finally worked.

PieterScheffers commented 3 years ago

What worked for me was revoking the certificate and then generate a new one:

dokku letsencrypt:revoke <app>

dokku letsencrypt <app>
josegonzalez commented 3 years ago

This seems to currently be a catch-all issue. I'm going to close in favor of folks posting things more specific to their problems.