search

ibmjstart / bluemix-letsencrypt

Let's Encrypt wrapper for Cloud Foundry apps on IBM Bluemix
MIT License
36 stars 15 forks source link

Unable to clean up challenge directory #3

Closed d0liver closed 7 years ago

d0liver commented 8 years ago

I have been attempting to follow this guide: Securing Custom Domains with Let's Encrypt

When running python setup-app.py after:

  1. Installing dependencies pip install -r requirements.txt
  2. Configuring DNS (The guide suggests using CNAME to the Bluemix route but DreamHost seems to have issues doing url forwarding on unhosted domain names so forwarding omegaunicorn.com to www.omegaunicorn.com wasn't working and DreamHost wouldn't accept a CNAME for something other than a subdomain. Therefore, instead I did an nslookup on my deployed application on Bluemix and added A records for omegaunicorn.com and www.omegaunicorn.com using that ip to DreamHost. This seems to be fine.)
  3. Adding omegaunicorn.com to target org

The letsencrypt app (deployed successfully to Bluemix) times out waiting for certificates issuing the error: "It has been 1 minutes without seeing certificates issued in the log. Something probably went wrong. Please check the output of cf logs letsencrypt --recent for more information."

Following the advice, I check the output of cf logs letsencrypt --recent and the logs report Unable to clean up challenge directory /home/vcap/app/host/.well-known/acme-challenge

From there a FailedChallenges error is raised.

The domains.yml file is as follows:

{ "email": "david@doliver.org", "staging": false, "domains": [ { "domain": "omegaunicorn.com", "hosts": [ "www", "." ] } ] } I tracked the error down in the certbot source code also and all it's supposed to be doing is this: os.rmdir(root_path) so I guess there is some kind of permissions issue within the deployed letsencrypt app or maybe the folder wasn't created? I am able to visit the site with the existing DNS/Bluemix configuration so I assume that there is some issue with my domains.yml configuration or I have uncovered an error with this or some other source that this depends on.

lmsurpre commented 8 years ago

Thanks for the detailed report. This is definitely our bad. I think that everything is working and we're just checking in the wrong spot for confirmation of the certificates.

We'll get that fixed, but for now you can just swap the order of your hosts entries and it should work:

{ "email": "david@doliver.org", "staging": false, "domains": [ { "domain": "omegaunicorn.com", "hosts": [ ".", "www" ] } ] }

d0liver commented 8 years ago

Everything's working now. Thanks!

lmsurpre commented 7 years ago

'Unable to clean up challenge directory' should be fixed with commit 0dea2def

However, I don't think we ever fixed the script to work with a '.' hostname that isn't in the first position.