search

jast / placme

A Perl client for the ACME protocol (e.g. Let's Encrypt), with no exotic dependencies. PLACME IS NO LONGER MAINTAINED.
GNU General Public License v3.0
3 stars 3 forks source link

confirm doesn’t seem to work … ? #2

Closed FGasper closed 8 years ago

FGasper commented 8 years ago

Hello,

I’m trying this tool out since I don’t have gcc access on my shared hosting account to use Protocol::ACME.

I did:

… but it gives me:

Error from server: 400 Bad Request Error details: Unable to update challenge :: Response does not complete challenge

I notice also that the Apache logs don’t seem to show any requests coming in. The domain (felipegasper.com) is definitely configured correctly.

What am I missing here?

Thank you for making this tool available!

jast commented 8 years ago

Hi Felipe,

going from the challenge URL you passed in the confirm command, I think you got the wrong token (a GET request on that URL shows a different token). The JSON document you get from authz contains multiple tokens: one for each method of validation (in the case of letsencrypt.org: HTTP, TLS).

Additionally, you have missed a step (the documentation currently isn't extremely clear, I'm working on that): the validation file you're creating needs to have a special content. You can generate this either by calling authz with the --http flag, or by calling confirm without the --url parameter first (that way it will only generate the file's content and skip notifying the ACME server; after you have created the file you run confirm again, this time with both --token and --url). The former has the charming advantage that authz automatically extracts the correct token for you.

Finally, there's a fully automatic mode for authorization that you can use if you have write access to the correct location for the validation file while running placme. For example, if your web root is at /var/www/felipegasper.com, you could do this:

mkdir -p /var/www/felipegasper.com/.well-known/acme-challenge # you've probably already done this
/path/to/placme authz --http=send --domain=felipegasper.com --keyauth-out=/var/www/felipegasper.com/.well-known/acme-challenge/:TOKEN: # a literal ":TOKEN:" here, gets replaced by placme

Please let me know if this helps. Good luck!

FGasper commented 8 years ago

I did actually have the file in place, but (going by the Apache logs) the LE server wasn’t querying for it.

What worked, finally, was to give --keyauth-out to authz, then confirm.

BTW, would it be more sensible just to give the web root for the domain, since the path depends on that? the .well-known/acme-challenge/:TOKEN: stuff is implicit in the protocol, isn’t it?

jast commented 8 years ago

The setup I'm planning for my own machines is to have a central directory for tokens, and alias it into the various virtual hosts... so there would be a single directory I am putting the token files in, and without the .well-known/acme-challenge/ suffix. Still, I guess it would make sense to change the parameter so that it accepts a directory rather than a full path name.

Thanks for the feedback! I'm doing a lot of refactoring right now and, along with new automation features I'll be reworking the interface and docs slightly to make these things easier.