search

sjkp / letsencrypt-siteextension

Azure Web App Site Extension for easy installation and configuration of Let's Encrypt issued SSL certifcates for custom domain names.
745 stars 76 forks source link

The Lets Encrypt ACME server was probably unable to reach #315

Open courtenayparserr opened 5 years ago

courtenayparserr commented 5 years ago

Hi @sjkp

Firstly thanks for such a great service and tool. So appreciate it.

We are running into the "The Lets Encrypt ACME server was probably unable to reach" issue on the renewal job. I know why it is, because letsencrypt is trying to reach our server on HTTP but obviously we already have a valid certificate on there which means HTTP is not available.

We have a load-balanced setup on parserr dot com and api dot parserr dot com. How do we allow this job to run successfully to update certificates?

sjkp commented 5 years ago

If you want to use HTTP acknowledge flow, you have to allow http access to the /.well-known/acme-challenge path. So you could make a rule that allows that. Otherwise you can use DNS acknowledge but then you shouldn't be using the site-extension but instead https://github.com/sjkp/letsencrypt-azure.

To deal with the load balanced nature, you have to configure a blob storage account that can contain the challenge file, so that it can be availalbe from all load balanced web sites. You can read a bit about it here, how to set it up depends on your which framework you are using https://github.com/sjkp/letsencrypt-siteextension/wiki/Azure-Function,-Multi-Region,-Local-Cache-support (the load balanced complexity is also removed if you use a dns challenge)