Letsencrypt SSL issues

InnerCode · June 19, 2018, 6:40am

Hi,

I used StartSSL free certificates before but want to use letsencrypt now. Trying to install a new certificate via the web interface results in the following error in /var/log/syslog
Jun 19 08:25:11 mail Exception on /ssl/csr/innercode.nl [POST]#012Traceback (most recent call last):#012 File “/usr/local/lib/mailinabox/env/lib/python3.4/site-packages/flask/app.py”, line 2292, in wsgi_app#012 response = self.full_dispatch_request()#012 File “/usr/local/lib/mailinabox/env/lib/python3.4/site-packages/flask/app.py”, line 1815, in full_dispatch_request#012 rv = self.handle_user_exception(e)#012 File “/usr/local/lib/mailinabox/env/lib/python3.4/site-packages/flask/app.py”, line 1718, in handle_user_exception#012 reraise(exc_type, exc_value, tb)#012 File “/usr/local/lib/mailinabox/env/lib/python3.4/site-packages/flask/_compat.py”, line 35, in reraise#012 raise value#012 File “/usr/local/lib/mailinabox/env/lib/python3.4/site-packages/flask/app.py”, line 1813, in full_dispatch_request#012 rv = self.dispatch_request()#012 File “/usr/local/lib/mailinabox/env/lib/python3.4/site-packages/flask/app.py”, line 1799, in dispatch_request#012 return self.view_functionsrule.endpoint#012 File “/root/mailinabox/management/daemon.py”, line 53, in newview#012 return viewfunc(*args, **kwargs)#012 File “/root/mailinabox/management/daemon.py”, line 361, in ssl_get_csr#012 return create_csr(domain, ssl_private_key, request.form.get(‘countrycode’, ‘’), env)#012 File “/root/mailinabox/management/ssl_certificates.py”, line 559, in create_csr#012 “-subj”, “/C=%s/CN=%s” % (country_code, domain)])#012 File “/root/mailinabox/management/utils.py”, line 123, in shell#012 ret = getattr(subprocess, method)(cmd_args, **kwargs)#012 File “/usr/lib/python3.4/subprocess.py”, line 620, in check_output#012 raise CalledProcessError(retcode, process.args, output=output)#012subprocess.CalledProcessError: Command ‘[‘openssl’, ‘req’, ‘-new’, ‘-key’, ‘/home/user-data/ssl/ssl_private_key.pem’, ‘-sha256’, ‘-subj’, ‘/C=/CN=innercode.nl’]’ returned non-zero exit status 1

Running it manually ./ssl_certificates.py innercode.nl results in:
/usr/local/lib/mailinabox/env/lib/python3.4/site-packages/acme/jose/jwa.py:110: CryptographyDeprecationWarning: signer and verifier have been deprecated. Please use sign and verify instead.
signer = key.signer(self.padding, self.hash)
ERROR:acme.challenges:Unable to reach url/to/challenge: HTTPConnectionPool(host=‘innercode.nl’, port=80): Max retries exceeded with url: /.well-known/acme-challenge/BJ0jdD2_ahCmnAU7DrwqQa1Dy5fu0LRVJ_gc_uBjkHY (Caused by NewConnectionError(’<urllib3.connection.HTTPConnection object at 0x7f7051313320>: Failed to establish a new connection: [Errno 111] Connection refused’,))
ERROR:acme.challenges:Unable to reach url/to/challenge: HTTPConnectionPool(host=‘innercode.nl’, port=80): Max retries exceeded with url: /.well-known/acme-challenge/BJ0jdD2_ahCmnAU7DrwqQa1Dy5fu0LRVJ_gc_uBjkHY (Caused by NewConnectionError(’<urllib3.connection.HTTPConnection object at 0x7f7050773e10>: Failed to establish a new connection: [Errno 111] Connection refused’,))
innercode.nl:
Something unexpected went wrong: [NeedToInstallFile(‘url/to/challenge’, ‘BJ0jdD2_ahCmnAU7DrwqQa1Dy5fu0LRVJ_gc_uBjkHY.T1O3-nbRjjXxlUHkh4ikEF3vLUDtA9FO4WYldgQHPPE’, ‘BJ0jdD2_ahCmnAU7DrwqQa1Dy5fu0LRVJ_gc_uBjkHY’)]

The file is accessible outside so I don’t know why it fails.

Thanks in advance

hfuller · June 21, 2018, 12:45am

I’m currently having the same issue.

hfuller@mail:~$ sudo ./mailinabox/management/ssl_certificates.py
[sudo] password for hfuller:
/usr/local/lib/mailinabox/env/lib/python3.4/site-packages/acme/jose/jwa.py:110: CryptographyDeprecationWarning: signer and verifier have been deprecated. Please use sign and verify instead.
signer = key.signer(self.padding, self.hash)
ERROR:acme.challenges:Unable to reach http://mail.acedb.co/.well-known/acme-challenge/fI45yEvmzSeUn7xoaBhe5j-wnMhO9dKwS4gw74HdGvI: HTTPConnectionPool(host=‘mail.acedb.co’, port=80): Max retries exceeded with url: /.well-known/acme-challenge/fI45yEvmzSeUn7xoaBhe5j-wnMhO9dKwS4gw74HdGvI (Caused by NewConnectionError(’<urllib3.connection.HTTPConnection object at 0x7fb7adb517f0>: Failed to establish a new connection: [Errno 111] Connection refused’,))

Port 80 on the mailinabox does respond from elsewhere on the Internet.

murgero · June 21, 2018, 3:42pm

@hfuller - I looked at your server (found in the error message you gave) and the SSL cert is valid until July 3rd. IDK if that helps you at all. Also Port 80 responds to me, which is unlike your last statement there.

@InnerCode -

Failed to establish a new connection: [Errno 111] Connection refused

For some reason LetsEncrypt cannot connect. This is probably because nginx is not running (letsencrypt default with MIAB) but Apache is:

hfuller · June 22, 2018, 9:06pm

@murgero It does help, because it means I have quite some time to resolve the issue. But I am already getting emails from Let’s Encrypt because the expiration is approaching.
Port 80 does indeed work for me, and it appears in the nginx access log (/var/log/nginx/access.log) when I access it from my PC, but nothing appears when Let’s Encrypt tries to do it.

hfuller · June 26, 2018, 10:19pm

Nevermind, it was due to firewall issues. I have another problem and I’ll open my own thread about it. Thanks anyway.