acme.sh and Cloudflare

Discussion in 'ISPConfig 3 Priority Support' started by Stelios, Oct 30, 2023.

  1. Stelios

    Stelios Active Member HowtoForge Supporter

    Hi all,

    I got a blank page in some websites that using Cloudflare (proxied) and I'm not able to renew the ssl.
    Example when I run manually the acme.sh:

    Invalid status, www.mydomain.com:Verify error detail:myipv6: Invalid response from http://www.mydomain.com/.well-known/acme-challenge/U-HGfTk2zUxH_RVl9Sd2ml4zT_GOl3qALrbpZJtbcXk: 404

    Logs showing:

    [Mon Oct 30 06:34:28 PM EET 2023] code='400'
    [Mon Oct 30 06:34:28 PM EET 2023] original='{
    "type": "urn:ietf:params:acme:error:malformed",
    "detail": "Unable to update challenge :: authorization must be pending",
    "status": 400
    }'
    [Mon Oct 30 06:34:28 PM EET 2023] response='{
    "type": "urn:ietf:params:acme:error:malformed",
    "detail": "Unable to update challenge :: authorization must be pending",
    "status": 400
    }'


    I add cloudflare in dev mode but same problem.

    Any help is very much appreciated.
     
  2. Stelios

    Stelios Active Member HowtoForge Supporter

    I disabled some rules in cloudflare and still not working but now getting this error:

    [Mon Oct 30 07:16:43 PM EET 2023] code='400'
    [Mon Oct 30 07:16:43 PM EET 2023] original='{
    "type": "urn:ietf:params:acme:error:malformed",
    "detail": "Unable to update challenge :: authorization must be pending",
    "status": 400
    }'
    [Mon Oct 30 07:16:43 PM EET 2023] response='{
    "type": "urn:ietf:params:acme:error:malformed",
    "detail": "Unable to update challenge :: authorization must be pending",
    "status": 400
    }'
     
  3. Stelios

    Stelios Active Member HowtoForge Supporter

    Further to my post, I removed the proxied in DNS entries and now it took a Letencrypt certificate but it displays a blank page the website. It looks that is encrypted with Letsencrypt but shows nothing and can't figure out how to troubleshoot this.
     
  4. till

    till Super Moderator Staff Member ISPConfig Developer

    Yes, you can not use let#s encrypt behind a CloudFlare proxy. If you want to use CloudFlare proxy, enable SSL in Cloudflare and create a self-signed SSL cert in ISPConfig for the website.

    Check website error.log for errors.
     
  5. Stelios

    Stelios Active Member HowtoForge Supporter

    This happens after I tried to resync all services. On the master server with the controlpanel I get:

    /usr/local/ispconfig/server/server.sh
    30.10.2023-19:02 - WARNING - There is already a lockfile set, but no process running with this pid (83609). Continuing.
    Database connection failed

    but the user seems to have the proper password.
     
  6. till

    till Super Moderator Staff Member ISPConfig Developer

    Check with mysql command that you can login to dbispconfig database on localhost with the database login details from file /usr/local/ispconfig/server/lib/config.inc.php and if this works, empty the login details for dbmaster connection in that file (but only on master, not on slave nodes).
     
  7. Stelios

    Stelios Active Member HowtoForge Supporter

    I fixed the password and re-update the server and worked ok.

    However, there must be a bug or something as only after I use the resync tool on 2 servers all domains are showing a blank page where the SSL seems to work fine. No logs, nothing on them. If I run the index.php from the server it self it pass it fine.
    They used to work just fine. Sites on other servers are resolving fine. Go figure....
     
  8. Stelios

    Stelios Active Member HowtoForge Supporter

    Found the problem.....the domain registrar has a problem with DNSSec and all domains that using it they don't work....
    DNSSEC: DNSKEY Missing; DNS problem: looking
     
    till likes this.
  9. Stelios

    Stelios Active Member HowtoForge Supporter

    and the snuffleupagus module was causing also this....sorry for the long post.
     

Share This Page