Certbot Issues

[vchan]

Has anyone had trouble updating certs with certbot on 15.1-RELEASE-p5? I have my port open via pf anchor and am running

doas certbot -v certonly --standalone --http-01-port=8888 -d myURL.com

I usually run haproxy but currently have it disabled.

This is the error:

Fetching http://myURL.com/.well-known/acme-challenge/gEHHPbrv-x9H8gNkRlbsbqthTXV6KdWzYF-wNl4CunM: Timeout during connect (likely firewall problem)

I thought I had my periodic.conf setup to update it automatically, but it didn't work. I have scanned my VPS and the port is open from the outside.

 

[richardtoohey2]

No, I'm not seeing any issues (but I'm currently using the manual DNS approach so not what you are doing.)

e.g.

certbot certonly --manual --preferred-challenges dns -d "*.blah.blah" -d "blah.blah"

 

[drhowarddrfine]

No problem a few weeks ago when I renewed mine. Look into the new shorter renewal time that I think is out now. Instead of 90 days it's....uh....uh....you look it up and remind me.
EDIT: It's going to 64 day renewals on February 10th so that won't be the issue.

 

[SirDice]

I have scanned my VPS and the port is open from the outside.

The URL connects to port 80, while your certbot (and probably your firewall) is listening on 8888.

 

[SirDice]

For certbot in combination with haproxy I use a local nginx that's used for the HTTP challange.

haproxy.conf (the important bits)

frontend http-in
  {...}
  acl is_letsencrypt path_beg /.well-known/acme-challenge/
  {...}
  use_backend local if is_letsencrypt
  {...}
backend local
        option httpchk GET /up.txt
        server localhost 127.0.0.1:80 check

nginx.conf (important bits)

    server {
        listen       [::1]:80 default_server;
        listen       127.0.0.1:80 default_server;

        location /.well-known/acme-challenge {
                alias /usr/local/www/acme/.well-known/acme-challenge;
                autoindex off;
        }
        location /up.txt {
                return 200 "UP!";
                access_log off;
        }

Then use certbot with --webroot /usr/local/www/acme to do the challange/response directly in that nginx web directory. HAProxy will send any request with the /.well-known/acme-challenge path to the local nginx.

You'll need a deploy script to copy the renewed certificates to a directory for HAProxy.

#!/bin/sh -e

# $RENEWED_LINEAGE will point to the config live subdirectory
# $RENEWED_DOMAINS will contain a space-delimited list of renewed certificate domains

TARGETDIR="/usr/local/etc/haproxy/ssl"
TARGET="${TARGETDIR}/${RENEWED_DOMAINS%% *}.pem"

cat "${RENEWED_LINEAGE}/fullchain.pem" > "${TARGET}"
cat "${RENEWED_LINEAGE}/privkey.pem" >> "${TARGET}"

And a post renewal script to reload HAProxy (so it picks up the changed certificates)

#!/bin/sh

# Lets check the validity of the config first
echo -n "Checking haproxy config: "
/usr/sbin/service haproxy configtest > /dev/null 2>&1
if [ $? != 0 ]; then
  echo "There is an error in haproxy.conf. Not reloading!"
  exit 1
else
  echo "All good. Reloading."
  /usr/sbin/service haproxy reload
fi

My HAproxy is configured to pick up the certificates automatically from that directory:

frontend https-in
        bind x.x.x.x:443 ssl crt /usr/local/etc/haproxy/ssl/

Last but not least, enable a weekly check and refresh:
/etc/periodic.conf

weekly_certbot_enable="YES"

This setup has been running for several years now. Besides a few issues with certbot or Letsencrypt itself it's been running just fine. I have had so few issues I often forget it exists.

 

[siladi]

I moved on to acme.sh . No more python nonsense.

 

[vchan]

Apparently ACME can do it from within HAProxy, but I just modified my Pre and Post hooks to disable/enable my jail rdr and HAProxy. So now the Periodic script will update my certs correctly. Once I have some time I'll looking into have HAProxy handle it.