Lua-resty-auto-ssl: La redirección de http a https provoca que no se obtengan nuevos certificados

Creado en 20 may. 2020 · 2Comentarios · Fuente: auto-ssl/lua-resty-auto-ssl

La redirección de HTTP a https conduce a fallas en la obtención de nuevos certificados
Estaba intentando redirigir la solicitud HTTP en el puerto 80 en nginx.conf

server {
    listen 80;
    server_name _;
    location /.well-known/acme-challenge/ {
      content_by_lua_block {
        auto_ssl:challenge_server()
      }
    }
    return 301 https://$host$request_uri;
  }

Muestra un error como este

Processing five.fortunekit.com
 + Creating new directory /etc/resty-auto-ssl/letsencrypt/certs/five.fortunekit.com ...
 + Signing domains...
 + Generating private key...
 + Generating signing request...
 + Requesting new certificate order from CA...
 + Received 1 authorizations URLs from the CA
 + Handling authorization for five.fortunekit.com
 + 1 pending challenge(s)
 + Deploying challenge tokens...
deploy_challenge
 + Responding to challenge for five.fortunekit.com authorization...
invalid_challenge
Invalid challenge: DOMAIN=five.fortunekit.com RESPONSE={
  "type": "http-01",
  "status": "invalid",
  "error": {
    "type": "urn:ietf:params:acme:error:connection",
    "detail": "Fetching https://five.fortunekit.com/.well-known/acme-challenge/geyhMh-KOQTyNQRDIurMja32h3Xjd4nmiE9UkFBn15w: Timeout after connect (your server may be slow or overloaded)",
    "status": 400
  },
  "url": "https://acme-v02.api.letsencrypt.org/acme/chall-v3/4699231438/-vRiFQ",
  "token": "geyhMh-KOQTyNQRDIurMja32h3Xjd4nmiE9UkFBn15w",
  "validationRecord": [
    {
      "url": "http://five.fortunekit.com/.well-known/acme-challenge/geyhMh-KOQTyNQRDIurMja32h3Xjd4nmiE9UkFBn15w",
      "hostname": "five.fortunekit.com",
      "port": "80",
      "addressesResolved": [
        "35.154.129.216"
      ],
      "addressUsed": "35.154.129.216"
    },
    {
      "url": "https://five.fortunekit.com/.well-known/acme-challenge/geyhMh-KOQTyNQRDIurMja32h3Xjd4nmiE9UkFBn15w",
      "hostname": "five.fortunekit.com",
      "port": "443",
      "addressesResolved": [
        "35.154.129.216"
      ],
      "addressUsed": "35.154.129.216"
    }
  ]
}
 err: Can't load ./.rnd into RNG
140653820678592:error:2406F079:random number generator:RAND_load_file:Cannot open file:../crypto/rand/randfile.c:88:Filename=./.rnd
, context: ssl_certificate_by_lua*, client: 106.210.248.44, server: 0.0.0.0:443
2020/05/20 10:36:17 [error] 4144#4144: *4 [lua] ssl_certificate.lua:97: issue_cert(): auto-ssl: issuing new certificate failed: dehydrated failure, context: ssl_certificate_by_lua*, client: 106.210.248.44, server: 0.0.0.0:443
2020/05/20 10:36:17 [error] 4144#4144: *4 [lua] ssl_certificate.lua:291: auto-ssl: could not get certificate for five.fortunekit.com - using fallback - failed to get or issue certificate, context: ssl_certificate_by_lua*, client: 106.210.248.44, server: 0.0.0.0:443
2020/05/20 10:36:35 [error] 4144#4144: *12 [lua] ssl_certificate.lua:68: issue_cert(): auto-ssl: failed to obtain lock: timeout, context: ssl_certificate_by_lua*, client: 66.133.109.36, server: 0.0.0.0:443
2020/05/20 10:36:35 [error] 4144#4144: *12 [lua] ssl_certificate.lua:291: auto-ssl: could not get certificate for five.fortunekit.com - using fallback - failed to get or issue certificate, context: ssl_certificate_by_lua*, client: 66.133.109.36, server: 0.0.0.0:443
2020/05/20 10:36:36 [error] 4144#4144: *16 [lua] ssl_certificate.lua:68: issue_cert(): auto-ssl: failed to obtain lock: timeout, context: ssl_certificate_by_lua*, client: 34.209.232.166, server: 0.0.0.0:443

Eso conduce a un error 429 como

{
  "type": "urn:ietf:params:acme:error:rateLimited",
  "detail": "Error creating new order :: too many failed authorizations recently: see https://letsencrypt.org/docs/rate-limits/",
  "status": 429
}

Fuente

amanjhaNOW

Comentario más útil

Yo tuve el mismo problema. Sin embargo, la solución no es obvia si no profundiza en cómo nginx selecciona bloques location .

La solución :

 # wildcard HTTP server for domains
  server {
    listen 80;
    server_name _;
    # Endpoint used for performing domain verification with Let's Encrypt.
    location /.well-known/acme-challenge/ {
      content_by_lua_block {
        auto_ssl:challenge_server()
      }
    }
    location / {
      return 301 https://$host$request_uri;
    }

Por qué esto funciona y su ejemplo no: porque tiene una declaración de retorno en la raíz del servidor, por lo que nginx ve eso y devuelve directamente 301 en lugar de coincidir primero con la ubicación que tiene. Por lo tanto, no use return en la raíz de un servidor. siempre.

aviatrix en 26 may. 2020

❤4 👍2

Todos 2 comentarios

Yo tuve el mismo problema. Sin embargo, la solución no es obvia si no profundiza en cómo nginx selecciona bloques location .

La solución :

 # wildcard HTTP server for domains
  server {
    listen 80;
    server_name _;
    # Endpoint used for performing domain verification with Let's Encrypt.
    location /.well-known/acme-challenge/ {
      content_by_lua_block {
        auto_ssl:challenge_server()
      }
    }
    location / {
      return 301 https://$host$request_uri;
    }

aviatrix en 26 may. 2020

❤4 👍2

Está trabajando ahora. Muchas gracias :)

amanjhaNOW en 26 may. 2020

¿Fue útil esta página

0 / 5 - 0 calificaciones