Lets Encrpt auf Panel Domain defekt

turbopixel · Post by **turbopixel** » Thu 28. Jan 2021, 08:54

Moin,
seit ca. vier Tagen funktioniert das SSL Zertifikat von Lets Encrypt nicht mehr auf meiiner Panel Domain.

Das Protokoll:

Code: Select all

[16-Jan-2021 00:00:13] INFO  --> check domain "meine-domain.tld'
[16-Jan-2021 00:00:13] INFO  --> certificate is valid until 2021-01-23 23:01:16 (7 days left)
[16-Jan-2021 00:00:13] INFO  --> certificate is in renewal period
[16-Jan-2021 00:00:13] INFO  --> renew cert
[16-Jan-2021 00:00:13] INFO  --> Using certificate authority: "https://acme-v02.api.letsencrypt.org/" ().
[16-Jan-2021 00:00:13] INFO  --> Getting endpoint URLs.
[16-Jan-2021 00:00:14] INFO  --> Account "keyhelp" already registered. Continue.
[16-Jan-2021 00:00:14] INFO  --> Requesting Key ID.
[16-Jan-2021 00:00:14] INFO  --> Sending signed request to "https://acme-v02.api.letsencrypt.org/acme/new-acct".
[16-Jan-2021 00:00:16] INFO  --> Start certificate generation.
[16-Jan-2021 00:00:17] INFO  --> Token stored at: /home/keyhelp/www/.well-known/acme-challenge/local-check-60021e8103d850.48684051
[16-Jan-2021 00:00:17] INFO  --> Local resolving checks of domains successfully completed.
[16-Jan-2021 00:00:17] INFO  --> Requesting challenges for domain "meine-domain.tld".
[16-Jan-2021 00:00:17] INFO  --> Sending signed request to "https://acme-v02.api.letsencrypt.org/acme/new-order".
[16-Jan-2021 00:00:18] INFO  --> Start authorization process for "meine-domain.tld".
[16-Jan-2021 00:00:18] INFO  --> Deploy challenge.
[16-Jan-2021 00:00:18] INFO  --> Token stored at: /home/keyhelp/www/.well-known/acme-challenge/OTCWLzAmGCNVa1yhx0-A28T5LeKOz-88Hw9Un6j-hOY
[16-Jan-2021 00:00:18] INFO  --> Notify CA that the challenge is ready.
[16-Jan-2021 00:00:18] INFO  --> Sending signed request to "https://acme-v02.api.letsencrypt.org/acme/chall-v3/10106919324/YVX0Iw".
[16-Jan-2021 00:00:20] INFO  --> Waiting for verification...
[16-Jan-2021 00:00:23] INFO  --> Waiting for verification...
[16-Jan-2021 00:00:25] INFO  --> Waiting for verification...
[16-Jan-2021 00:00:28] INFO  --> Waiting for verification...
[16-Jan-2021 00:00:31] INFO  --> Waiting for verification...
[16-Jan-2021 00:00:33] INFO  --> Waiting for verification...
[16-Jan-2021 00:00:36] INFO  --> Waiting for verification...
[16-Jan-2021 00:00:38] INFO  --> Waiting for verification...
[16-Jan-2021 00:00:41] INFO  --> Waiting for verification...
[16-Jan-2021 00:00:44] INFO  --> Waiting for verification...
[16-Jan-2021 00:00:46] ERROR --> a Let's Encrypt error occurred: Verification ended with an error. Response: {"type":"http-01","status":"invalid","error":{"type":"urn:ietf:params:acme:error:connection","detail":"Fetching https:\/\/meine-domain.tld\/.well-known\/acme-challenge\/OTCWLzAmGCNVa1yhx0-A28T5LeKOz-88Hw9Un6j-hOY: Timeout during connect (likely firewall problem)","status":400},"url":"https:\/\/acme-v02.api.letsencrypt.org\/acme\/chall-v3\/10106919324\/YVX0Iw","token":"OTCWLzAmGCNVa1yhx0-A28T5LeKOz-88Hw9Un6j-hOY","validationRecord":[{"url":"http:\/\/meine-domain.tld\/.well-known\/acme-challenge\/OTCWLzAmGCNVa1yhx0-A28T5LeKOz-88Hw9Un6j-hOY","hostname":"meine-domain.tld","port":"80","addressesResolved":["37.120.184.174","2a03:4000:f:31d::1"],"addressUsed":"2a03:4000:f:31d::1"},{"url":"http:\/\/meine-domain.tld\/.well-known\/acme-challenge\/OTCWLzAmGCNVa1yhx0-A28T5LeKOz-88Hw9Un6j-hOY","hostname":"meine-domain.tld","port":"80","addressesResolved":["37.120.184.174","2a03:4000:f:31d::1"],"addressUsed":"37.120.184.174"},{"url":"https:\/\/meine-domain.tld\/.well-known\/acme-challenge\/OTCWLzAmGCNVa1yhx0-A28T5LeKOz-88Hw9Un6j-hOY","hostname":"meine-domain.tld","port":"443","addressesResolved":["37.120.184.174","2a03:4000:f:31d::1"],"addressUsed":"2a03:4000:f:31d::1"}]}
[16-Jan-2021 00:00:47] INFO  --> send notification to admin "adminuser" (@)
[16-Jan-2021 00:00:47] INFO  --> finished

Das Fehler: Timeout during connect (likely firewall problem)

Nun ist es so, dass ich die .well-known URL im Browser ohne Probleme aufrufen kann. In der Firewall selber habe ich nicht rumgespielt, das ist alles auf Keyhelp Standard.

---

Habt ihr eine Idee? Den Panel Hostname zu wechseln bringt nichts. Das gleiche Problem verhindert die Neuaustellung.

Viele Grüße

Post by **Alexander** » Thu 28. Jan 2021, 09:23

Hallo,

Vielleicht ein DNS Problem?

Let's Encrypt für andere Domains funktioniert?

Ggf. noch ein Auszug der tatsächlich aktiven Firewallregeln anhängen ("iptables -S")

turbopixel · Post by **turbopixel** » Thu 28. Jan 2021, 11:19

Gerade eben habe ich versucht ein neues SSL Zertifikat für eine Subdomain anzulegen. Das hat auch nicht mehr funktioniert und nun sind alle Domains mit einem roten Zeichen versehen (Siehe Screenshot 1)

Die Domain von lets encrypt kann ich anpingen:

Code: Select all

nh@vm4:/root$ ping -4 acme-v02.api.letsencrypt.org
PING ca80a1adb12a4fbdac5ffcbc944e9a61.pacloudflare.com (172.65.32.248) 56(84) bytes of data.
64 bytes from 172.65.32.248 (172.65.32.248): icmp_seq=1 ttl=60 time=3.94 ms
64 bytes from 172.65.32.248 (172.65.32.248): icmp_seq=2 ttl=60 time=3.79 ms
64 bytes from 172.65.32.248 (172.65.32.248): icmp_seq=3 ttl=60 time=3.85 ms
64 bytes from 172.65.32.248 (172.65.32.248): icmp_seq=4 ttl=60 time=3.76 ms
^C
--- ca80a1adb12a4fbdac5ffcbc944e9a61.pacloudflare.com ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 8ms
rtt min/avg/max/mdev = 3.763/3.834/3.937/0.100 ms

iptables -S

Code: Select all

nh@vm4:/root$ sudo iptables -S
-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-N f2b-sshd
-A INPUT -p tcp -m multiport --dports 22 -j f2b-sshd
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -m state --state INVALID -j DROP
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,PSH,ACK,URG -j DROP
-A INPUT -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j DROP
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -j DROP
-A INPUT -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j DROP
-A INPUT -s 127.0.0.0/8 ! -i lo -j DROP
-A INPUT -i lo -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type any -m limit --limit 1/sec -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type any -j DROP
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -s 127.0.0.0/8 ! -i lo -j DROP
-A FORWARD -i lo -o lo -j ACCEPT
-A FORWARD -p icmp -m icmp --icmp-type any -m limit --limit 1/sec -j ACCEPT
-A FORWARD -p icmp -m icmp --icmp-type any -j DROP
-A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
-A f2b-sshd -s 61.177.172.104/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 178.214.243.19/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 54.37.68.191/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 67.205.178.62/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 45.80.64.246/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 167.172.164.37/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 106.54.98.89/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 142.44.211.57/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 139.155.68.39/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 146.185.180.57/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 51.195.148.139/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 85.191.214.236/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 106.75.211.130/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 119.45.181.168/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 151.80.61.249/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 51.254.117.33/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 218.92.0.248/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 193.112.213.187/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 64.213.148.44/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 40.115.6.17/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -j RETURN

Post by **Florian** » Thu 28. Jan 2021, 11:25

Hallo,

"addressUsed":"2a03:4000:f:31d::1"

Funktioniert die IPv6 auch die Let's Encrypt hier ermittelt hat für die Domain?

turbopixel · Post by **turbopixel** » Thu 28. Jan 2021, 11:52

Whoa... nein die IPv6 ist gar nicht richtig eingerichtet

Ich habe den AAAA Record entfernt und warte ein paar Stunden ab. Dann sollte es nächste Nacht sauber durchlaufen

turbopixel · Post by **turbopixel** » Sat 30. Jan 2021, 15:40

Nachdem ich den IPv6 Eintrag von der Domain komplett entfernt habe und ich in der Verwaltung "SSL/TLS-Zertifikate" die Zertifikate ein paar mal hin und her tauscht habe, funktioniert Let's Encrypt wieder wie gewohnt. Auch bei den Kunden Domains!

Hier war die fehlerhafte Auflösung von IPv6 die Grund Ursache.

Code: Select all

[30-Jan-2021 00:00:08] INFO  --> check domain "*****.eu'
[30-Jan-2021 00:00:08] INFO  --> certificate is valid until 2021-04-28 16:18:12 (88 days left)
[30-Jan-2021 00:00:08] INFO  --> send notification to user "nh" (*****.de)
[30-Jan-2021 00:00:08] INFO  --> finished

Ein kleines Extra: Nun habe ich auch den Fehler Apache: syntax error: AH00526 - welches ein anderer auch schon gemeldet hat: viewtopic.php?f=5&t=10278&start=15

Code: Select all

[28-Jan-2021 16:18:14] INFO  --> All done.
[28-Jan-2021 16:18:14] INFO  --> Apache: reloadApache()
[28-Jan-2021 16:18:14] ERROR --> Apache: syntax error: AH00526: Syntax error on line 35 of /etc/apache2/keyhelp/keyhelp.conf:
SSLCertificateFile: file '/etc/ssl/keyhelp/keyhelp.pem' does not exist or is empty
Action 'configtest' failed.
The Apache error log may have more information.
[28-Jan-2021 16:18:14] ERROR --> Apache: no reload due syntax error

Lets Encrpt auf Panel Domain defekt [GELÖST]

Lets Encrpt auf Panel Domain defekt

Re: Lets Encrpt auf Panel Domain defekt

Re: Lets Encrpt auf Panel Domain defekt

Re: Lets Encrpt auf Panel Domain defekt [GELÖST]

Re: Lets Encrpt auf Panel Domain defekt

Re: Lets Encrpt auf Panel Domain defekt