[Solved] Problem with AIO and Let's Encrypt

Support intro

Sorry to hear you’re facing problems :slightly_frowning_face:

help.nextcloud.com is for home/non-enterprise users. If you’re running a business, paid support can be accessed via portal.nextcloud.com where we can ensure your business keeps running smoothly.

In order to help you as quickly as possible, before clicking Create Topic please provide as much of the below as you can. Feel free to use a pastebin service for logs, otherwise either indent short log examples with four spaces:

example

Or for longer, use three backticks above and below the code snippet:

longer
example
here

Some or all of the below information will be requested if it isn’t supplied; for fastest response please provide as much as you can :heart:

Nextcloud version (eg, 20.0.5): 28.0.4
Operating system and version (eg, Ubuntu 20.04): Ubuntu 22.04
Apache or nginx version (eg, Apache 2.4.25): AIO Apache/Caddy
PHP version (eg, 7.4): AIO PHP 8.2.17

The issue you are facing:
The ACME client is having problems with certificate validation. Docker logs report a timeout during validation, but tcpdump shows the packets being received and replied to on port 80.

Is this the first time you’ve seen this error? (Y/N):
Yes

Steps to replicate it:

  1. docker restart nextcloud-aio-apache
  2. docker logs -tf nextcloud-aio-apache
  3. Wait a few moments for the ACME client to be invoked automatically because the certificate is already expired

The output of your Nextcloud log in Admin > Logging:

Error	core	
TypeError OCA\DAV\CardDAV\CardDavBackend::getUID(): Argument #1 ($cardData) must be of type string, resource given, called in /var/www/html/apps/dav/lib/CardDAV/CardDavBackend.php on line 718
Error while running background job (class: OCA\DAV\Migration\BuildSocialSearchIndexBackgroundJob, arguments: Array ( [offset] => 0 [stopAt] => 19 ) ) 

The output of your config.php file in /path/to/nextcloud (make sure you remove any identifiable information!):

{
    "system": {
        "one-click-instance": true,
        "one-click-instance.user-limit": 100,
        "memcache.local": "\\OC\\Memcache\\APCu",
        "apps_paths": [
            {
                "path": "\/var\/www\/html\/apps",
                "url": "\/apps",
                "writable": false
            },
            {
                "path": "\/var\/www\/html\/custom_apps",
                "url": "\/custom_apps",
                "writable": true
            }
        ],
        "appsallowlist": false,
        "check_data_directory_permissions": false,
        "memcache.distributed": "\\OC\\Memcache\\Redis",
        "memcache.locking": "\\OC\\Memcache\\Redis",
        "redis": {
            "host": "***REMOVED SENSITIVE VALUE***",
            "password": "***REMOVED SENSITIVE VALUE***",
            "port": 6379
        },
        "overwritehost": "***REMOVED SENSITIVE VALUE***",
        "overwriteprotocol": "https",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "localhost",
            "***REMOVED SENSITIVE VALUE***"
        ],
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "dbtype": "pgsql",
        "version": "28.0.4.1",
        "overwrite.cli.url": "https:\/\/***REMOVED SENSITIVE VALUE***\/",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbport": "",
        "dbtableprefix": "oc_",
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "maintenance": false,
        "updatedirectory": "\/nc-updater",
        "loglevel": "2",
        "app_install_overwrite": [
            "nextcloud-aio"
        ],
        "log_type": "file",
        "logfile": "\/var\/www\/html\/data\/nextcloud.log",
        "log_rotate_size": "10485760",
        "log.condition": {
            "apps": [
                "admin_audit"
            ]
        },
        "preview_max_x": "2048",
        "preview_max_y": "2048",
        "jpeg_quality": "60",
        "enabledPreviewProviders": {
            "1": "OC\\Preview\\Image",
            "2": "OC\\Preview\\MarkDown",
            "3": "OC\\Preview\\MP3",
            "4": "OC\\Preview\\TXT",
            "5": "OC\\Preview\\OpenDocument",
            "6": "OC\\Preview\\Movie",
            "7": "OC\\Preview\\Krita",
            "0": "OC\\Preview\\Imaginary"
        },
        "enable_previews": true,
        "upgrade.disable-web": true,
        "mail_smtpmode": "smtp",
        "trashbin_retention_obligation": "auto, 30",
        "versions_retention_obligation": "auto, 30",
        "activity_expire_days": "30",
        "simpleSignUpLink.shown": false,
        "share_folder": "\/Shared",
        "one-click-instance.link": "https:\/\/nextcloud.com\/all-in-one\/",
        "upgrade.cli-upgrade-link": "https:\/\/github.com\/nextcloud\/all-in-one\/discussions\/2726",
        "allow_local_remote_servers": true,
        "davstorage.request_timeout": 3600,
        "htaccess.RewriteBase": "\/",
        "dbpersistent": false,
        "files_external_allow_create_new_local": false,
        "trusted_proxies": "***REMOVED SENSITIVE VALUE***",
        "preview_imaginary_url": "***REMOVED SENSITIVE VALUE***",
        "default_phone_region": "us",
        "ldapProviderFactory": "OCA\\User_LDAP\\LDAPProviderFactory",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_sendmailmode": "smtp",
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpport": "587",
        "maintenance_window_start": 100,
        "preview_imaginary_key": "25e745123a63397e590f80a4f7238edfe05240c1bf8da21f"
    },
    "apps": {
        "activity": {
            "types": "filesystem",
            "enabled": "yes",
            "installed_version": "2.20.0"
        },
        "admin_audit": {
            "installed_version": "1.18.0",
            "types": "logging",
            "enabled": "yes",
            "logfile": "\/var\/www\/html\/data\/audit.log"
        },
        "backgroundjob": {
            "lastjob": "35"
        },
        "bruteForce": {
            "whitelist_1": "10.0.0.0\/8",
            "whitelist_2": "172.16.0.0\/12",
            "whitelist_3": "192.168.0.0\/16"
        },
        "bruteforcesettings": {
            "installed_version": "2.8.0",
            "types": "",
            "enabled": "yes"
        },
        "calendar": {
            "installed_version": "4.6.7",
            "enabled": "yes",
            "types": ""
        },
        "circles": {
            "types": "filesystem,dav",
            "enabled": "yes",
            "installed_version": "28.0.0",
            "loopback_tmp_scheme": "https",
            "migration_22": "1",
            "migration_run": "0",
            "loopback_tmp_path": "\/",
            "maintenance_run": "0",
            "maintenance_update": "{\"3\":1713809701,\"2\":1713813301,\"1\":1713813301}"
        },
        "cloud_federation_api": {
            "types": "filesystem",
            "enabled": "yes",
            "installed_version": "1.11.0"
        },
        "comments": {
            "types": "logging",
            "enabled": "yes",
            "installed_version": "1.18.0"
        },
        "contacts": {
            "types": "dav",
            "enabled": "yes",
            "installed_version": "5.5.3"
        },
        "contactsinteraction": {
            "types": "dav",
            "enabled": "yes",
            "installed_version": "1.9.0"
        },
        "core": {
            "vendor": "nextcloud",
            "public_webdav": "dav\/appinfo\/v1\/publicwebdav.php",
            "public_files": "files_sharing\/public.php",
            "moveavatarsdone": "yes",
            "previewsCleanedUp": "1",
            "oc.integritycheck.checker": "[]",
            "lastupdatedat": "0",
            "installedat": "1705532206.8300",
            "files_metadata_installed": "1",
            "backgroundjobs_mode": "cron",
            "emailTestSuccessful": "1",
            "files_metadata": "{\"photos-original_date_time\":{\"value\":null,\"type\":\"int\",\"indexed\":true,\"editPermission\":0},\"photos-size\":{\"value\":null,\"type\":\"array\",\"indexed\":false,\"editPermission\":0},\"photos-exif\":{\"value\":null,\"type\":\"array\",\"indexed\":false,\"editPermission\":0},\"photos-ifd0\":{\"value\":null,\"type\":\"array\",\"indexed\":false,\"editPermission\":0},\"photos-gps\":{\"value\":null,\"type\":\"array\",\"indexed\":false,\"editPermission\":0}}",
            "lastcron": "1713813302"
        },
        "dashboard": {
            "types": "",
            "enabled": "yes",
            "installed_version": "7.8.0"
        },
        "dav": {
            "types": "filesystem",
            "enabled": "yes",
            "installed_version": "1.29.1",
            "regeneratedBirthdayCalendarsForYearFix": "yes",
            "buildCalendarSearchIndex": "yes",
            "buildCalendarReminderIndex": "yes",
            "builtSocialSearchIndex": "yes",
            "chunks_migrated": "1"
        },
        "deck": {
            "types": "dav",
            "installed_version": "1.12.2",
            "enabled": "yes"
        },
        "federatedfilesharing": {
            "types": "",
            "enabled": "yes",
            "installed_version": "1.18.0"
        },
        "federation": {
            "types": "authentication",
            "enabled": "yes",
            "installed_version": "1.18.0"
        },
        "files": {
            "types": "filesystem",
            "enabled": "yes",
            "installed_version": "2.0.0"
        },
        "files_pdfviewer": {
            "types": "",
            "enabled": "yes",
            "installed_version": "2.9.0"
        },
        "files_reminders": {
            "types": "",
            "enabled": "yes",
            "installed_version": "1.1.0"
        },
        "files_rightclick": {
            "installed_version": "1.6.0",
            "types": "",
            "enabled": "no"
        },
        "files_sharing": {
            "types": "filesystem",
            "enabled": "yes",
            "installed_version": "1.20.0"
        },
        "files_trashbin": {
            "types": "filesystem,dav",
            "enabled": "yes",
            "installed_version": "1.18.0"
        },
        "files_versions": {
            "types": "filesystem,dav",
            "enabled": "yes",
            "installed_version": "1.21.0"
        },
        "firstrunwizard": {
            "types": "logging",
            "enabled": "yes",
            "installed_version": "2.17.0"
        },
        "groupfolders": {
            "types": "filesystem,dav",
            "installed_version": "16.0.6",
            "enabled": "yes"
        },
        "guests": {
            "installed_version": "3.0.1",
            "types": "authentication",
            "enabled": "yes",
            "usewhitelist": "true",
            "allow_external_storage": "false",
            "hide_users": "true",
            "whitelist": "files_trashbin,files_versions,files_sharing,files_texteditor,text,activity,firstrunwizard,photos,notifications,dashboard,user_status,weather_status"
        },
        "logreader": {
            "types": "logging",
            "enabled": "yes",
            "installed_version": "2.13.0",
            "shownLevels": "[2,3,4]"
        },
        "lookup_server_connector": {
            "types": "authentication",
            "enabled": "yes",
            "installed_version": "1.16.0"
        },
        "nextcloud-aio": {
            "types": "",
            "enabled": "yes",
            "installed_version": "0.5.0"
        },
        "nextcloud_announcements": {
            "types": "logging",
            "enabled": "yes",
            "installed_version": "1.17.0",
            "pub_date": "Thu, 24 Oct 2019 00:00:00 +0200"
        },
        "notes": {
            "types": "",
            "enabled": "yes",
            "installed_version": "4.9.4"
        },
        "notifications": {
            "types": "logging",
            "enabled": "yes",
            "installed_version": "2.16.0"
        },
        "notify_push": {
            "enabled": "yes",
            "installed_version": "0.6.10",
            "types": "filesystem",
            "base_endpoint": "https:\/\/***REMOVED SENSITIVE VALUE***\/push"
        },
        "oauth2": {
            "types": "authentication",
            "enabled": "yes",
            "installed_version": "1.16.3"
        },
        "password_policy": {
            "types": "authentication",
            "enabled": "yes",
            "installed_version": "1.18.0"
        },
        "photos": {
            "types": "dav,authentication",
            "enabled": "yes",
            "installed_version": "2.4.0",
            "lastPlaceMappedUser": "admin",
            "lastPlaceMappingDone": "true"
        },
        "preview": {
            "jpeg_quality": "60"
        },
        "privacy": {
            "types": "",
            "enabled": "yes",
            "installed_version": "1.12.0"
        },
        "provisioning_api": {
            "types": "prevent_group_restriction",
            "enabled": "yes",
            "installed_version": "1.18.0"
        },
        "recommendations": {
            "types": "",
            "enabled": "yes",
            "installed_version": "2.0.0"
        },
        "related_resources": {
            "types": "",
            "enabled": "yes",
            "installed_version": "1.3.0"
        },
        "serverinfo": {
            "types": "",
            "enabled": "yes",
            "installed_version": "1.18.0",
            "cached_count_filecache": "1529",
            "cached_count_storages": "21"
        },
        "settings": {
            "types": "",
            "enabled": "yes",
            "installed_version": "1.10.1"
        },
        "sharebymail": {
            "types": "filesystem",
            "enabled": "yes",
            "installed_version": "1.18.0"
        },
        "support": {
            "types": "session",
            "enabled": "yes",
            "installed_version": "1.11.1",
            "SwitchUpdaterServerHasRun": "yes"
        },
        "survey_client": {
            "types": "",
            "enabled": "yes",
            "installed_version": "1.16.0"
        },
        "systemtags": {
            "types": "logging",
            "enabled": "yes",
            "installed_version": "1.18.0"
        },
        "tasks": {
            "installed_version": "0.15.0",
            "types": "",
            "enabled": "yes"
        },
        "text": {
            "types": "dav",
            "enabled": "yes",
            "installed_version": "3.9.1"
        },
        "theming": {
            "types": "logging",
            "enabled": "yes",
            "installed_version": "2.3.0",
            "name": "***REMOVED SENSITIVE VALUE***",
            "url": "***REMOVED SENSITIVE VALUE***",
            "slogan": "***REMOVED SENSITIVE VALUE***",
            "color": "#001C79",
            "logoMime": "image\/png",
            "backgroundMime": "image\/png",
            "cachebuster": "9"
        },
        "twofactor_backupcodes": {
            "types": "",
            "enabled": "yes",
            "installed_version": "1.17.0"
        },
        "twofactor_totp": {
            "installed_version": "10.0.0-beta.2",
            "types": "",
            "enabled": "yes"
        },
        "updatenotification": {
            "installed_version": "1.18.0",
            "types": "",
            "enabled": "no"
        },
        "user_ldap": {
            "installed_version": "1.19.0",
            "types": "authentication",
            "enabled": "yes",
            "s01ldap_userfilter_groups": "Nextcloud Users",
            "s01ldap_backup_host": "",
            "s01ldap_backup_port": "",
            "s01ldap_background_host": "",
            "s01ldap_background_port": "",
            "s01ldap_override_main_server": "",
            "s01ldap_login_filter_mode": "0",
            "s01ldap_loginfilter_email": "0",
            "s01ldap_loginfilter_username": "1",
            "s01ldap_loginfilter_attributes": "",
            "s01ldap_group_filter": "",
            "s01ldap_group_filter_mode": "0",
            "s01ldap_groupfilter_objectclass": "",
            "s01ldap_groupfilter_groups": "",
            "s01ldap_gid_number": "gidNumber",
            "s01ldap_user_display_name_2": "",
            "s01ldap_group_display_name": "cn",
            "s01ldap_tls": "0",
            "s01ldap_quota_def": "",
            "s01ldap_quota_attr": "",
            "s01ldap_group_member_assoc_attribute": "",
            "s01ldap_cache_ttl": "600",
            "s01home_folder_naming_rule": "",
            "s01ldap_turn_off_cert_check": "0",
            "s01ldap_attributes_for_user_search": "",
            "s01ldap_expert_username_attr": "",
            "s01ldap_attributes_for_group_search": "",
            "s01ldap_expert_uuid_user_attr": "",
            "s01ldap_expert_uuid_group_attr": "",
            "s01ldap_display_name": "displayname",
            "s01use_memberof_to_detect_membership": "1",
            "s01ldap_mark_remnants_as_disabled": "0",
            "s01last_jpegPhoto_lookup": "0",
            "s01ldap_nested_groups": "0",
            "s01ldap_paging_size": "500",
            "s01ldap_turn_on_pwd_change": "0",
            "s01ldap_dynamic_group_member_url": "",
            "s01ldap_agent_password": "***REMOVED SENSITIVE VALUE***",
            "s01ldap_base": "***REMOVED SENSITIVE VALUE***",
            "s01ldap_port": "389",
            "s01ldap_experienced_admin": "0",
            "s01has_memberof_filter_support": "1",
            "s01ldap_userfilter_objectclass": "user",
            "s01ldap_user_filter_mode": "1",
            "s01ldap_configuration_active": "1",
            "s01ldap_base_users": "***REMOVED SENSITIVE VALUE***",
            "s01ldap_email_attr": "mail",
            "s01ldap_base_groups": "***REMOVED SENSITIVE VALUE***",
            "s01ldap_default_ppolicy_dn": "",
            "s01ldap_user_avatar_rule": "default",
            "s01ldap_ext_storage_home_attribute": "",
            "s01ldap_matching_rule_in_chain_state": "unknown",
            "s01ldap_connection_timeout": "15",
            "s01ldap_attr_phone": "",
            "s01ldap_attr_website": "",
            "s01ldap_attr_address": "",
            "s01ldap_attr_twitter": "",
            "s01ldap_attr_fediverse": "",
            "s01ldap_attr_organisation": "",
            "s01ldap_attr_role": "",
            "s01ldap_attr_headline": "",
            "s01ldap_attr_biography": "",
            "s01ldap_admin_group": "",
            "s01ldap_dn": "***REMOVED SENSITIVE VALUE***",
            "s01ldap_host": "ldap:\/\/***REMOVED SENSITIVE VALUE***",
            "s01_lastChange": "1705591337",
            "s01ldap_userlist_filter": "***REMOVED SENSITIVE VALUE***",
            "s02ldap_port": "389",
            "s02ldap_backup_host": "",
            "s02ldap_backup_port": "",
            "s02ldap_background_host": "",
            "s02ldap_background_port": "",
            "s02ldap_base": "***REMOVED SENSITIVE VALUE***",
            "s02ldap_base_users": "",
            "s02ldap_base_groups": "",
            "s02ldap_dn": "***REMOVED SENSITIVE VALUE***",
            "s02ldap_agent_password": "***REMOVED SENSITIVE VALUE***",
            "s02ldap_tls": "0",
            "s02ldap_turn_off_cert_check": "0",
            "s02ldap_display_name": "displayName",
            "s02ldap_user_display_name_2": "",
            "s02ldap_user_avatar_rule": "default",
            "s02ldap_gid_number": "gidNumber",
            "s02ldap_userfilter_objectclass": "",
            "s02ldap_userfilter_groups": "",
            "s02ldap_userlist_filter": "",
            "s02ldap_user_filter_mode": "0",
            "s02ldap_group_filter": "",
            "s02ldap_group_filter_mode": "0",
            "s02ldap_groupfilter_objectclass": "",
            "s02ldap_groupfilter_groups": "",
            "s02ldap_group_display_name": "cn",
            "s02ldap_group_member_assoc_attribute": "",
            "s02ldap_login_filter": "",
            "s02ldap_login_filter_mode": "0",
            "s02ldap_loginfilter_email": "0",
            "s02ldap_loginfilter_username": "1",
            "s02ldap_loginfilter_attributes": "",
            "s02ldap_quota_attr": "",
            "s02ldap_quota_def": "",
            "s02ldap_email_attr": "",
            "s02ldap_cache_ttl": "600",
            "s02ldap_override_main_server": "",
            "s02ldap_configuration_active": "0",
            "s02ldap_attributes_for_user_search": "",
            "s02ldap_attributes_for_group_search": "",
            "s02ldap_experienced_admin": "0",
            "s02home_folder_naming_rule": "",
            "s02has_memberof_filter_support": "0",
            "s02use_memberof_to_detect_membership": "1",
            "s02ldap_expert_username_attr": "",
            "s02ldap_expert_uuid_user_attr": "",
            "s02ldap_expert_uuid_group_attr": "",
            "s02ldap_mark_remnants_as_disabled": "0",
            "s02last_jpegPhoto_lookup": "0",
            "s02ldap_nested_groups": "0",
            "s02ldap_paging_size": "500",
            "s02ldap_turn_on_pwd_change": "0",
            "s02ldap_dynamic_group_member_url": "",
            "s02ldap_default_ppolicy_dn": "",
            "s02ldap_ext_storage_home_attribute": "",
            "s02ldap_matching_rule_in_chain_state": "unknown",
            "s02ldap_connection_timeout": "15",
            "s02ldap_attr_phone": "",
            "s02ldap_attr_website": "",
            "s02ldap_attr_address": "",
            "s02ldap_attr_twitter": "",
            "s02ldap_attr_fediverse": "",
            "s02ldap_attr_organisation": "",
            "s02ldap_attr_role": "",
            "s02ldap_attr_headline": "",
            "s02ldap_attr_biography": "",
            "s02ldap_admin_group": "",
            "s02ldap_host": "ldap:\/\/***REMOVED SENSITIVE VALUE***",
            "s02_lastChange": "1705590449",
            "s01ldap_login_filter": "***REMOVED SENSITIVE VALUE***",
            "background_sync_prefix": "s01",
            "background_sync_offset": "0",
            "background_sync_interval": "43200"
        },
        "user_status": {
            "types": "",
            "enabled": "yes",
            "installed_version": "1.8.1"
        },
        "viewer": {
            "types": "",
            "enabled": "yes",
            "installed_version": "2.2.0"
        },
        "weather_status": {
            "types": "",
            "enabled": "yes",
            "installed_version": "1.8.0"
        },
        "workflowengine": {
            "types": "filesystem",
            "enabled": "yes",
            "installed_version": "2.10.0"
        }
    }
}

The output of your Apache/nginx/system log in /var/log/____:

2024-04-22T18:28:07.708459920Z {"level":"error","ts":1713810487.7081113,"logger":"tls.renew","msg":"could not get certificate from issuer","identifier":"***REMOVED SENSITIVE VALUE***","issuer":"acme-v02.api.letsencrypt.org-directory","error":"HTTP 400 urn:ietf:params:acme:error:connection - During secondary validation: ***REMOVED SENSITIVE VALUE***: Timeout during connect (likely firewall problem)"}
2024-04-22T18:28:07.708889547Z {"level":"error","ts":1713810487.70817,"logger":"tls.renew","msg":"will retry","error":"[***REMOVED SENSITIVE VALUE***] Renew: [***REMOVED SENSITIVE VALUE***] solving challenge: ***REMOVED SENSITIVE VALUE***: [***REMOVED SENSITIVE VALUE***] authorization failed: HTTP 400 urn:ietf:params:acme:error:connection - During secondary validation: ***REMOVED SENSITIVE VALUE***: Timeout during connect (likely firewall problem) (ca=https://acme-v02.api.letsencrypt.org/directory)","attempt":1,"retrying_in":60,"elapsed":11.05144242,"max_duration":2592000}

Since the last successful ACME renewal in January, the certificate renewal has stopped working. The error indicates a timeout as if the port wasn’t forwarded, but tcpdump on the Nextcloud server shows port 80 traffic coming in from the ACME server as well as responses going back out. The DNS entry is also correct, and the system is up and running apart from the expired certificate. I can’t see any reason the validation would be failing.

We had a NAT issue in a new firewall that was originally causing the problem. After correcting that, the AIO admin interface updated its certificate and is now valid, but Nextcloud still has an expired certificate and won’t renew due to this validation issue.

What else can I do to troubleshoot this?

Hi, maybe this helps? What can I do when Nextcloud is not reachable via my domain or if I get `SSL_ERROR_INTERNAL_ERROR_ALERT` or `ERR_SSL_PROTOCOL_ERROR` when opening my Nextcloud domain? · nextcloud/all-in-one · Discussion #2105 · GitHub

There is no AAAA record and no CloudFlare tunnel.

The nextcloud.log aims to a different error. You should check the /var/log/apache2/access_log for more information as well as the /var/log/letsencrypt.log.

These files don’t exist in the nextcloud-aio-apache container that’s showing the above ACME error in the docker logs.

I fear the log is pretty clear on what is wrong…

Btw, the apache container uses the tls-alpn challenge by default: Challenge Typen - Let's Encrypt - Freie SSL/TLS Zertifikate

Yes, and normally I would agree as firewall and DNS issues account for nearly all ACME challenge problems… but what am I missing? I don’t see how it can be a timeout if I can see the packets in tcpdump with it talking back and forth. That means that it found the correct DNS entry and that the firewall is forwarding packets to the server.

How could it renew the certificate for the AIO admin page if the firewall setup was incorrect? I have a NC cert that expired 4/16 and a AIO admin page cert that was issued 4/19.

Is there any way I can look at the challenge or manually run it so I can see more about what’s going on?

Ah, so the aio admin page renewal is failing and not the one for the apache container?

Other way around. The admin page renewal worked, Apache container renewal was failing.

Okay, I believe the key factor was that it was doing the validation over port 443. It’s fixed now. Here’s what happened.

On the new firewall, I limited incoming connections to only allow United States IPs. When the validation failed, I opened port 80 world wide to allow validation using foreign Let’s Encrypt servers, with the understanding that Nextcloud login attempts could not be attempted on port 80. This way port 443 is still protected from foreign hacking attempts. When the port is open world wide, it’s constantly getting hammered from places that have nothing to do with it. And that doesn’t explain why I was seeing a challenge come back on port 80 and then fail.

Unfortunately this means I can’t lock down port 443. Since LE doesn’t publish their server IPs, I can’t make exceptions for them. I’ll have to see what else I can do to protect it.

2 Likes