Boulder: TLS-SNI-01 challenge fail

[zosocanuck]

Hi,

I've run ./test/run-docker.sh and using certbot as the client:

certbot_test certonly -a standalone -d example.com

and getting the failed challenge message:

File "/root/certbot/certbot/auth_handler.py", line 195, in _poll_challenges
raise errors.FailedChallenges(all_failed_achalls)
FailedChallenges: Failed authorization procedure. example.com (tls-sni-01): urn:acme:error:connection :: The server could not connect to the client to verify the domain :: Failed to connect to 127.0.0.1:5001 for TLS-SNI-01 challenge

IMPORTANT NOTES:

• The following errors were reported by the server:

Domain: example.com
Type: connection
Detail: Failed to connect to 127.0.0.1:5001 for TLS-SNI-01
challenge

Am I missing anything from the config?

[jsha]

You should find the IP of the docker interface via ifconfig. Mine is usually 172.17.0.1. You should set the FAKE_DNS env variable to this when running run-docker.sh:

FAKE_DNS=172.17.0.1 ./test/run-docker.sh

Note that two of us are doing our main development using the docker-compose method, not the ./test/run-docker.sh method, so you may have better luck with the former. When using docker-compose you'll want to edit in the FAKE_DNS var in docker-compose.yml, or specify it on command line like:

docker-compose run -e FAKE_DNS=172.17.0.1 boulder

[zosocanuck]

ok getting further... but when running certbot_test certonly -a standalone -d example i get:

Traceback (most recent call last):
File "/root/certbot/venv/bin/certbot", line 9, in
load_entry_point('certbot', 'console_scripts', 'certbot')()
File "/root/certbot/certbot/main.py", line 735, in main
return config.func(config, plugins)
File "/root/certbot/certbot/main.py", line 549, in obtain_cert
le_client = _init_le_client(config, auth, installer)
File "/root/certbot/certbot/main.py", line 366, in _init_le_client
return client.Client(config, acc, authenticator, installer, acme=acme)
File "/root/certbot/certbot/client.py", line 184, in __init__
acme = acme_from_config_key(config, self.account.key)
File "/root/certbot/certbot/client.py", line 42, in acme_from_config_key
return acme_client.Client(config.server, key=key, net=net)
File "/root/certbot/acme/acme/client.py", line 63, in init
self.net.get(directory).json())
File "/root/certbot/acme/acme/client.py", line 631, in get
self._send_request('GET', url, *_kwargs), content_type=content_type)
File "/root/certbot/acme/acme/client.py", line 613, in _send_request
response = self.session.request(method, url, *args, *_kwargs)
File "/root/certbot/venv/lib/python2.7/site-packages/requests/sessions.py", line 475, in request
resp = self.send(prep, *_send_kwargs)
File "/root/certbot/venv/lib/python2.7/site-packages/requests/sessions.py", line 585, in send
r = adapter.send(request, *_kwargs)
File "/root/certbot/venv/lib/python2.7/site-packages/requests/adapters.py", line 467, in send
raise ConnectionError(e, request=request)
ConnectionError: HTTPConnectionPool(host='localhost', port=4000): Max retries exceeded with url: /directory (Caused by NewConnectionError(': Failed to establish a new connection: [Errno 111] Connection refused',))

[jsha]

Yep - we were just debugging this today. First, make sure you're on the very latet master. Second, add -e BOULDER_CONFIG=test/boulder-config-next.json to the command line. This uses the "next" config, which among other things fixes up directory URLs. Then, re-run certbot_test but add --server http://172.17.0.4:4000/directory. Assuming your Boulder container is running on that IP.

[zosocanuck]

Now I get this:

[root@localhost test]# docker-compose run -e FAKE_DNS=172.17.0.1 -e BOULDER_CONFIG=/home/iwallis/work/src/github.com/letsencrypt/boulder/test/builder-config-next.json boulder
[ ok ] Starting enhanced syslogd: rsyslogd.
Databases already created.
started exec listenbuddy -listen :5673 -speak boulder-rabbitmq:5672 with pid 49
export GO15VENDOREXPERIMENT=1
GOBIN=/go/src/github.com/letsencrypt/boulder/bin go install ./...
E182432 boulder-wfe [AUDIT] Unable to read config file: open /home/iwallis/work/src/github.com/letsencrypt/boulder/test/builder-config-next.json: no such file or directory
Unable to read config file: open /home/iwallis/work/src/github.com/letsencrypt/boulder/test/builder-config-next.json: no such file or directory

[cpu]

Hi @zosocanuck - you have a typo in your config filename. It should be boulder-config-next.json instead of builder-config-next.json

[zosocanuck]

good catch. still getting the same max tries exceeded error message, even with the changes recommended by @jsha

[jsha]

You need to add --service-ports in your docker-compose run command. We've added this to the README now.