Boulder: http-01 testing error

[qiuxiangdong]

Hi folks,

I am trying to run the testing file "chisel2.py" in the following way.

First start up all the services by:
docker-compose up
Then run python2 chisel2.py foo.com bar.com

In the chisel2.py I changed the default "challenge_type" in method "auth_and_issue" to be "http-01".

I got the following error info on the client side:
Traceback (most recent call last): File "chisel2.py", line 210, in <module> auth_and_issue(domains) File "chisel2.py", line 117, in auth_and_issue order = client.poll_and_finalize(order) File "/usr/local/lib/python2.7/site-packages/acme/client.py", line 634, in poll_and_finalize orderr = self.poll_authorizations(orderr, deadline) File "/usr/local/lib/python2.7/site-packages/acme/client.py", line 658, in poll_authorizations raise errors.ValidationError(failed) acme.errors.ValidationError

And the following error info on the server end:
boulder_1 | I000604 boulder-va HTTP request to http://foo.com:5002/.well-known/acme-challenge/YWf7riWU3usmuRz5Hyd40tC6RJnz4UUvzOvsDmqq5Ts failed. err=[&url.Error{Op:"Get", URL:"http://foo.com:5002/.well-known/acme-challenge/YWf7riWU3usmuRz5Hyd40tC6RJnz4UUvzOvsDmqq5Ts", Err:(*net.OpError)(0xc42049c500)}] errStr=[Get http://foo.com:5002/.well-known/acme-challenge/YWf7riWU3usmuRz5Hyd40tC6RJnz4UUvzOvsDmqq5Ts: dial tcp 127.0.0.1:5002: connect: connection refused]

Your help will be appreciated! :)

[cpu]

Hi @qiuxiangdong

It looks like you aren't setting the FAKE_DNS environment variable/docker-compose.yml setting to point to your host machine where you are running Chisel2. By default Boulder resolves all hostnames to 127.0.0.1 and since Chisel2 isn't running inside of the container on the loopback address the validation challenge requests are refused.

Check out the advice from the README:

By default, Boulder uses a fake DNS resolver that resolves all hostnames to 127.0.0.1. This is suitable for running integration tests inside the Docker container. If you want Boulder to be able to communicate with a client running on your host instead, you should find your host's Docker IP with:

ifconfig docker0 | grep "inet addr:" | cut -d: -f2 | awk '{ print $1}'
And edit docker-compose.yml to change the FAKE_DNS environment variable to match.

Alternatively, you can override the docker-compose.yml default with an environmental variable using -e (replace 172.17.0.1 with the host IPv4 address found in the command above)

Hope that helps!

[qiuxiangdong]

That works! :D Thanks @cpu