Caddy: Failed to get certificate: The server could not validate our request.

Created on 2 Jan 2016 · 18Comments · Source: caddyserver/caddy

Hi,
I want to use https with my config but i don't know why i have this error :
"./caddy -conf="test/Caddyfile" -agree
Activating privacy features...
2016/01/02 21:47:09 [test.qlaffont.com] failed to get certificate: The server could not validate our request.".

This is my config file:

localhost:80, test.qlaffont.com {
    startup php-cgi -b 127.0.0.1:9000 &
    bind 1925.168.1.163:80 
    errors {
        log error.log
    }
    browse
    root /home/uiop/Bureau/test
    ext .html .htm .php 
    fastcgi / 127.0.0.1:9000 {
        ext   .php
        split .php
        index index.php
    }
    gzip
    basicauth /secret Bob mdp 
    rewrite /contact /secret
    tls [email protected]
}

Thanks for all.
QL.

question

Source

qlaffont

All 18 comments

Run with -log stderr and report back all the output. Thanks!

mholt on 3 Jan 2016

Thanks. This is the output :
root@debian:/home/uiop/Bureau# ./caddy -conf="test/Caddyfile" -agree -email "qlaffont13.[email protected]" -log stderr
Activating privacy features...2016/01/03 09:45:45 [INFO] acme: Obtaining bundled certificates for test.qlaffont.com
2016/01/03 09:45:45 [INFO] acme: Trying to solve TLS-SNI-01

2016/01/03 09:45:47 [test.qlaffont.com] failed to get certificate: The server could not validate our request.
Thanks
QL.

qlaffont on 3 Jan 2016

@mholt after that if you want i can traduce your doc + your presentation page on french language.

qlaffont on 3 Jan 2016

    bind 1925.168.1.163:80
            ^

Probably not related to the issue but just noticed this.

hubertbanas on 3 Jan 2016

😄1

wtf xD. i check this

qlaffont on 3 Jan 2016

Thanx @hubertbanas I correct and I have the output. "
root@debian:/home/uiop/Bureau# ./caddy -conf="www/Caddyfile" -agree -email "qlaffont13.[email protected]" -log stderr
Activating privacy features...2016/01/03 17:03:35 [INFO] acme: Obtaining bundled certificates for test.qlaffont.com
2016/01/03 17:03:35 [INFO] acme: Trying to solve TLS-SNI-01

2016/01/03 17:03:38 [test.qlaffont.com] failed to get certificate: The server could not validate our request.
"

qlaffont on 3 Jan 2016

The most likely reason for this is that you're behind a load balancer or SSL terminator. Or the domain is not pointing to your machine. Any of those relevant to you?

mholt on 3 Jan 2016

I'm soing some test on linux server ( on a virtual machine powered by virtualbox). Test.qlaffont.com have the same ip that my local machine.
And i'm not behind a load balancer or ssl terminator.

qlaffont on 3 Jan 2016

That's the problem.

$ nslookup test.qlaffont.com
Server:     8.8.8.8
Address:    8.8.8.8#53

Non-authoritative answer:
Name:   Test.qlaffont.com
Address: 192.168.1.163

It resolves to an internal IP. It must be globally resolvable for LE to issue a cert successfully.

mholt on 3 Jan 2016

Yes it's work on my dedicated server. Thanks for all QL.

qlaffont on 3 Jan 2016

👍1

@Fristing Don't let me forget about your offer to translate the docs into French. :smile: Maybe post a comment in #337 which is related.

mholt on 6 Jan 2016

no problem ^^

qlaffont on 6 Jan 2016

_"...the domain is not pointing to your machine."_
Precisely my problem. I'm using a CDN so it doesn't issue a certificate. How can I get around it?

yitzhakbg on 18 Jan 2016

@yitzhakbg You'll have to wait until the dns-01 challenge is supported by Let's Encrypt. They're working on it; it's already on in their staging environment, but it's a little rough around the edges still. The DNS challenge simply requires them to do a DNS lookup rather than making requests to your machine.

mholt on 19 Jan 2016

body p { margin-bottom: 0cm; margin-top: 0pt; } 


Thanks.

On 19/1/16 01:59, Matt Holt wrote:


  @yitzhakbg You'll have to wait until
    the dns-01 challenge is supported by Let's Encrypt. They're
    working on it; it's already on in their staging environment, but
    it's a little rough around the edges still. The DNS challenge
    simply requires them to do a DNS lookup rather than making
    requests to your machine.
  —
    Reply to this email directly or view
      it on GitHub.

yitzhakbg on 19 Jan 2016