Docker-letsencrypt-nginx-proxy-companion: CA marked some of the authorizations as invalid

[bassail]

Hello,

I have a problem with lets encrypt and my docker containers, and I really don't know what's wrong (I am new to Nginx and let's encrypt...)

Here is the docker-compose file I use to start Nginx proxy and lets encrypt companion :
```version: '3'
services:
proxy:
image: jwilder/nginx-proxy
restart: always
ports:
- 80:80
volumes:
- /var/run/docker.sock:/tmp/docker.sock:ro
- /home/user/tools/nginx_webproxy/certificats:/etc/nginx/certs:ro
- /etc/nginx/vhost.d
- /usr/share/nginx/html
labels:
- "com.github.jrcs.letsencrypt_nginx_proxy_companion.nginx_proxy"
networks:
- web
letsencrypt:
image: jrcs/letsencrypt-nginx-proxy-companion
depends_on:
- proxy
volumes:
- /var/run/docker.sock:/tmp/docker.sock:ro
- /etc/nginx/vhost.d
- /usr/share/nginx/html
- /home/user/tools/nginx_webproxy/certificats:/etc/nginx/certs:rw
- /var/run/docker.sock:/var/run/docker.sock:ro
networks:
web:
internal: false

And the container I want to be accessible : WikiJS 

version: '3'
services:
wikidb:
image: mongo:3
restart: always
expose:
- '27017'
command: '--smallfiles --bind_ip ::,0.0.0.0'
environment:
- 'MONGO_LOG_DIR=/dev/null'
volumes:
- /home/user/tools/wikijs/data/data:/data/db
networks:
- web
wikijs:
image: 'requarks/wiki:latest'
restart: always
depends_on:
- wikidb
ports:
- '5080:5080'
environment:
WIKI_ADMIN_EMAIL: [email protected]
VIRTUAL_HOST: sub.example.com
VIRTUAL_PORT: 5080
LETSENCRYPT_HOST: sub.example.com
LETSENCRYPT_EMAIL: [email protected]
volumes:
- /home/user/tools/wikijs/install/config.yml:/var/wiki/config.yml
- /home/user/tools/wikijs/data/repo:/var/wiki/repo
networks:
- web
networks:
web:
internal: false

The error I get is : 

Creating/renewal sub.example.com certificates... (sub.example.com)
2018-10-30 07:00:49,139:INFO:simp_le:1479: Generating new certificate private key
2018-10-30 07:00:52,461:ERROR:simp_le:1446: CA marked some of the authorizations as invalid, which likely means it could not access http://example.com/.well-known/acme-challenge/X. Did you set correct path in -d example.com:path or --default_root? Are all your domains accessible from the internet? Please check your domains' DNS entries, your host's network/firewall setup and your webserver config. If a domain's DNS entry has both A and AAAA fields set up, some CAs such as Let's Encrypt will perform the challenge validation over IPv6. If your DNS provider does not answer correctly to CAA records request, Let's Encrypt won't issue a certificate for your domain (see https://letsencrypt.org/docs/caa/). Failing authorizations: https://acme-v01.api.letsencrypt.org/acme/authz/redacted
Challenge validation has failed, see error log.

```

Did I do something wrong ?

[buchdag]

There are multiple issues with your compose files:

• your haven't published port 443 on your proxy container
• your nginx-proxy and letsencrypt-nginx-proxy-companion aren't sharing their vhost and html volumes.
• your proxyed service will be on a different network than the proxy itself

fast correction, I can't guarantee I've spotted everything:

first create a web network (or whatever other name suits you) with docker network create web

version: '3'

services:
  proxy:
    image: jwilder/nginx-proxy
    restart: always
    ports:
      - 80:80
      - 443:443
    volumes:      
      - vhost:/etc/nginx/vhost.d
      - html:/usr/share/nginx/html
      - /home/user/tools/nginx_webproxy/certificats:/etc/nginx/certs:ro
      - /var/run/docker.sock:/tmp/docker.sock:ro
    labels:
      - "com.github.jrcs.letsencrypt_nginx_proxy_companion.nginx_proxy"
    networks:
      - web

  letsencrypt:
    image: jrcs/letsencrypt-nginx-proxy-companion
    depends_on:
      - proxy
    volumes:
      - vhost:/etc/nginx/vhost.d
      - html:/usr/share/nginx/html
      - /home/user/tools/nginx_webproxy/certificats:/etc/nginx/certs:rw
      - /var/run/docker.sock:/var/run/docker.sock:ro
    networks:
      - web

networks:
  web:
    external: true

volumes:
  vhost:
  html:

version: '3'

services:
  wikidb:
    image: mongo:3
    restart: always
    expose:
      - '27017'
    command: '--smallfiles --bind_ip ::,0.0.0.0'
    environment:
      - 'MONGO_LOG_DIR=/dev/null'
    volumes:
      - /home/user/tools/wikijs/data/data:/data/db
    networks:
      - web

  wikijs:
    image: 'requarks/wiki:latest'
    restart: always
    depends_on:
      - wikidb
    ports:
      - '5080:5080'
    environment:
      WIKI_ADMIN_EMAIL: [email protected]
      VIRTUAL_HOST: sub.example.com
      VIRTUAL_PORT: 5080
      LETSENCRYPT_HOST: sub.example.com
      LETSENCRYPT_EMAIL: [email protected]
    volumes:
      - /home/user/tools/wikijs/install/config.yml:/var/wiki/config.yml
      - /home/user/tools/wikijs/data/repo:/var/wiki/repo
    networks:
      - web

networks:
  web:
    external: true

[bassail]

Well..

It works like a charm now !

Thank you very much, kind sir.

[kaishin]

Thanks! I had failing auth and the response above made me realize that the volumes weren't shared properly.

[zinnik1]

Hello i have same problem but with nextcloud... please can you help me its very important for me.
Sorry for my bad english

version: '3'

services:
  db:
    image: mariadb
    command: --transaction-isolation=READ-COMMITTED --binlog-format=ROW
    restart: always
    volumes:
      - /share/CACHEDEV1_DATA/Docker-Volumes/nextcloud/mariadb:/var/lib/mysql
    environment:
      - MYSQL_ROOT_PASSWORD=donchillo0501
    env_file:
      - db.env

  app:  
    image: nextcloud:fpm
    restart: always
    volumes:
      - /share/CACHEDEV1_DATA/Docker-Volumes/nextcloud/html:/var/www/html
    environment:
      - MYSQL_HOST=db
      - LETSENCRYPT_HOST=nextcloud.zinnik.de
      - [email protected]
    env_file:
      - db.env
    depends_on:
      - db

  web:
    build: ./web
    restart: always
    volumes:
      - /share/CACHEDEV1_DATA/Docker-Volumes/nextcloud/html:/var/www/html:ro
    environment:
      - VIRTUAL_HOST=nextcloud.zinnik.de
    depends_on:
      - app
    ports:
      - 4080:80
    networks:
      - proxy-tier
      - default

  proxy:
    build: ./proxy
    restart: always
    ports:
      - 443:443
      - 80:80
#    environment:
#      - VIRTUAL_PROTO=https
#      - VIRTUAL_PORT=443
    labels:
      com.github.jrcs.letsencrypt_nginx_proxy_companion.nginx_proxy: "true"
    volumes:
      - /share/CACHEDEV1_DATA/Docker-Volumes/nextcloud/nginx-certs:/etc/nginx/certs:ro
      - /share/CACHEDEV1_DATA/Docker-Volumes/nextcloud/nginx-vhost.d:/etc/nginx/vhost.d
      - /share/CACHEDEV1_DATA/Docker-Volumes/nextcloud/nginx-html:/usr/share/nginx/html
      - /share/CACHEDEV1_DATA/Docker-Volumes/nextcloud/nginx-conf.d:/etc/nginx/conf.d
      - /var/run/docker.sock:/tmp/docker.sock:ro
    networks:
      - proxy-tier

  letsencrypt-companion:
    image: jrcs/letsencrypt-nginx-proxy-companion
    restart: always
    volumes:
      - /share/CACHEDEV1_DATA/Docker-Volumes/nextcloud/nginx-certs:/etc/nginx/certs
      - /share/CACHEDEV1_DATA/Docker-Volumes/nextcloud/nginx-vhost.d:/etc/nginx/vhost.d
      - /share/CACHEDEV1_DATA/Docker-Volumes/nextcloud/nginx-html:/usr/share/nginx/html
      - /var/run/docker.sock:/var/run/docker.sock:ro
    networks:
      - proxy-tier
    depends_on:
      - proxy

networks:
  proxy-tier: