Docker-letsencrypt-nginx-proxy-companion: LetsEncrypt challenge fails with nginx-proxy:latest

[elifiner]

I'm using the following docker-compose.yml with nginx-proxy:latest and getting an error (see below). Using nginx-proxy:alpine in this setup works fine.

version: '2'

services:
  nginx-proxy:
    image: jwilder/nginx-proxy:latest
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - /var/run/docker.sock:/tmp/docker.sock:ro
      - /etc/nginx/certs
      - /etc/nginx/vhost.d
      - /usr/share/nginx/html

  nginx-proxy-letsencrypt:
    image: jrcs/letsencrypt-nginx-proxy-companion
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    volumes_from:
      - nginx-proxy

  whoami:
    image: jwilder/whoami
    environment:
      - VIRTUAL_HOST=whoami.mp0.rbgapp.com
      - LETSENCRYPT_HOST=whoami.mp0.rbgapp.com

And getting the following error:

nginx-proxy-letsencrypt_1  | 2019-05-19 03:00:11,836:ERROR:simp_le:1446: CA marked some of the authorizations as invalid, which likely means it could not access http://example.com/.well-known/acme-challenge/X. Did you set correct path in -d example.com:path or --default_root? Are all your domains accessible from the internet? Please check your domains' DNS entries, your host's network/firewall setup and your webserver config. If a domain's DNS entry has both A and AAAA fields set up, some CAs such as Let's Encrypt will perform the challenge validation over IPv6. If your DNS provider does not answer correctly to CAA records request, Let's Encrypt won't issue a certificate for your domain (see https://letsencrypt.org/docs/caa/). Failing authorizations: https://acme-v01.api.letsencrypt.org/acme/authz/_o4LwxfsGhU_5nmrqrX94whYgjf4RUlsM1U9RjkJ-I0

Looking at https://acme-v01.api.letsencrypt.org/acme/authz/_o4LwxfsGhU_5nmrqrX94whYgjf4RUlsM1U9RjkJ-I0 it seems nginx-proxy just called the whoami container and didn't respond with the LE challenge.

Might be enough to just mention in the README that this only supports the (newer?) alpine image.

[buchdag]

Might be enough to just mention in the README that this only supports the (newer?) alpine image.

I don't understand this sentence, which newer alpine image of which project are you referring to ? nginx-proxy ? If yes, our test suite runs with jwilder/nginx-proxy:latest just fine.

[DevopsDood]

@elifiner same issue. Just use jrcs/letsencrypt-nginx-proxy-companion:v1.11 and it will start working again

[buchdag]

This a nginx-proxy issue : the repository's Dockerhub autobuild appears to be broken and latest does not actually include the latest commits, specifically this one https://github.com/jwilder/nginx-proxy/pull/1213 (I just checked that on freshly pulled jwilder/nginx-proxy:latest).

The failure mechanism is the same as described here https://github.com/JrCs/docker-letsencrypt-nginx-proxy-companion/issues/543#issuecomment-493996267, but this time with nginx-proxy DH parameters.

fixes for now are :

• building nginx-proxy from source (what I just tested to confirm this).
• waiting for the nginx-proxy container to generate its DH parameters before creating proxyed containers.
• generating a DH parameters file yourself and mounting it at /etc/nginx/dhparam/dhparam.pem

The test suite does not fail because we lower the DH parameters bit size to 256 bits for both containers (the DH parameters generation is very CPU intensive and keeping the default 2048 bits can cause issues with Travis CI small VMs).

[elifiner]

That explains it. I think Docker Hub have recently changed the required
permissions to run the automated builds which caused quite a few projects
to stop updating. Thanks!

On Mon, May 20, 2019, 15:09 Nicolas Duchon [e-mail] wrote:

This a nginx-proxy issue : the repository's Dockerhub autobuild appears
to be broken and latest does not actually include the latest commits,
specifically this one jwilder/nginx-proxy#1213
https://github.com/jwilder/nginx-proxy/pull/1213 (I just checked that
on freshly pulled jwilder/nginx-proxy:latest).

The failure mechanism is the same as described here #543 (comment)
https://github.com/JrCs/docker-letsencrypt-nginx-proxy-companion/issues/543#issuecomment-493996267,
but this time with nginx-proxy DH parameters.

fixes for now are :

• building nginx-proxy from source (what I just tested to confirm
  this).
• waiting for the nginx-proxy container to generate its DH parameters
  before creating proxyed containers.
• generating a DH parameters file yourself and mounting it at
  /etc/nginx/dhparam/dhparam.pem

The test suite does not fail because we lower the DH parameters bit size
to 256 bits for both containers (the DH parameters generation is very CPU
intensive and keeping the default 2048 bits can cause issues with Travis CI
small VMs).

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
https://github.com/JrCs/docker-letsencrypt-nginx-proxy-companion/issues/544?email_source=notifications&email_token=AAGHNNI72EEPMAVWFQB7DFTPWMOQJA5CNFSM4HN3RUGKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGODV2GTMI#issuecomment-494168497,
or mute the thread
https://github.com/notifications/unsubscribe-auth/AAGHNNM3JZ65FFHY75X656TPWMOQJANCNFSM4HN3RUGA
.

[buchdag]

I opened an issue at nginx-proxy's repo if you want to ping jwilder https://github.com/jwilder/nginx-proxy/issues/1279

Hopefully this will be fixed in less than a year.

[buchdag]

This has been fixed upstream, glad I was proven wrong.