Ejabberd: ACME validation fails with Let's Encrypt staging CA

[alexrudd]

Hi there,

What version of ejabberd are you using?

18.4.0

What operating system (version) are you using?

Docker: ejabberd/ecs:18.04
OS: CoreOS 1745.3.1

How did you install ejabberd (source, package, distribution)?

Docker image

What did not work as expected?

Ejabberd ACME support with Let's Encrypt staging CA

Are there error messages in the log?

[info] Registering hook for ACME HTTP headers
[info] (<0.544.0>) Accepted connection 52.29.173.72:35878 -> 172.17.0.2:8080
[info] (<0.545.0>) Accepted connection 66.133.109.36:52424 -> 172.17.0.2:8080
[error] Unable to serve key authorization in: [<<"acme-challenge">>,<<"ztjsYdUiIOKGDwAv****************************">>]
[info] (<0.546.0>) Accepted connection 13.58.30.69:55404 -> 172.17.0.2:8080
[error] Unable to serve key authorization in: [<<"acme-challenge">>,<<"ztjsYdUiIOKGDwAv****************************">>]
[info] (<0.547.0>) Accepted connection 34.213.106.112:35948 -> 172.17.0.2:8080
[error] Unable to serve key authorization in: [<<"acme-challenge">>,<<"ztjsYdUiIOKGDwAv****************************">>]
[error] Maximum request limit waiting for validation reached
[error] Error: {error,{badmatch,{error,max_request_limit}}} getting an authorization for domain: <<"test.chat.example.com">>
[info] Unregistering hook for ACME HTTP headers

What was the unexpected behavior?

Based on the example config comments I created a config with the following key parts:

hosts:
  - "test.chat.example.com"
...
listen:
  -
    port: 8080
    ip: "0.0.0.0"
    module: ejabberd_http
...
acme:
   contact: "mailto:[email protected]"
   ca_url: "https://acme-staging.api.letsencrypt.org"

Running ejabberdctl get_certificates all with this config returns the following:

Error for domain: "test.chat.example.com",  with reason: 'authorization'

And the log lines above.

If I use the production Let's Encrypt CA url it works successfully but while I'm in dev I'd like to be using the staging url so that I don't hit any rate limits.

Thanks,
Alex

[zinid]

ACME improvements is on my TODO list. I will try to solve all its accumulated problems by 18.08.

[alexrudd]

Great to hear. Thank you!

[Snowmanko]

ACME improvements is on my TODO list. I will try to solve all its accumulated problems by 18.08.

Any updates? I'am stucked at : [error] <0.606.0>@ejabberd_acme:create_new_account:286 Error: {error,badarg} creating an account for contact: <<"mailto:[email protected]">>

[zentavr]

I have the same issue with 18.12.1

[rsys-dev]

Same issue, also 18.12.1. Did anyone solve it?

[tomamplius]

I encountered this error only for renew certificate.
After comment this line it's work for renew cert.

ca_url: "https://acme-v01.api.letsencrypt.org"

[jwise]

Yep, with ca_url: "https://acme-v01.api.letsencrypt.org" uncommented, I get the [error] <0.606.0>@ejabberd_acme:create_new_account:286 error; with it commented out, I get the error,max_request_limit error.

[bijaykanshinew]

i am facing same issue with latest ejabberd.

[licaon-kter]

@bijaykanshinew which error?