Letsencrypt is unable to generate a certificate for the domains

Traefik Traefik v2
,
1

Hi,

I'm testing with Whoami and get an issue generating the certificates.

Here is the error :slight_smile:

traefik         | time="2019-10-14T21:16:15Z" level=error msg="Unable to obtain ACME certificate for domains \"inner-whoami.mysite.com\": unable to generate a certificate for the domains [inner-whoami.mysite.com]: acme: Error -> One or more domains had a problem:\n[inner-whoami.mysite.com] acme: error: 403 :: urn:ietf:params:acme:error:unauthorized :: Invalid response from https://inner-whoami.mysite.com/.well-known/acme-challenge/xxxxxxxxxxxxxxxxxxxx [51.75.207.100]: \"Hostname: xxxxxxxxxx\\nIP: 127.0.0.1\\nIP: 172.18.0.2\\nRemoteAddr: 172.18.0.3:55692\\nGET /.well-known/acme-challenge/xxxxxxxxxx\", url: \n" rule="Host(`inner-whoami.mysite.com`)" routerName=inner-whoami-secured providerName=myhttpchallenge.acme
traefik         | time="2019-10-14T21:16:17Z" level=debug msg="legolog: [INFO] Unable to deactivate the authorization: https://acme-v02.api.letsencrypt.org/acme/authz-v3/xxxxxxxxxx"

Here is the docker-compose.yml file :slight_smile:

version: "3.3"

networks:
    # Allow the use of traefik in other docker-compose.yml files
    traefik:
        external: true

services:

  traefik:
    image: "traefik:v2.0"
    container_name: "traefik"
    command:
      # Only for development environment
      - "--log.level=DEBUG"
      - "--api.insecure=true"
      # Get Docker as the provider
      - "--providers.docker=true"
      # Avoid that all containers are exposed
      - "--providers.docker.exposedbydefault=false"
      # Settle the ports for the entry points
      - "--entrypoints.web.address=:80"
      - "--entrypoints.web-secure.address=:443"
      # Settle the autentification method to http challenge
      - "--certificatesresolvers.myhttpchallenge.acme.httpchallenge=true"
      - "--certificatesresolvers.myhttpchallenge.acme.httpchallenge.entrypoint=web-secure"
      # Uncomment this to get a fake certificate when testing
      #- "--certificatesresolvers.myhttpchallenge.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory"
      # Settle letsencrypt as the certificate provider
      - "--certificatesresolvers.myhttpchallenge.acme.email=me@mail.com"
      - "--certificatesresolvers.myhttpchallenge.acme.storage=/letsencrypt/acme.json"
    ports:
      - "80:80"
      - "443:443"
      - "8080:8080"
    networks:
      - "traefik"
    volumes:
      # Store certificates in ./letsencrypt/acme.json
      - "./letsencrypt:/letsencrypt"
      # Connect to Doker socket
      - "/var/run/docker.sock:/var/run/docker.sock:ro"

  inner-whoami:
    image: "containous/whoami"
    container_name: "inner-whoami"
    networks:
      - "traefik"
    labels:
      - "traefik.enable=true"
      # Get the routes from http
      - "traefik.http.routers.inner-whoami.rule=Host(`inner-whoami.mysite.com`)"
      - "traefik.http.routers.inner-whoami.entrypoints=web"
      # Redirect these routes to https
      - "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"
      - "traefik.http.routers.inner-whoami.middlewares=redirect-to-https@docker"
      # Get the routes from https
      - "traefik.http.routers.inner-whoami-secured.rule=Host(`inner-whoami.mysite.com`)"
      - "traefik.http.routers.inner-whoami-secured.entrypoints=web-secure"
      # Apply autentificiation with http challenge
      - "traefik.http.routers.inner-whoami-secured.tls=true"
      - "traefik.http.routers.inner-whoami-secured.tls.certresolver=myhttpchallenge"
2

Hello,

the HTTP challenge require the port 80.

--certificatesresolvers.myhttpchallenge.acme.httpchallenge.entrypoint=web

https://docs.traefik.io/v2.0/https/acme/#httpchallenge

1 Like
3

Thanks. It works like a charm now...