TLS challenge validation fails

Traefik Traefik v2
1

Hi,

I am maintaining a Non-Letsencrypt ACME server implementation. One of my users did contact me claiming that certificate enrollment does not work when using tls-alpn-01 challenge validation. I think i was able to replicate the issue in my lab by using your reference config with some smaller modifications.

version: '3.3'

services:
  traefik:
    image: traefik:latest
    container_name: "traefik"    
    command: 
      - "--log.level=DEBUG"    
      - "--api.insecure=true" 
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.web.address=:80"       
      - "--entrypoints.websecure.address=:443" 
      - "--certificatesresolvers.myresolver.acme.tlschallenge=true"
      # - "--certificatesresolvers.myresolver.acme.httpchallenge.entrypoint=web"      
      - "--certificatesresolvers.myresolver.acme.caserver=http://192.168.14.1/directory"
      - "--certificatesresolvers.myresolver.acme.email=grindsa@foo.bar"
      - "--certificatesresolvers.myresolver.acme.storage=/letsencrypt/acme.json"      
    ports:
      - "80:80"
      - "443:443"      
      - "8080:8080"
    volumes:
      - "./letsencrypt:/letsencrypt"      
      - "/var/run/docker.sock:/var/run/docker.sock"

  whoami:
    image: traefik/whoami
    labels:
      - "traefik.enable=true"    
      - "traefik.http.routers.whoami.rule=Host(`whoami.bar.local`)"
      - "traefik.http.routers.whoami.entrypoints=web,websecure"
      # - "traefik.http.routers.whoami.entrypoints=websecure"
      - "traefik.http.routers.whoami.tls.certresolver=myresolver"

I see that the challenge validation failes on the acme-server as the certificate presented by traeffik is wrong/missing the respective SAN and certificate extension fields. Below an example certificate which gets presented to acme-server.

-----BEGIN CERTIFICATE-----
MIIDXjCCAkagAwIBAgIRAOmGOJ9jzfO1hZSSYdfGCKwwDQYJKoZIhvcNAQELBQAw
HzEdMBsGA1UEAxMUVFJBRUZJSyBERUZBVUxUIENFUlQwHhcNMjMwNTI5MTIxMzIy
WhcNMjQwNTI4MTIxMzIyWjAfMR0wGwYDVQQDExRUUkFFRklLIERFRkFVTFQgQ0VS
VDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANJMdTn+gKgI6IRvyWOV
/QNibiCCA0OOq//1fh/xzGjuhE+KB2gOaSZ/2eazV5X/8n5EcZMVxcy0z0/+piBe
bAmE5qnf5OHyWBrjLv5E/rgoEU4tNKAqI+0yzS/1CXFb0c18/Bz4nm45Z+ISlNJU
rNLj72nO/xxZZkOdqgDtJdd0PyQkUUk0qMJGYiG37yQgSRv0rohZB+MYenvj8Ebr
psxWYHNoeV4jVlMmQQ53euTUjoMBEudVht/ox81cW+Pvf+/2RByLawAZE+uY/K6O
N/li4BlP25dGbkNoJapO0S41rzRlKi1ne2nZPSeiJkvGWKS4C0q2wRwOKa6AddoU
wesCAwEAAaOBlDCBkTAOBgNVHQ8BAf8EBAMCA7gwEwYDVR0lBAwwCgYIKwYBBQUH
AwEwDAYDVR0TAQH/BAIwADBcBgNVHREEVTBTglEwNjdhNmZkM2QyYWUzMDZkY2Jj
MGQ5MjhmMGY2MTgzMS5jOTU2ZDU4MzM5NDk1OTc4ZDRiZDMxYWE2ZmZhOTkyZC50
cmFlZmlrLmRlZmF1bHQwDQYJKoZIhvcNAQELBQADggEBAExSSlZhSQ984FAlLbCv
7E8DwEh+tAb2noupQSgjp1r1J+29hXtCvPNoAQOw2ZcXFyVQeQ+nYLhN8DLJNcHc
SvrJ9u/q1h9bPi+ft36QQ1UF/NUCM6RIQDkf7kDIUvdD41m0WkRVTyT6RZiK8K3+
x2NIUcAd4JyrZSXe1Hil2bgGtqzz9+UuFO0Hv/FuK81v3m74ZPZAYX1q2Eyux/q7
4011AP9PWX7G2HfN+m7GpbBgBtQVxGG9hAdu1RcfENGGlHtmAyeoLz3kjxcIFksH
PUjNDhv3LgHtIkzu7CWiF9AeariOKCmnXefOXAZT37Jj4rckFk9mKHJjnVCvr23a
03U=
-----END CERTIFICATE-----

CN=TRAEFIK DEFAULT CERT
SAN=DNS:067a6fd3d2ae306dcbc0d928f0f61831.c956d58339495978d4bd31aa6ffa992d.traefik.default

Is my configuration incomplete or did i get hit by a bug?

Thank you for your help and have a nice day.

/G.

2

Your setup probably does not work because you have a private hostname. For LetsEncrypt validation you need a public domain name.

Optionally check this simple Traefik example.

3

I am not using LE but a private acme server which does allow private domains.

Further challenge validation via http-01 works without issues. Only when using tls-alpn-01 validation fails as my traefik instance does present the wrong certificate vor validation.

BR G.

4

Traefik uses le-go, maybe their community can help better. They probably have a similar forum.

5

Thank you for your answer. I meanwhile found the issue by myself.

It seems that Traefik routes the validation requests coming from the acme-server based on the ALPN extension included in the ClientHello message. This was missing in my implementation. After adding the extension with a correct protocol name ("acme-tls/1") everything works as expected.

1 Like
6

This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.