Need assistance in private beta...

[sharpner]

Hi sorry if this is more of a stupid error by me, but I can't get lego to work on my server.

Running letsencryt-auto works and creates certificates:
/opt/letsencrypt/letsencrypt-auto --agree-dev-preview --server https://acme-v01.api.letsencrypt.org/directory auth -d sub.mydomain.com--standalone

Running lego:

./Go/bin/lego --domains=sub.mydomain.com -B 4096 --email="sharpner@mydomain.com" --port 10443 -s "https://acme-v01.api.letsencrypt.org/" run

gets me:

2015/11/20 16:24:52 [INFO] acme: Obtaining bundled SAN certificate for mydomain.com
2015/11/20 16:24:53 [INFO] acme: Trying to solve HTTP-01
2015/11/20 16:24:54 [mydomain.com] Could not obtain certificates
    The server could not validate our request.

Can you help me out here? I even tried the add-tls-sni-challenge branch, but with the same results.

[xenolf]

Is there an active proxy listening on port 80 which forwards traffic to the opt port 10443 you told lego to bind to?

LE will try to access your server on port 80 for HTTP-01.

[sharpner]

damn thank you. I hoped I would be able to use a different port than either 80/443. It sucks to disable the nginx to update the certificates.

But it works now, awesome =)

[xenolf]

You don't have to disable nginx. That's what the optPort is for. You could just add a temporary proxy directive to the nginx config to pass all traffic on the path /.well-known/acme/ to port 10443. :)

[sharpner]

let me try this. Thanks for the support! :-)

[xenolf]

No problem. I know that this is kind of a convoluted way to work around nginx at the moment but as soon as we merge #32 and #16 we are able to put the token into the nginx webroot to let nginx serve it.

[sharpner]

its also hard to find that workaround in the first place.

You probably have to read the whole spec get which folder to proxy.

[xenolf]

I agree. I should probably improve the documentation on what optPort is for.

[sharpner]

Thanks for the awesome project btw.

[xenolf]

My pleasure :)

[sharpner]

Just for the record, that's the nginx proxy i used:

      location /.well-known/acme-challenge/ {
                proxy_ssl_session_reuse off;

                proxy_set_header        X-Forwarded-Proto $scheme;
                add_header              Front-End-Https   on;
                add_header Strict-Transport-Security "max-age=31536000";

                proxy_set_header X-Real-IP $remote_addr;
                proxy_set_header X-Forwarded-For $remote_addr;
                proxy_set_header Host $http_host;

                proxy_pass http://172.17.42.1:9999;
       }

Thanks again :D