Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Quicksetup acme "cant find solver" "firewall problem?" #40

Closed
gusmorrison1 opened this issue May 5, 2024 · 10 comments
Closed

Quicksetup acme "cant find solver" "firewall problem?" #40

gusmorrison1 opened this issue May 5, 2024 · 10 comments

Comments

@gusmorrison1
Copy link

gusmorrison1 commented May 5, 2024 •
edited
Loading

I'm running a ubuntu jammy 24.04 vps on oracle cloud and a seperately hosted domain.
I followed all the steps in the "new" quicksetup in the booklet and everything worked fine running bootstrap.sh until task lego:enroll at letsencrypt.

I think its best if I just paste the error message here. I replaced what I thought was sensitive with IplaceholdersI

fatal: [localhost]: FAILED! => {"changed": true, "cmd": ["/usr/local/owntracks/lego/enroll.sh"], "delta": "0:00:18.573103", "end": "2024-05-04 22:08:31.223056", "msg": "non-zero return code", "rc": 1, "start": "2024-05-04 22:08:12.649953", "stderr": "", "stderr_lines": [], "stdout": "2024-05-04T22:08:12\n2024/05/04 22:08:13 

[INFO] [IdomainI] acme: Obtaining bundled SAN certificate\n2024/05/04 22:08:14 
[INFO] [IdomainI] AuthURL: https://acme-v02.api.letsencrypt.org/acme/authz-v3/IauthidI\n2024/05/04 22:08:14 
[INFO] [IdomainI] acme: Could not find solver for: tls-alpn-01\n2024/05/04 22:08:14
[INFO] [IdomainI] acme: use http-01 solver\n2024/05/04 22:08:14 
[INFO] [IdomainI] acme: Trying to solve HTTP-01\n2024/05/04 22:08:31 
[INFO] Deactivating auth: https://acme-v02.api.letsencrypt.org/acme/authz-v3/IauthidI\n2024/05/04 22:08:31 Could not obtain certificates:\n\terror: one or more domains had a problem:\n[IdomainI] acme: error: 400 :: urn:ietf:params:acme:error:connection
:: IIP-AddressI: Fetching http://IdomainI/.well-known/acme-challenge/Irandom lettersI: Timeout during connect (likely firewall problem), url: ", "stdout_lines": ["2024-05-04T22:08:12", "2024/05/04 22:08:13
 
[INFO] [IdomainI] acme: Obtaining bundled SAN certificate", "2024/05/04 22:08:14 
[INFO] [IdomainI] AuthURL: https://acme-v02.api.letsencrypt.org/acme/authz-v3/IauthidI", "2024/05/04 22:08:14 
[INFO] [IdomainI] acme: Could not find solver for: tls-alpn-01", "2024/05/04 22:08:14 
[INFO] [IdomainI] acme: use http-01 solver", "2024/05/04 22:08:14 
[INFO] [IdomainI] acme: Trying to solve HTTP-01", "2024/05/04 22:08:31 
[INFO] Deactivating auth: https://acme-v02.api.letsencrypt.org/acme/authz-v3/IauthidI", "2024/05/04 22:08:31 Could not obtain certificates:", "\terror: one or more domains had a problem:", "[IdomainI] acme: error: 400 :: urn:ietf:params:acme:error:connection :: IIP-AddressI: Fetching http://IdomainI/.well-known/acme-challenge/Irandom lettersI: Timeout during connect (likely firewall problem), url: "]}

My question is mainly where the problem exactly lies. Is it a problem with the domain? With the settings of the VPS on Oracle Cloud? Or is it just a directory that doesnt have proper chmod. Im struggling with this error message for days now. I already configured the iptables to allow everything but still it just says "firewall problem"

This is the first Issue I ever post on Github, so Im sorry if im labeling it wrong 😅
Thanks in advance

-Gus
@jpmens
Copy link
Member

jpmens commented May 5, 2024

You did nothing wrong, and I'm sorry you've been fighting with this. (I edited your question to add ``` before and after code lines to make it easier for me to read.)

I'm surprised at the error: Could not find solver for: tls-alpn-01" which is being reported back to us by Let's Encrypt...

In your configuration.yaml file, have you specified your DNS domain as a simple name such as

dns_domain: my.domain.example

or does that have a scheme on it as in https://my.domain.example? This would be wrong.

Regarding VPS on Oracle cloud: we've no experience with that, so it might of course well be that that cloud is not permitting Let's Encrypt to connect back to your VPS for the http-01 challenge which it needs to verify your OwnTracks machine is actually yours ... This connection would be done on port 80.

@jpmens
Copy link
Member

jpmens commented May 5, 2024 •
edited
Loading

If you attempt to connect to your OwnTracks VPS from elsewhere, say using something like the following do you see a connection refused message (expected) or something else?

curl -v http://my.domain.example

And just to be sure let me ask: does the name my.domain.example point to the address of your VPS?

@gusmorrison1
Copy link
Author

Thanks for the quick response. I really apreciate your help!
Yes, the domain is set as a simple domain, just domain.de. I also checked that the domain is pointed at the public ip of the vps by pinging and searching my domain on a dns lookup. When running curl -v http://my.domain.example from my android however I get.

curl -v http://domain.de

  • Could not resolve host: domain.de
  • Closing connection 0
    curl: (6) Could not resolve host: domain.de
    $

Does that mean that my VPS doesnt allow connections as you suggested?

@jpmens
Copy link
Member

jpmens commented May 5, 2024

Your last comment doesn't quite compute: on the one hand you say you can resolve and ping the domain, on the other hand in the curl example you say the result is "could not resolve host". (That's what happens when one tries to obfuscate ;-)

Please double-check your details.

You can also gladly send us the actual domain name via an email to support@owntracks.org, and I'll gladly verify for you. (Please mention this issue number in the subject if you do.)

@jpmens
Copy link
Member

jpmens commented May 5, 2024

Let the record show it turns out there was a firewall blocking access to 80 and 443.

Thanks a lot for your help Jan-Piet! This will probably not be the last time you heard from me since the process of setting the apps up and working is still a long way. But thanks for now!Have a nice day

Glad you solved it.

@jpmens jpmens closed this as completed May 5, 2024
@gusmorrison1
Copy link
Author

gusmorrison1 commented May 5, 2024 via email

@jpmens
Copy link
Member

jpmens commented May 5, 2024

HTTP status 405 is "method not allowed" which appears to indicate that either the server is misconfigured (not terribly likely) or something is intercepting that query.

If you followed these instructions from the Booklet that should not be occurring, as we configure for the MQTT protocol which for OwnTracks is much more capable. You would need to enable TCP port 8883 on your firewall if it is currently disabled.

@gusmorrison1
Copy link
Author

gusmorrison1 commented May 5, 2024 via email

@gusmorrison1
Copy link
Author

gusmorrison1 commented May 5, 2024 via email

@jpmens
Copy link
Member

jpmens commented May 5, 2024

The login is at https://yourdomain.example/owntracks/

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@jpmens @gusmorrison1