ACME challenge settings?

[poVoq]

Instead of my previous attempt with using my host system to create the Lets Encrypt certificates, I thought it might be actually nicer to automatically create through the new ACME system in Ejabberd.

With the self signed certs it seems to work fine, but I guess I need to un-comment the following line:
- "/etc/letsencrypt/live/xmpp.mydomain.com/*.pem"

for it to look at the right place? Does that work with the Docker image?
If I switch to that and remove the self-signed cert line from the ejabberd.yml my XMPP client does not connect any longer because of an SSL negotiation error.

Any ideas?

The ejabberd.log gives me this:

2018-03-10 18:55:57.473 [warning] <0.512.0>@ejabberd_c2s:process_terminated:290 (tls|<0.512.0>) Failed to secure c2s connection: TLS failed: Failed to find a certi
ficate matching the domain in SNI extension: error:1412E0E2:SSL routines:ssl_parse_clienthello_tlsext:clienthello tlsext

[zinid]

If I understand correctly, and you want to use built-in ACME support in ejabberd, you don't even need to configure certfiles option: ejabberd will download the certificate in a special directory (called certs/acme inside the Mnesia directory).

[zinid]

Note that ejabberd doesn't enable ACME automatically, you need to use the special ejabberdctl commands for this.

[poVoq]

Note that ejabberd doesn't enable ACME automatically, you need to use the special ejabberdctl commands for this.

Ahh, is that documented somewhere? I was looking for something like that :(

[zinid]

I don't remember where it's documented, but basically, you need a single command:
$ ejabberdctl get-certificates all

[poVoq]

Ah, so I will need to run this every 3 months manually to renew the certificates?

I tried it the following way:
docker exec -it ejabberd bin/ejabberdctl get-certificates all
Which takes a while and then results in an error:

Error with one or more certificates
  Error for domain: "xmpp.mydomain.com",  with reason: 'authorization'

But I guess that might be related to my reverse-proxy (Traefik).

[zinid]

Make sure all your domains (including subdomains like conference.foo.bar) are resolvable and you redirect 80th port to some ejabberd's port of ejabberd_http listener.

[zinid]

(For the record, you anyway need to configure redirection in order to make mod_http_upload working).

[poVoq]

Ok I thought is was related to Traefik enforcing Https, but after switching it to also allow unencrypted connection on port 80 on xmpp.mydomain.com (with works fine /api /bosh /admin etc all show up) I still get the same error.

Could it be related that I already previously got a certificate from LetsEncrypt for that domain through traefic? Maybe some query like with certbot that asks if you want to renew despite still being valid that does result in an error with ejabberd?

Edit: Ok checked the logs... maybe a "max_request_limit" issue, will try again tomorrow. Thanks for the help.

[zinid]

Hard to say, ACME has extremely shitty error reports (we need somehow to improve this).
Do you even see incoming http requests on ejabberd side? You can set loglevel: 5 to see more details.

[cromain]

i'm closing this as it's not docker related. reopen only if you have troubles with ACME in use with container.

[buzanits]

For those who are searching for that error message: It may be an issue with access privileges of the ejabberd user on /etc/letsencrypt/live and /etc/letsencrypt/archive