CloudFlare 6103: Invalid format for X-Auth-Key header

[jonaslewin]

Do you want to request a feature or report a bug?

Reporting a bug

What did you do?

Ran traefik in a windows container and set cloudlfare to be the dnsProvider.

What did you expect to see?

I expected to get the ssl certificate.

What did you see instead?

time="2017-10-01T18:02:02+02:00" level=error msg="map[www.site.com:Error presenting token: Cloudflare API Error 
Error: 6003: Invalid request headers<- 6103: Invalid format for X-Auth-Key header site.com:Error presenting token: Cloudflare API Error 
Error: 6003: Invalid request headers<- 6103: Invalid format for X-Auth-Key header]" 
time="2017-10-01T18:02:02+02:00" level=error msg="Error getting ACME certificate for domain [site.com www.site.com]: Cannot obtain certificates map[site.com:Error presenting token: Cloudflare API Error 
Error: 6003: Invalid request headers<- 6103: Invalid format for X-Auth-Key header www.site.com:Error presenting token: Cloudflare API Error 
Error: 6003: Invalid request headers<- 6103: Invalid format for X-Auth-Key header]+v"

Output of traefik version: (What version of Traefik are you using?)

Version:      v1.4.0-rc3
Codename:     roquefort
Go version:   go1.9
Built:        2017-09-18_04:38:27PM
OS/Arch:      windows/amd64

What is your environment & configuration (arguments, toml, provider, platform, ...)?

traefikLogsFile = "/logs/traefik.log"
debug = true

[file]
directory = "/etc/sites/"
watch = true

[web]
address = ":8080"

defaultEntryPoints = ["http", "https"]
[entryPoints]
  [entryPoints.http]
  address = ":80"
  [entryPoints.https]
  address = ":443"
    [entryPoints.https.tls]
  
[acme]
email = "my@email.com"
storage = "C:/ssl/lets-encrypt.json"
entryPoint = "https"
dnsProvider = "cloudflare"
acmeLogging = true
caServer = "https://acme-staging.api.letsencrypt.org/directory"
[[acme.domains]]
  main = "site.com"
  sans = ["www.site.com"]

I run traefik in a container like this:

docker run -d -e CLOUDFLARE_EMAIL=my@email.com -e CLOUDFLARE_API_KEY=v1.0-...abc -p 80:80 -p 8080:8080 -p 443:443 -v... traefik

I have verified that I am using the Origin CA Key

[mmatur]

@jonaslewin This error is not due to a bug in Træfik but to a missing feature in xenolf/lego dependency.

Currently xenolf/lego support only X-Auth-Email and X-Auth-Key https://github.com/xenolf/lego/blob/master/providers/dns/cloudflare/cloudflare.go#L180

Regarding Cloudflare documentation, your API key seems to be an User Service Key and need to be set in header X-Auth-User-Service-Key

Could you confirm that your key is an User Service Key ?

[jonaslewin]

I can't verify if this is the User Service Key or not, as the only 2 options that I have in CloudFlare in my profile are the following:
Global API Key
Origin CA Key

None of those match the name User Service Key

The one I used was Origin CA Key

[frenchviking]

Hello,

I'm currently in the same situation, with little differencies
OS : Linux (container)
Version: v1.4.5

[mmatur]

@jonaslewin @frenchviking Could you tell me if your API keys start with v1- please

[frenchviking]

@mmatur it doesn't.

[mmatur]

@frenchviking Could you provide us more informations like logs, traefik configuration and how your run your traefik container please

[frenchviking]

Here is the docker-compose.yml.

version: '3.1' 
services: 
  traefik:
    image: traefik:latest
    command: --docker --docker.swarmmode --docker.domain=traefik --docker.watch --web --web.metrics --web.metrics.prometheus
    environment:
      CLOUDFLARE_EMAIL: [my_contact_email]
      CLOUDFLARE_API_KEY: [my_cloudflare_Global_API_Key]
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - /storage/traefik/config:/etc/traefik
    deploy:
      mode: replicated
      replicas: 3
      placement:
        constraints:
          - node.role == manager
      update_config:
        parallelism: 1
        delay: 5s
      resources:
        limits:
          cpus: '1'
          memory: 64M
      restart_policy: 
        condition: any
        delay: 5s
        window: 5s
      labels:
        magik.service.type: "infra"
    networks:
      - traefik-net
    ports:
      - "80:80"
      - "443:443"
      - "8090:8080"
    logging:
      driver: "fluentd"
      options:
        fluentd-address: localhost:24224
        tag: docker.admin.traefik

logs :

Error: 6003: Invalid request headers<- 6103: Invalid format for X-Auth-Key header]" 
Error: 6003: Invalid request headers<- 6103: Invalid format for X-Auth-Key header]+v" 
Error getting ACME certificates [my.website] : Cannot obtain certificates map[my.website:Error presenting token: Cloudflare API Error
Error getting ACME certificate for domain [my.website]: Cannot obtain certificates map[my.website:Error presenting token: Cloudflare API Error
Error: 6003: Invalid request headers<- 6103: Invalid format for X-Auth-Key header]"
Error presenting token: Cloudflare API Error
Error: 6003: Invalid request headers<- 6103: Invalid format for X-Auth-Key header]"
Error: 6003: Invalid request headers<- 6103: Invalid format for X-Auth-Key header my.website:Error presenting token: Cloudflare API Error
Error getting ACME certificates [my.website] : Cannot obtain certificates map[my.website:Error presenting token: Cloudflare API Error

[mmatur]

@frenchviking Could you please verify if email used in env variable CLOUDFLARE_EMAIL is the same as the email of your Cloudflare account

[mmatur]

@jonaslewin if you are using Origin CA Key, this key start with v1.. and lego dependency does not manage this type of API key

[jonaslewin]

@mmatur The Origin CA Key starts with v1...
Does this mean that I sould use the Global CA Key instead?

[mmatur]

Currently you can only use Global CA Key

[mmatur]

After some investigations on Cloudflare API and lego dependency, we will not be able to use only the Origin CA Key to execute all actions required by the DNS configuration.

So please use the Global CA Key.

I will close this issue

[errm]

Should we add a note to the traefik documentation?

[mmatur]

@errm yes, I have just create a PR to improve documentation

[traefiker]

Closed by #2558.

[EugenMayer]

Migrated over from traefik 1.6.6, fixed from CF_X to CLOUFLARE_EMAIL/CLOUDFLARE_API_KEY and getting the same issues as above. I am using the GLOBAL CA KEY ( i am just migrating over from a working 1.6.6 instance ).

@mmatur this should be a bug i suppose. You need the usual ACME debug logs for further verification?

[EugenMayer]

Sorry my bad, after digging around i found out that the variable scope was unexpected and the CLOUDFLARE_* variables i sourced are not passed to the script below. No action required, was all on me, sorry