שגיאה באימות LetsEncrypt

תמיכה

סיכום מבוסס בינה מלאכותית

The user MihaVuk encountered an error during Let’s Encrypt HTTPS setup on a self-hosted Docker Discourse instance, with the ACME challenge failing due to a timeout. The issue was traced to port 80 being blocked by the company firewall, preventing access to the challenge file at /.well-known/acme-challenge/. Despite attempts to fix it via discourse-setup and manual edits, the problem persisted until the firewall was adjusted. MihaVuk initially suspected a configuration issue, but pfaffman pointed out the need for a standard install and potential port blocking. supermathie confirmed the issue via curl tests. Ultimately, MihaVuk resolved it by allowing ACME traffic through the firewall. MihaVuk confirmed the fix.

1

I have setup the self-hosted Docker environment and enabled HTTPS using Let’s Encrypt following the tutorial.

It always fails on the step below. Setup without HTTPS works fine and the forum is publicly available on HTTP.

root@discoursetest3-app:/shared/letsencrypt# cat acme.sh.log
…
[Mon 11 Apr 2022 02:56:35 PM UTC] discourse-test3.docentric.com:Verify error:Fetching http://discourse-test3.docentric.com/.well-known/acme-challenge/iEFjgyseuVL1IzIrTjmfhwv0HqV7EgUmQUVhy1nmnCE: Timeout after connect (your server may be slow or overloaded)

It seems that ACME challenge is not accessible.

2

Did you read the first sentence in that guide that says that if you’re doing a standard install you don’t need to follow that guide?

Is this a recent standard install? Did you run discourse-setup?

It looks like you may have port 80 (and perhaps also port 443) blocked for incoming connections.

3

Oddly, the first works but the second doesn’t:

○ → curl http://discourse-test3.docentric.com/srv/status
ok

○ → timeout -v 5s curl http://discourse-test3.docentric.com/.well-known/acme-challenge/iEFjgyseuVL1IzIrTjmfhwv0HqV7EgUmQUVhy1nmnCE
timeout: sending signal TERM to command ‘curl’

I’m not sure what would cause that if it’s a standard setup.

4

It is an old test installation without HTTPS and now I would like to enable HTTPS.
I have tried to edit app.yml manually and also to run discourse-setup. In both cases the same error.
I have also tried to delete Discourse (containers and files) and install from scratch, but the result is the same.

I agree that it looks that port 80 in not available, but if I comment the following two lines in app.yml, the forum runs on HTTP without problem.

  • “templates/web.ssl.template.yml”
  • “templates/web.letsencrypt.ssl.template.yml”

Where on the disk are static files like http://discourse-test3.docentric.com/.well-known/acme-challenge/iEFjgyseuVL1IzIrTjmfhwv0HqV7EgUmQUVhy1nmnCE?

5

It has turned out that just ACME protocol was blocked on the company firewall. Now it works :slight_smile: