# Let's encrypt falhando para IP atrás do firewall

**URL:** <https://meta.discourse.org/t/lets-encrypt-failing-for-ip-behind-firewall/267396>\
**Category:** Self-hosting\
**Tags:** unsupported-install\
**Created:** [6 Junho , 2023 14:23 UTC](https://meta.discourse.org/t/lets-encrypt-failing-for-ip-behind-firewall/267396 "2023-06-06T14:23:19Z")\
**Posts on this page:** 1\
**Showing post:** 1

<div class="post-metadata">

**Author:** ![Qcloud1223](https://avatars.discourse-cdn.com/v4/letter/q/a183cd/32.png) [@Qcloud1223](https://meta.discourse.org/u/Qcloud1223)\
**Post date:** [6 Junho , 2023 14:23 UTC](https://meta.discourse.org/t/lets-encrypt-failing-for-ip-behind-firewall/267396/1 "2023-06-06T14:23:20Z")

</div>

Olá a todos,

Após instalar o Discourse, recebo um HTTP 502, e o log diz:

```plaintext
$ sudo ./launcher logs app
x86_64 arch detected.
run-parts: executing /etc/runit/1.d/00-ensure-links
run-parts: executing /etc/runit/1.d/00-fix-var-logs
run-parts: executing /etc/runit/1.d/01-cleanup-web-pids
run-parts: executing /etc/runit/1.d/anacron
run-parts: executing /etc/runit/1.d/cleanup-pids
Cleaning stale PID files
run-parts: executing /etc/runit/1.d/copy-env
run-parts: executing /etc/runit/1.d/letsencrypt
[Tue 06 Jun 2023 01:51:07 PM UTC] Using CA: https://acme-v02.api.letsencrypt.org/directory
[Tue 06 Jun 2023 01:51:07 PM UTC] Create account key ok.
[Tue 06 Jun 2023 01:51:07 PM UTC] Registering account: https://acme-v02.api.letsencrypt.org/directory
[Tue 06 Jun 2023 01:51:09 PM UTC] Registered
[Tue 06 Jun 2023 01:51:09 PM UTC] ACCOUNT_THUMBPRINT='V5GxRKC8yO-5jvYjc3WlSSMbTABmaNtxUNs8XVoL1R8'
[Tue 06 Jun 2023 01:51:09 PM UTC] Creating domain key
[Tue 06 Jun 2023 01:51:10 PM UTC] The domain key is here: /shared/letsencrypt/<my domain>/<my domain>.key
[Tue 06 Jun 2023 01:51:10 PM UTC] Single domain='<my domain>'
[Tue 06 Jun 2023 01:51:10 PM UTC] Getting domain auth token for each domain
[Tue 06 Jun 2023 01:51:13 PM UTC] Getting webroot for domain='<my domain>'
[Tue 06 Jun 2023 01:51:13 PM UTC] Verifying: <my domain>
[Tue 06 Jun 2023 01:51:15 PM UTC] Pending, The CA is processing your order, please just wait. (1/30)
[Tue 06 Jun 2023 01:51:19 PM UTC] Pending, The CA is processing your order, please just wait. (2/30)
[Tue 06 Jun 2023 01:51:23 PM UTC] Pending, The CA is processing your order, please just wait. (3/30)
[Tue 06 Jun 2023 01:51:27 PM UTC] <my domain>:Verify error:202.117.43.203: Fetching http://<my domain>/.well-known/acme-challenge/UuD6jm6XJAaoXG7lE_IKfNVuHtqB4dokQXm-ll0bmrk: Timeout during connect (likely firewall problem)
[Tue 06 Jun 2023 01:51:27 PM UTC] Please check log file for more details: /shared/letsencrypt/acme.sh.log
Can't open ca.cer for reading, No such file or directory
140104391968064:error:02001002:system library:fopen:No such file or directory:../crypto/bio/bss_file.c:69:fopen('ca.cer','r')
140104391968064:error:2006D080:BIO routines:BIO_new_file:no such file:../crypto/bio/bss_file.c:76:
unable to load certificate
Error loading file /dev/fd/63

...
nginx: [emerg] cannot load certificate "/shared/ssl/ics.yhdang.top.cer": PEM_read_bio_X509_AUX() failed (SSL: error:0909006C:PEM routines:get_name:no start line:Expecting: TRUSTED CERTIFICATE)
nginx: [emerg] cannot load certificate "/shared/ssl/ics.yhdang.top.cer": PEM_read_bio_X509_AUX() failed (SSL: error:0909006C:PEM routines:get_name:no start line:Expecting: TRUSTED CERTIFICATE)
nginx: [emerg] cannot load certificate "/shared/ssl/ics.yhdang.top.cer": PEM_read_bio_X509_AUX() failed (SSL: error:0909006C:PEM routines:get_name:no start line:Expecting: TRUSTED CERTIFICATE)

```

Presumo que isso aconteça porque o Discourse tenta gerar um certificado automaticamente e verificá-lo no modo `HTTP`, acessando o URL listado. No entanto, meu IP está sob um firewall institucional e, portanto, não pode permitir que IPs externos acessem, nem a CA.

Também aprendi no [site da Let’s Encrypt](https://letsencrypt.org/docs/challenge-types/) que o desafio `DNS` pode ser usado se o HTTP não estiver disponível, mas não tenho certeza de como fazer isso no Discourse.

Obrigado.

---

_[View the full topic](https://meta.discourse.org/t/lets-encrypt-failing-for-ip-behind-firewall/267396)._