Caddy does not create certificate for one domain

Help
1

1. The problem I’m having:

I am starting caddy using caddy run with the following caddy file: k8s-infrastructure/Caddyfile at 7c58e73a340274f86c722dbd983b30ca8110ad41 · Androz2091/k8s-infrastructure · GitHub

I added a new entry, pdf.androz2091.fr.

2. Error messages and/or full log output:

the pdf certificate does not get created
Note that I included my whole log file but some errors come from /paypal/ipn failing because my manage-invite-api service is down

root@ns561436:~/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory# ls
10mans-adminjs.androz2091.fr  cloud.androz2091.fr                      harbor.androz2091.fr        photos.androz2091.fr                  radarr.androz2091.fr              tagger.androz2091.fr
analytics.androz2091.fr       dash.manage-invite.xyz                   haste.androz2091.fr         plex.androz2091.fr                    sabnzbd.androz2091.fr             tautulli.androz2091.fr
androz2091.fr                 ddpe.androz2091.fr                       kolc-adminjs.androz2091.fr  pokercode-quiz-adminjs.androz2091.fr  simonlefort.ch                    timetagger.androz2091.fr
api.manage-invite.xyz         diswho.androz2091.fr                     monica.androz2091.fr        prometheus-grafana.androz2091.fr      simonlefort.fr                    vault.androz2091.fr
argocd.androz2091.fr          evolution-markets-adminjs.androz2091.fr  pgadmin.androz2091.fr       qbt.androz2091.fr                     slash-commands-gui.androz2091.fr

ebian@ns561436:~/k8s-infrastructure$ sudo caddy run
2024/11/30 12:06:30.609 INFO    using adjacent Caddyfile
2024/11/30 12:06:30.612 INFO    adapted config to JSON  {"adapter": "caddyfile"}
2024/11/30 12:06:30.612 WARN    Caddyfile input is not formatted; run 'caddy fmt --overwrite' to fix inconsistencies    {"adapter": "caddyfile", "file": "Caddyfile", "line": 2}
2024/11/30 12:06:30.613 INFO    admin   admin endpoint started  {"address": "localhost:2019", "enforce_origin": false, "origins": ["//localhost:2019", "//[::1]:2019", "//127.0.0.1:2019"]}
2024/11/30 12:06:30.613 INFO    http.auto_https enabling automatic HTTP->HTTPS redirects        {"server_name": "srv0"}
2024/11/30 12:06:30.613 INFO    tls.cache.maintenance   started background certificate maintenance      {"cache": "0xc000319b00"}
2024/11/30 12:06:30.614 INFO    http.auto_https server is listening only on the HTTPS port but has no TLS connection policies; adding one to enable TLS {"server_name": "srv1", "https_port": 443}
2024/11/30 12:06:30.614 INFO    http.auto_https enabling automatic HTTP->HTTPS redirects        {"server_name": "srv1"}
2024/11/30 12:06:30.615 INFO    http    enabling HTTP/3 listener        {"addr": ":32400"}
2024/11/30 12:06:30.615 INFO    http.log        server running  {"name": "srv0", "protocols": ["h1", "h2", "h3"]}
2024/11/30 12:06:30.615 INFO    http    enabling HTTP/3 listener        {"addr": ":443"}
2024/11/30 12:06:30.615 INFO    http.log        server running  {"name": "srv1", "protocols": ["h1", "h2", "h3"]}
2024/11/30 12:06:30.615 INFO    http.log        server running  {"name": "remaining_auto_https_redirects", "protocols": ["h1", "h2", "h3"]}
2024/11/30 12:06:30.615 INFO    http    enabling automatic TLS certificate management   {"domains": ["timetagger.androz2091.fr", "androz2091.fr", "10mans-adminjs.androz2091.fr", "evolution-markets-adminjs.androz2091.fr", "api.manage-invite.xyz", "dash.manage-invite.xyz", "simonlefort.fr", "vault.androz2091.fr", "radarr.androz2091.fr", "harbor.androz2091.fr", "sabnzbd.androz2091.fr", "prometheus-grafana.androz2091.fr", "pokercode-quiz-adminjs.androz2091.fr", "tagger.androz2091.fr", "pgadmin.androz2091.fr", "cloud.androz2091.fr", "analytics.androz2091.fr", "ddpe.androz2091.fr", "simonlefort.ch", "diswho.androz2091.fr", "haste.androz2091.fr", "argocd.androz2091.fr", "plex.androz2091.fr", "tautulli.androz2091.fr", "photos.androz2091.fr", "kolc-adminjs.androz2091.fr", "qbt.androz2091.fr", "slash-commands-gui.androz2091.fr", "pdf.androz2091.fr"]}
2024/11/30 12:06:30.622 INFO    tls.obtain      acquiring lock  {"identifier": "pdf.androz2091.fr"}
2024/11/30 12:06:30.627 INFO    autosaved config (load with --resume flag)      {"file": "/root/.config/caddy/autosave.json"}
2024/11/30 12:06:30.627 INFO    serving initial configuration
2024/11/30 12:06:30.642 INFO    tls     storage cleaning happened too recently; skipping for now        {"storage": "FileStorage:/root/.local/share/caddy", "instance": "ea9c872e-2d5d-4c4f-a241-eedd310ff710", "try_again": "2024/12/01 12:06:30.642", "try_again_in": 86399.999998278}
2024/11/30 12:06:30.642 INFO    tls     finished cleaning storage units

3. Caddy version:

v2.8.4

4. How I installed and ran Caddy:

a. System environment:

Debian v12.8

b. Command:

sudo caddy run

d. My complete Caddy config:

See below.

5. Links to relevant resources:

2

Hi @Androz2091,

Using the online tool Let’s Debug yields these results
https://letsdebug.net/pdf.androz2091.fr/2296922

ANotWorking
Error
pdf.androz2091.fr has an A (IPv4) record (54.39.102.76) but a request to this address over port 80 did not succeed. Your web server must have at least one working IPv4 or IPv6 address.
Get "https://pdf.androz2091.fr/.well-known/acme-challenge/letsdebug-test": remote error: tls: internal error

Trace:
@0ms: Making a request to http://pdf.androz2091.fr/.well-known/acme-challenge/letsdebug-test (using initial IP 54.39.102.76)
@0ms: Dialing 54.39.102.76
@215ms: Server response: HTTP 308 Permanent Redirect
@215ms: Received redirect to https://pdf.androz2091.fr/.well-known/acme-challenge/letsdebug-test
@215ms: Dialing 54.39.102.76
@432ms: Experienced error: remote error: tls: internal error

image
image1001×433 6.38 KB

3

Thank you for your reply! I think it is linked to another issue I’ve got with Caddy, do you have any idea why? ssl - OpenSSL routines:ssl3_read_bytes:tlsv1 alert internal error with kubernetes and caddy - Server Fault

I’ve been having this issue for weeks and I cannot figure out what’s wrong

1 Like
4

HTTP on Port 80 ACME challenge gives a redirect, which is fine, to HTTPS.

$ curl -Ii http://pdf.androz2091.fr/.well-known/acme-challenge/sometestfile
HTTP/1.1 308 Permanent Redirect
Connection: close
Location: https://pdf.androz2091.fr/.well-known/acme-challenge/sometestfile
Server: Caddy
Date: Sat, 30 Nov 2024 17:18:23 GMT

Following the redirect to HTTPS.
HTTPS on Port 443 fails to connect.

$ curl -k -Ii https://pdf.androz2091.fr:443/.well-known/acme-challenge/sometestfile
curl: (35) error:0A000438:SSL routines::tlsv1 alert internal error

Checking what is on Port 443.
HTTP on Port 443 connects and get a response of HTTP/1.0 400 Bad Request.

$ curl -k -Ii http://pdf.androz2091.fr:443/.well-known/acme-challenge/sometestfile
HTTP/1.0 400 Bad Request
5

Thank you for your reply. What can I do for that? How can I debug the issue? I only ran caddy run.

1 Like
6

Kindly wait for more knowledgeable Caddy community volunteers to assist.

1 Like