1. Caddy version (caddy version):
v2.5.0 h1:eRHzZ4l3X6Ag3kUt8nj5IxATprhqKq/wToP7OHlXWA0=
2. How I run Caddy:
Linux Systemd
a. System environment:
$ uname -a
Linux 5.13.0-1025-raspi #27-Ubuntu SMP PREEMPT Tue Apr 5 12:05:22 UTC 2022 aarch64 aarch64 aarch64 GNU/Linux
b. Command:
sudo service caddy start
c. Service/unit/compose file:
[Unit]
Description=Caddy
Documentation=https://caddyserver.com/docs/
After=network.target network-online.target
Requires=network-online.target
[Service]
Type=notify
User=caddy
Group=caddy
ExecStart=/usr/bin/caddy run --environ --config /etc/caddy/Caddyfile
ExecReload=/usr/bin/caddy reload --config /etc/caddy/Caddyfile
TimeoutStopSec=5s
LimitNOFILE=1048576
LimitNPROC=512
PrivateTmp=true
ProtectSystem=full
AmbientCapabilities=CAP_NET_BIND_SERVICE
[Install]
WantedBy=multi-user.target
d. My complete Caddyfile or JSON config:
{
servers {
protocol {
experimental_http3
}
}
}
tucablanca.narwhal-nominal.ts.net, metricas.pinayalcachofa.es {
encode zstd gzip
reverse_proxy localhost:3000
}
3. The problem I’m having:
I’m trying to add a new domain (metricas.pinayalcachofa.es) to my existing configuration that was working just fine.
4. Error messages and/or full log output:
May 04 12:59:16 tucaBlanca systemd[1]: Reloaded Caddy.
May 04 12:59:17 tucaBlanca caddy[123825]: {"level":"info","ts":1651669157.79132,"logger":"tls.obtain","msg":"lock acquired","identifier":"metricas.pinayalcachofa.es"}
May 04 12:59:17 tucaBlanca caddy[123825]: {"level":"info","ts":1651669157.7960844,"logger":"tls.issuance.acme","msg":"waiting on internal rate limiter","identifiers":["metricas.pinayalcachofa.es"],"ca":"h
ttps://acme-v02.api.letsencrypt.org/directory","account":"plorenzo@hey.com"}
May 04 12:59:17 tucaBlanca caddy[123825]: {"level":"info","ts":1651669157.7962883,"logger":"tls.issuance.acme","msg":"done waiting on internal rate limiter","identifiers":["metricas.pinayalcachofa.es"],"c
a":"https://acme-v02.api.letsencrypt.org/directory","account":"plorenzo@hey.com"}
May 04 12:59:19 tucaBlanca caddy[123825]: {"level":"info","ts":1651669159.1608107,"logger":"tls.issuance.acme.acme_client","msg":"trying to solve challenge","identifier":"metricas.pinayalcachofa.es","challenge_type":"tls-alpn-01","ca":"https://acme-v02.api.letsencrypt.org/directory"}
May 04 12:59:20 tucaBlanca caddy[123825]: {"level":"error","ts":1651669160.3862174,"logger":"tls.issuance.acme.acme_client","msg":"challenge failed","identifier":"metricas.pinayalcachofa.es","challenge_type":"tls-alpn-01","problem":{"type":"urn:ietf:params:acme:error:tls","title":"","detail":"156.249.12.173: remote error: tls: internal error","instance":"","subproblems":[]}}
May 04 12:59:20 tucaBlanca caddy[123825]: {"level":"error","ts":1651669160.3864515,"logger":"tls.issuance.acme.acme_client","msg":"validating authorization","identifier":"metricas.pinayalcachofa.es","problem":{"type":"urn:ietf:params:acme:error:tls","title":"","detail":"156.249.12.173: remote error: tls: internal error","instance":"","subproblems":[]},"order":"https://acme-v02.api.letsencrypt.org/acme/order/528443056/85731870216","attempt":1,"max_attempts":3}
May 04 12:59:21 tucaBlanca caddy[123825]: {"level":"info","ts":1651669161.9948442,"logger":"tls.issuance.acme.acme_client","msg":"trying to solve challenge","identifier":"metricas.pinayalcachofa.es","challenge_type":"http-01","ca":"https://acme-v02.api.letsencrypt.org/directory"}
May 04 12:59:23 tucaBlanca caddy[123825]: {"level":"error","ts":1651669163.6842563,"logger":"tls.issuance.acme.acme_client","msg":"challenge failed","identifier":"metricas.pinayalcachofa.es","challenge_type":"http-01","problem":{"type":"urn:ietf:params:acme:error:tls","title":"","detail":"156.249.12.173: Fetching https://metricas.pinayalcachofa.es/.well-known/acme-challenge/GsQdxxJpgWzDudQWUc_GHw9JzU5XlhzABaUeVQKhxT0: remote error: tls: internal error","instance":"","subproblems":[]}}
May 04 12:59:23 tucaBlanca caddy[123825]: {"level":"error","ts":1651669163.6845248,"logger":"tls.issuance.acme.acme_client","msg":"validating authorization","identifier":"metricas.pinayalcachofa.es","problem":{"type":"urn:ietf:params:acme:error:tls","title":"","detail":"156.249.12.173: Fetching https://metricas.pinayalcachofa.es/.well-known/acme-challenge/GsQdxxJpgWzDudQWUc_GHw9JzU5XlhzABaUeVQKhxT0: remote error: tls: internal error","instance":"","subproblems":[]},"order":"https://acme-v02.api.letsencrypt.org/acme/order/528443056/85731879576","attempt":2,"max_attempts":3}
May 04 12:59:23 tucaBlanca caddy[123825]: {"level":"error","ts":1651669163.6847627,"logger":"tls.obtain","msg":"could not get certificate from issuer","identifier":"metricas.pinayalcachofa.es","issuer":"acme-v02.api.letsencrypt.org-directory","error":"HTTP 400 urn:ietf:params:acme:error:tls - 156.249.12.173: Fetching https://metricas.pinayalcachofa.es/.well-known/acme-challenge/GsQdxxJpgWzDudQWUc_GHw9JzU5XlhzABaUeVQKhxT0: remote error: tls: internal error"}
May 04 12:59:23 tucaBlanca caddy[123825]: {"level":"info","ts":1651669163.687205,"logger":"tls.issuance.acme","msg":"waiting on internal rate limiter","identifiers":["metricas.pinayalcachofa.es"],"ca":"https://acme.zerossl.com/v2/DV90","account":"plorenzo@hey.com"}
May 04 12:59:23 tucaBlanca caddy[123825]: {"level":"info","ts":1651669163.6873858,"logger":"tls.issuance.acme","msg":"done waiting on internal rate limiter","identifiers":["metricas.pinayalcachofa.es"],"ca":"https://acme.zerossl.com/v2/DV90","account":"plorenzo@hey.com"}
May 04 12:59:24 tucaBlanca caddy[123825]: {"level":"error","ts":1651669164.9179,"logger":"tls.obtain","msg":"could not get certificate from issuer","identifier":"metricas.pinayalcachofa.es","issuer":"acme.zerossl.com-v2-DV90","error":"[metricas.pinayalcachofa.es] creating new order: fetching new nonce from server: HTTP 500: (ca=https://acme.zerossl.com/v2/DV90)"}
May 04 12:59:24 tucaBlanca caddy[123825]: {"level":"error","ts":1651669164.9181328,"logger":"tls.obtain","msg":"will retry","error":"[metricas.pinayalcachofa.es] Obtain: [metricas.pinayalcachofa.es] creating new order: fetching new nonce from server: HTTP 500: (ca=https://acme.zerossl.com/v2/DV90)","attempt":1,"retrying_in":60,"elapsed":7.126639868,"max_duration":2592000}
May 04 13:00:26 tucaBlanca caddy[123825]: {"level":"info","ts":1651669226.0745986,"logger":"tls.issuance.acme.acme_client","msg":"trying to solve challenge","identifier":"metricas.pinayalcachofa.es","challenge_type":"tls-alpn-01","ca":"https://acme-staging-v02.api.letsencrypt.org/directory"}
May 04 13:00:27 tucaBlanca caddy[123825]: {"level":"error","ts":1651669227.2416818,"logger":"tls.issuance.acme.acme_client","msg":"challenge failed","identifier":"metricas.pinayalcachofa.es","challenge_type":"tls-alpn-01","problem":{"type":"urn:ietf:params:acme:error:tls","title":"","detail":"156.249.12.173: remote error: tls: internal error","instance":"","subproblems":[]}}
May 04 13:00:27 tucaBlanca caddy[123825]: {"level":"error","ts":1651669227.2419264,"logger":"tls.issuance.acme.acme_client","msg":"validating authorization","identifier":"metricas.pinayalcachofa.es","problem":{"type":"urn:ietf:params:acme:error:tls","title":"","detail":"156.249.12.173: remote error: tls: internal error","instance":"","subproblems":[]},"order":"https://acme-staging-v02.api.letsencrypt.org/acme/order/53007614/2483555194","attempt":1,"max_attempts":3}
May 04 13:00:28 tucaBlanca caddy[123825]: {"level":"info","ts":1651669228.6962085,"logger":"tls.issuance.acme.acme_client","msg":"trying to solve challenge","identifier":"metricas.pinayalcachofa.es","challenge_type":"http-01","ca":"https://acme-staging-v02.api.letsencrypt.org/directory"}
May 04 13:00:29 tucaBlanca caddy[123825]: {"level":"error","ts":1651669229.8588178,"logger":"tls.issuance.acme.acme_client","msg":"challenge failed","identifier":"metricas.pinayalcachofa.es","challenge_type":"http-01","problem":{"type":"urn:ietf:params:acme:error:tls","title":"","detail":"156.249.12.173: Fetching https://metricas.pinayalcachofa.es/.well-known/acme-challenge/PcHwDS4kpVwVDIMf90Js1N3jKq0OUA3
dT8K8JWsIQuI: remote error: tls: internal error","instance":"","subproblems":[]}}
May 04 13:00:29 tucaBlanca caddy[123825]: {"level":"error","ts":1651669229.8590786,"logger":"tls.issuance.acme.acme_client","msg":"validating authorization","identifier":"metricas.pinayalcachofa.es","prob
lem":{"type":"urn:ietf:params:acme:error:tls","title":"","detail":"156.249.12.173: Fetching https://metricas.pinayalcachofa.es/.well-known/acme-challenge/PcHwDS4kpVwVDIMf90Js1N3jKq0OUA3dT8K8JWsIQuI: remot
e error: tls: internal error","instance":"","subproblems":[]},"order":"https://acme-staging-v02.api.letsencrypt.org/acme/order/53007614/2483555584","attempt":2,"max_attempts":3}
May 04 13:00:29 tucaBlanca caddy[123825]: {"level":"error","ts":1651669229.8593311,"logger":"tls.obtain","msg":"could not get certificate from issuer","identifier":"metricas.pinayalcachofa.es","issuer":"a
cme-v02.api.letsencrypt.org-directory","error":"HTTP 400 urn:ietf:params:acme:error:tls - 156.249.12.173: Fetching https://metricas.pinayalcachofa.es/.well-known/acme-challenge/PcHwDS4kpVwVDIMf90Js1N3jKq0
OUA3dT8K8JWsIQuI: remote error: tls: internal error"}
May 04 13:01:01 tucaBlanca caddy[123825]: {"level":"info","ts":1651669261.5975342,"logger":"tls.issuance.acme.acme_client","msg":"trying to solve challenge","identifier":"metricas.pinayalcachofa.es","chal
lenge_type":"http-01","ca":"https://acme.zerossl.com/v2/DV90"}
5. What I already tried:
I’ve tried to reload the config and wait for a while to avoid rate limiters, I’ve also tried to split the block in 2 like:
tucablanca.narwhal-nominal.ts.net {
encode zstd gzip
reverse_proxy localhost:3000
}
metricas.pinayalcachofa.es {
encode zstd gzip
reverse_proxy localhost:3000
}
Same result, certificated is not fetched, previous domain (tucablanca.narwhal-nominal.ts.net) works just fine.
I feel like the issue may be here:
May 04 12:59:20 tucaBlanca caddy[123825]: {"level":"error","ts":1651669160.3862174,"logger":"tls.issuance.acme.acme_client","msg":"challenge failed","identifier":"metricas.pinayalcachofa.es","challenge_type":"tls-alpn-01","problem":{"type":"urn:ietf:params:acme:error:tls","title":"","detail":"156.249.12.173: remote error: tls: internal error","instance":"","subproblems":[]}}
I’m not sure if it’s normal for "title":"" and "subproblems":[] to be empty.
Maybe has something to do with trying to serve a Tailscale domain and a normal domain on the same block ?
Any help is welcome 
