1. The problem I’m having:
I run several subdomains through reverse proxy and Caddy. At some point my SSL certificates stopped being renewed and expired. Reading through the logs, it seems like it’s failing to renew through ZeroSSL. Any help decoding the error messages is greatly appreciated!
p.s. when using reverse_proxy, is it necessary to include http://?
2. Error messages and/or full log output:
I’ve pulled error messages for just one of the sub-domains (I think I got it all) since the logs are the same for the various subdomains and too large to copy & paste into the topic. The complete logs are here.
{"level":"info","ts":1695153826.9741719,"logger":"http","msg":"enabling automatic TLS certificate management","domains":["sonarr.greghao.com","radarr.greghao.com","trans.greghao.com","tautulli.greghao.com","jackett.greghao.com","www.greghao.com","sabnzbd.greghao.com","adguard.greghao.com","overseerr.greghao.com"]}
{"level":"warn","ts":1695153827.053664,"logger":"tls","msg":"stapling OCSP","error":"no OCSP stapling for [radarr.greghao.com]: parsing OCSP response: ocsp: error from server: unauthorized","identifiers":["radarr.greghao.com"]}
{"level":"info","ts":1695153827.0541282,"logger":"tls.renew","msg":"acquiring lock","identifier":"radarr.greghao.com"}
{"level":"info","ts":1695153827.057894,"logger":"tls.renew","msg":"lock acquired","identifier":"radarr.greghao.com"}
{"level":"info","ts":1695153827.0585961,"logger":"tls.renew","msg":"renewing certificate","identifier":"radarr.greghao.com","remaining":-99803.058595}
{"level":"info","ts":1695153827.6519349,"logger":"tls.issuance.acme.acme_client","msg":"trying to solve challenge","identifier":"radarr.greghao.com","challenge_type":"http-01","ca":"https://acme-v02.api.letsencrypt.org/directory"}
{"level":"error","ts":1695153858.954658,"logger":"tls.issuance.acme.acme_client","msg":"challenge failed","identifier":"radarr.greghao.com","challenge_type":"http-01","problem":{"type":"urn:ietf:params:acme:error:unauthorized","title":"","detail":"2606:4700:3036::ac43:d0c9: Invalid response from http://radarr.greghao.com/.well-known/acme-challenge/LlLSXxgUWCqyeGTgw1XRz1rdYYg3KboPI0-ZtkTkScU: 522","instance":"","subproblems":[]}}
{"level":"error","ts":1695153858.9547222,"logger":"tls.issuance.acme.acme_client","msg":"validating authorization","identifier":"radarr.greghao.com","problem":{"type":"urn:ietf:params:acme:error:unauthorized","title":"","detail":"2606:4700:3036::ac43:d0c9: Invalid response from http://radarr.greghao.com/.well-known/acme-challenge/LlLSXxgUWCqyeGTgw1XRz1rdYYg3KboPI0-ZtkTkScU: 522","instance":"","subproblems":[]},"order":"https://acme-v02.api.letsencrypt.org/acme/order/974460856/209505349976","attempt":1,"max_attempts":3}
3. Caddy version:
V 2.7.4
4. How I installed and ran Caddy:
brew install caddy
a. System environment:
MacOS 13.5.2
b. Command:
brew services start caddy
d. My complete Caddy config:
{
email greg@twilightstar.net
}
(basic-auth) {
basicauth / {
1234 abcd
}
}
sabnzbd.greghao.com {
reverse_proxy http://127.0.0.1:8080
}
trans.greghao.com {
reverse_proxy http://127.0.0.1:9091
}
radarr.greghao.com {
import basic-auth
reverse_proxy http://127.0.0.1:9092
}
sonarr.greghao.com {
import basic-auth
reverse_proxy http://127.0.0.1:9093
}
tautulli.greghao.com {
reverse_proxy http://127.0.0.1:9094
}
www.greghao.com {
import basic-auth
reverse_proxy http://127.0.0.1:9095
}
jackett.greghao.com {
import basic-auth
reverse_proxy http://127.0.0.1:9096
}
overseerr.greghao.com {
reverse_proxy http://127.0.0.1:9097
}
adguard.greghao.com {
reverse_proxy http://192.168.10.52
}
