1. The problem I’m having:
I am trying to create an IPv6 onlyblog server (AWS Lightsail VPS). I have a really basic Caddy config and an empty Ghost blog behind it.
Logs show failure to get certs issued for both ZeroSSL and LE as below.
2. Error messages and/or full log output:
caddy-1 | {"level":"debug","ts":1707784869.2619658,"logger":"tls.obtain","msg":"trying issuer 1/2","issuer":"acme-v02.api.letsencrypt.org-directory"}
caddy-1 | {"level":"warn","ts":1707784869.761995,"logger":"tls.issuance.acme.acme_client","msg":"HTTP request failed; retrying","url":"https://acme-v02.api.letsencrypt.org/directory","error":"performing request: Get \"https://acme-v02.api.letsencrypt.org/directory\": context deadline exceeded (Client.Timeout exceeded while awaiting headers)"}
caddy-1 | {"level":"error","ts":1707784869.7620826,"logger":"tls.obtain","msg":"could not get certificate from issuer","identifier":"www.example.com","issuer":"acme-v02.api.letsencrypt.org-directory","error":"registering account [mailto:domainblaster@pm.me] with server: provisioning client: performing request: Get \"https://acme-v02.api.letsencrypt.org/directory\": context deadline exceeded (Client.Timeout exceeded while awaiting headers)"}
caddy-1 | {"level":"debug","ts":1707784869.7621198,"logger":"tls.obtain","msg":"trying issuer 2/2","issuer":"acme.zerossl.com-v2-DV90"}
caddy-1 | {"level":"warn","ts":1707784899.7632802,"logger":"tls.issuance.acme.acme_client","msg":"HTTP request failed; retrying","url":"https://acme-staging-v02.api.letsencrypt.org/directory","error":"performing request: Get \"https://acme-staging-v02.api.letsencrypt.org/directory\": context deadline exceeded (Client.Timeout exceeded while awaiting headers)"}
caddy-1 | {"level":"error","ts":1707784899.7633023,"logger":"tls.obtain","msg":"could not get certificate from issuer","identifier":"www.example.com","issuer":"acme.zerossl.com-v2-DV90","error":"account pre-registration callback: performing EAB credentials request: Post \"https://api.zerossl.com/acme/eab-credentials-email\": dial tcp 52.205.231.143:443: i/o timeout"}
3. Caddy version:
v2.7.6 h1:w0NymbG2m9PcvKWsrXO6EEkY9Ru4FJK8uQbYcev1p3A=
4. How I installed and ran Caddy:
Docker compose pull
a. System environment:
Ubuntu 22.04 in AWS Lightsail. Docker and compose pulled fresh, new server build.
Added HTTPS to the cloud firewall from “all IPv6” origins which has SSH and HTTP there by default.
When the server came up, installed Docker and compose and apt-upgraded everything.
b. Command:
Compose startup → docker compose up -d
c. Service/unit/compose file:
version: "3.7"
networks:
web:
external: true
internal:
external: false
driver: bridge
services:
caddy:
image: caddy:2-alpine
restart: unless-stopped
ports:
- "80:80"
- "443:443"
- "443:443/udp"
volumes:
- /data/caddy/Caddyfile:/etc/caddy/Caddyfile
- /data/caddy/data:/data
- /data/caddy/config:/config
networks:
- web
- internal
ghost:
image: ghost:4-alpine
restart: unless-stopped
#ports:
#- 2368
environment:
url: https://example.com # Change to your domain
volumes:
- /data/myghostapp:/var/lib/ghost/content
networks:
- internal
d. My complete Caddy config:
{
email foo@example.com
debug
}
example.com {
reverse_proxy ghost:2368
}
www.example.com {
redir https://example.com{uri}
}
5. Links to relevant resources:
I have set up Caddy containers many times on IPv4 servers and not had a problem like this.
I did try an off the shelf Nginx container on 80 (without Caddy) which resolved fine from a browser.
I can reach your server from one of my IPv6 compatible servers
I don’t know what’s going on here.
button.