Could Not Get Certificate From Issuer

1. Output of caddy version:

v2.6.2 h1:wKoFIxpmOJLGl3QXoo6PNbYvGW4xLEgo32GPBEjWL8o=

2. How I run Caddy:

With the exe file grabbed from caddyserver.com with cloudflare and duckdns plugins.

a. System environment:

Windows 10, no Docker

b. Command:

caddy run --config Caddyfile

d. My complete Caddy config:

abcentral.duckdns.org {
	reverse_proxy localhost:13378
	tls {
		dns duckdns REDACTEDTOKEN
	}
}

3. The problem I’m having:

After rebooting my router, and starting caddy my website that’s reverse proxied with caddy is giving me this error " The connection for this site is not secure | abcentral.duckdns.org sent an invalid response."
After looking at the log output I see it’s saying “could not get certificate from issuer”. And I’m wondering how to fix this?

4. Error messages and/or full log output:

2022/10/29 10:12:07.460 ←[34mINFO←[0m   http    enabling HTTP/3 listener        {"addr": ":443"}
2022/10/29 10:12:07.460 ←[34mINFO←[0m   tls     finished cleaning storage units
2022/10/29 10:12:07.460 ←[34mINFO←[0m   http.log        server running  {"name": "srv0", "protocols": ["h1", "h2", "h3"]}
2022/10/29 10:12:07.460 ←[34mINFO←[0m   http.log        server running  {"name": "remaining_auto_https_redirects", "protocols": ["h1", "h2", "h3"]}
2022/10/29 10:12:07.460 ←[34mINFO←[0m   http    enabling automatic TLS certificate management   {"domains": ["abcentral.duckdns.org"]}
2022/10/29 10:12:07.460 ←[34mINFO←[0m   autosaved config (load with --resume flag)      {"file": "C:\\Users\\name\\AppData\\Roaming\\Caddy\\autosave.json"}
2022/10/29 10:12:07.460 ←[34mINFO←[0m   serving initial configuration
2022/10/29 10:12:07.460 ←[34mINFO←[0m   tls.obtain      acquiring lock  {"identifier": "abcentral.duckdns.org"}
2022/10/29 10:12:07.466 ←[34mINFO←[0m   tls.obtain      lock acquired   {"identifier": "abcentral.duckdns.org"}
2022/10/29 10:12:07.466 ←[34mINFO←[0m   tls.obtain      obtaining certificate   {"identifier": "abcentral.duckdns.org"}
2022/10/29 10:12:07.476 ←[34mINFO←[0m   http    waiting on internal rate limiter        {"identifiers": ["abcentral.duckdns.org"], "ca": "https://acme-v02.api.letsencrypt.org/directory", "account": ""}
2022/10/29 10:12:07.476 ←[34mINFO←[0m   http    done waiting on internal rate limiter   {"identifiers": ["abcentral.duckdns.org"], "ca": "https://acme-v02.api.letsencrypt.org/directory", "account": ""}
2022/10/29 10:12:08.340 ←[34mINFO←[0m   http.acme_client        trying to solve challenge       {"identifier": "abcentral.duckdns.org", "challenge_type": "dns-01", "ca": "https://acme-v02.api.letsencrypt.org/directory"}
2022/10/29 10:12:31.647 ←[31mERROR←[0m  tls.obtain      could not get certificate from issuer   {"identifier": "abcentral.duckdns.org", "issuer": "acme-v02.api.letsencrypt.org-directory", "error": "[abcentral.duckdns.org] solving challenges: waiting for solver certmagic.solverWrapper to be ready: checking DNS propagation of \"_acme-challenge.abcentral.duckdns.org\": dial tcp 35.182.183.211:53: i/o timeout (order=https://acme-v02.api.letsencrypt.org/acme/order/799783452/139003238612) (ca=https://acme-v02.api.letsencrypt.org/directory)"}
2022/10/29 10:12:31.658 ←[34mINFO←[0m   http    waiting on internal rate limiter        {"identifiers": ["abcentral.duckdns.org"], "ca": "https://acme.zerossl.com/v2/DV90", "account": ""}
2022/10/29 10:12:31.658 ←[34mINFO←[0m   http    done waiting on internal rate limiter   {"identifiers": ["abcentral.duckdns.org"], "ca": "https://acme.zerossl.com/v2/DV90", "account": ""}

5. What I already tried:

Pointing Duckdns to my new public IP after router reboot

6. Links to relevant resources:

Can’t get cert with caddy - Help - Caddy Community

Looks like you issued a certificate now :slight_smile:

If you didn’t change something in the meantime, then I would guess that duckdns was a bit unreliable again, but who knows :woman_shrugging:

PS: You also don’t need to use the DNS challenge in your case :innocent:

3 Likes

Yes! It was just duckdns being unreliable, false alarm folks haha

1 Like

This topic was automatically closed after 30 days. New replies are no longer allowed.