Exposing 443 and 80 for DNS Challenge?

[jeremyftw (Jeremy M)]

1. Caddy version (caddy version): 2.4.6

2. How I run Caddy:

Synology environment as reverse proxy to allow web traffic from the internet to connect via jmstash.duckdns.org:8080 to internal IP 192.168.1.78:6969.

a. System environment:

Docker on Synology DSM7

b. Command:

c. Service/unit/compose file:

only changes from docker hub (other than mapping folders and config file) is
0.0.0.0:12019  2019/tcp
0.0.0.0:10443  443/tcp
0.0.0.0:18080  80/tcp

d. My complete Caddyfile or JSON config:

{
    acme_ca https://acme.zerossl.com/v2/DV90
    email   softlord@pobox.com

}

jmstash.duckdns.org:8080

reverse_proxy 192.168.1.78:6969

3. The problem I’m having:

Do i really need to keep port 80 and port 443 of my router open to the internet indefinitely in order for SSL to work? I’m concerned about the security implications. It’s quite possibly i’m thinking about this totally wrong.

4. Error messages and/or full log output:

2022/01/26 04:51:08.548 ERROR tls.obtain could not get certificate from issuer {“identifier”: “jmstash.duckdns.org”, “issuer”: “acme.zerossl.com-v2-DV90”, “error”: “[jmstash.duckdns.org] solving challenges: [jmstash.duckdns.org] authorization took too long (order=https://acme.zerossl.com/v2/DV90/order/SOV3FR0yUE9KSx8K_L0nAQ) (ca=https://acme.zerossl.com/v2/DV90)”}
stdout
04:51:08

5. What I already tried:

6. Links to relevant resources:

[francislavoie]

Those ports are needed for the ACME HTTP and TLS-ALPN challenges (80 and 443 respectively), not for the DNS challenge.

The DNS challenge is special, it works by having the ACME CA do a DNS query to look for a TXT type record on your DNS zone, and requires building Caddy with the DNS plugin for your appropriate DNS provider.

The benefit of the DNS challenge is that it allows you to get wildcard certs (if you need it, most people don’t), and it allows you to get certificates even when ports 80/443 are not accessible (i.e. your ISP blocks those ports, or you’re not able to get a public static IP to reach your server).

There’s no inherent security concerns in keeping ports 80/443 open, though. It’s Caddy’s job to handle incoming connections on those ports. You can read this article to get a better idea of how it looks for home networking:

Using Caddy as a reverse proxy in a home network

If you want to run a service inside a Local Area Network (LAN) such as your home or office – and especially if you want to be able to access it from outside that network – Caddy can help you accomplish this quite easily. This guide will show you how. It assumes you’ve never done this before, but that you have some technical proficiency and are somewhat knowledgable about your own network. Do this at your own risk. There are several ways to make private services accessible from other n…

The other benefit of exclusively using ports 80/443 for your webserver needs, is that browsers default to those ports (for HTTP and HTTPS respectively, Caddy will always just redirect HTTP requests back to the HTTPS port). If you use non-standard ports like 8080 then you have to actually type that port number in your browser’s address bar. Annoying.

[jeremyftw (Jeremy M)]

OK so…

Synology uses ports 80 and 443 for its own web servers. What I would like to do is have Caddy (hosted on my NAS, 192.168.1.111 receive https queries from my DuckDNS domain and pass them along to a web-based server located at 192.168.1.78:6969 …

Am I correct in interpreting your response as that the correct way to get this done is:

• Punch firewall holes 80/443 and point them at the Synology box where Caddy is hosted (not sure how to do this since Caddy lives on a server that already uses those for something else… Maybe in the dockerfile?..this is a bunch of levels of abstraction and making my brain hurt (which is not Caddys fault, certainly)
• Revise Caddyfile to read:

jmstash.duckdns.org
reverse-proxy 192.168.1.78:6969

And the verification/TLS certificate will be addressed without additional ports needing to be opened, etc?

[francislavoie]

@jeremyftw

not sure how to do this since Caddy lives on a server that already uses those for something else

You should be able to switch the ports Synology uses to something else, and have Caddy proxy to it instead. But I’ve never used Synology so I don’t know how easy it is to do that.

You could run Caddy on a different machine if you have one available, to avoid that problem. Caddy is pretty lightweight, most anything would do, even a raspberry pi would probably be sufficient for most proxying tasks.

But yes, you’d port forward 80 and 443 to wherever Caddy is running.

@jeremyftw

• Revise Caddyfile to read:

jmstash.duckdns.org
reverse-proxy 192.168.1.78:6969

reverse_proxy (with an underscore), but yeah.

If you have more than one app/service to proxy to, then you could use subdomains for each one, something like this:

app1.jmstash.duckdns.org {
	reverse_proxy app1:8080
}

app2.jmstash.duckdns.org {
	reverse_proxy app2:8080
}

@jeremyftw

And the verification/TLS certificate will be addressed without additional ports needing to be opened, etc?

Yeah, only ports 80 and 443 need to be open for ACME HTTP and/or TLS-ALPN challenges, and for clients outside of your network to connect to Caddy.

[jeremyftw (Jeremy M)]

OK, now the log shows

"2022/01/26 05:58:19.214 ←[31mERROR←[0m tls.issuance.acme looking up info for HTTP challenge {"host": "jmstash.duckdns.org", "error": "no information found to solve challenge for identifier: jmstash.duckdns.org"}"

Looks like from Caddy v2 reverse proxy config for server already running on 443 that enabling tls_insecure_skip_verify is the way to go?

[jeremyftw (Jeremy M)]

OK I managed to get it working. What ended up being the problem was that I’d generated .key and .crt files for the duckdns site and kept them in the web host directory so the site for which Caddy was a proxy was using a different key/crt combo than Caddy itself.

Deleting the old keys and copying the .key and .crt files from %AppData%\Caddy\Certificates\Local\192.168.1.78 over to the other server directory did the trick. Hooray!

Thanks again for your help.