1. Caddy version (caddy version): Frontend Caddy reverse proxy server built with the Cloudflare module root@caddy:~ # caddy version v2.4.3 h1:Y1FaV2N4WO3rBqxSYA8UZsZTQdN+PwcoOcAiZTM8C0I= Backend Caddy web server using a static binary root@file:~ # caddy version v2.4.3 h1:Y1FaV2N4WO3rBqxSYA8UZsZTQ…

Ah, indeed I did miss that. Sigh, I kinda wish chi would path.Clean when they do the join, but oh well. Fixed in acmeserver: Trim slashes from path prefix · caddyserver/caddy@2de7e14 · GitHub .

If I build Caddy from the master, will I be able to test the fix?

Yep. It’s on the master branch.

Yeeha! :cowboy_hat_face: I’m back in business. Thanks @francislavoie @matt

Just a heads up at this stage. For the last nine days, access to the backend file server over an encrypted local connection has worked flawlessly. Today, it’s come crashing down. Here’s a process log extract around the time of the last certificate renewal. 2021/06/30 18:35:36 {"newNonce":"https://…

Yup. Just tried accessing the site this morning and it kicked in straight away. There could be a boundary issue. There were two groups of logged messages relating to the local CA since my last post. It’s hard to say after which one the file server would have become accessible again as this happened…

So I filtered the frontend process log across an 18 hour window (two-thirds of 24 hours = cert renewal window) and basically looked for lines with acme.lan and added some context around those. There’s also a section of the log where I first detected the issue and unsuccessfully tried to bring up the…

Well, my theory that there might be an end-of-month boundary issue has been dashed. I haven’t been able to contact the file server for almost two days now (since 3-Jul AM). I had hoped it would recover itself, but it hasn’t. I rolled back to non-secure backend comms and I’m able to contact the file…

@basil the mTLS certs from Caddy’s PKI module have a 7 day lifetime, whereas public ACME has 90 day lifetimes. So they should renew every 5-ish days. The time there is probably the “expires at” time on the certificate. I don’t understand why it wouldn’t have renewed in time. @matt got any ideas? E…

[image] francislavoie: The leaf certs should have 12 hour lifetimes. So you should see a renewal every 8 hours I think. And that’s certainly the evidence in the frontend process log for both acme.lan and file.lan. There’s a pattern that clearly repeats and certs are being renewed every eight …

I’ve stumbled across something I didn’t quite expect. I restarted the frontend Caddy server. This is what I saw in the logs. All looks pretty normal. {"level":"info","ts":"2021-07-04T21:50:33.656+0800","logger":"http.log.access","msg":"handled request","request":{"remote_addr":"172.70.42.60:12274"…

Caddy Community

mTLS: tls internal error

Help

show post in topic

Home
Categories
Guidelines
Terms of Service

Powered by Discourse, best viewed with JavaScript enabled