On demand TLS gives NET::ERR_CERT_AUTHORITY_INVALID

1. Caddy version (caddy version):

v2.1.1

2. How I run Caddy:

Loaded caddy configuration from json file on EC2 instance using

curl localhost:2020/config/ -H 'Content-Type: application/json'

a. System environment:

AWS EC2
Ubuntu 18.04

b. Command:

curl localhost:2020/config/ -H 'Content-Type: application/json'

c. Service/unit/compose file:

paste full file contents here

d. My complete Caddyfile or JSON config:

{
  "admin": {
    "disabled": false,
    "enforce_origin": true,
    "listen": ":2020",
    "origins": [
      "localhost:2020"
    ]
  },
  "apps": {
    "http": {
      "servers": {
        "srv0": {
          "listen": [
            ":443"
          ],
          "routes": [
            {
              "handle": [
                {
                  "handler": "subroute",
                  "routes": [
                    {
                      "handle": [
                        {
                          "handler": "vars",
                          "root": "/var/www/html/frontend/dist/webapp/"
                        }
                      ]
                    },
                    {
                      "handle": [
                        {
                          "handler": "rewrite",
                          "uri": "{http.matchers.file.relative}"
                        }
                      ],
                      "match": [
                        {
                          "file": {
                            "try_files": [
                              "{http.request.uri.path}",
                              "{http.request.uri.path}/",
                              "/index.html"
                            ]
                          }
                        }
                      ]
                    },
                   {
                      "handle": [
                        {
                          "encodings": {
                            "gzip": {},
                            "zstd": {}
                          },
                          "handler": "encode"
                        },
                        {
                          "handler": "file_server",
                          "hide": [
                            "Caddyfile"
                          ]
                        }
                      ]
                    }
                  ]
                }
              ]
            }
          ]
        }
      }
    },
    "tls": {
      "automation": {
        "on_demand": {
          "ask": "https://example.com/ssl-allowed/"
        },
        "policies": [
          {
            "on_demand": true
          }
        ]
      }
    }
  }
}

3. The problem I’m having:

The domain pointing to the server is giving SSL error rin the chrome browser

4. Error messages and/or full log output:

Your connection is not private
Attackers might be trying to steal your information from sub.domain.io (for example, passwords, messages or credit cards). Learn more
NET::ERR_CERT_AUTHORITY_INVALID
Subject: sub.domain.io

Issuer: Let's Encrypt Authority X3

Expires on: 17 Dec 2020

Current date: 18 Sep 2020

5. What I already tried:

6. Links to relevant resources:

Hi @anujs,

It looks like this is the best possible explanation - Accessing website on https fails on the first run when using On-Demand TLS - #7 by matt

TL;DR - It might be a browser bug, did you try completely quitting the browser and launching it back?

1 Like

Yah, I always recommend testing with curl or similar on the command line.

This topic was automatically closed after 30 days. New replies are no longer allowed.