OPNsense Setup - Certificate Error

Help
1

1. The problem I’m having:

I have been attempting to setup caddy as instructed on the opnsense caddy tutorial website. I’ve setup the firewall rules and checked the right boxes when setting up my domain. However I must be missing something that I can’t figure out. My domain does not work at all once created and on the opnsense dashboard widget for Caddy Certificates it has the message “Caddy does not manage any automatic certificates”. I also get the following errors below:

2. Error messages and/or full log output:

2024-08-15T16:33:59-05:00	Informational	caddy	"info","ts":"2024-08-15T21:33:59Z","logger":"tls.issuance.acme.acme_client","msg":"trying to solve challenge","identifier":"opnsense-test.marquez.com","challenge_type":"http-01","ca":"https://acme.zerossl.com/v2/DV90"}	
2024-08-15T16:33:58-05:00	Informational	caddy	"info","ts":"2024-08-15T21:33:58Z","logger":"tls.issuance.acme","msg":"using ACME account","account_id":"https://acme.zerossl.com/v2/DV90/account/by02PR_gu1hgQgLgVnwLCQ","account_contact":["mailto:example.com"]}	
2024-08-15T16:33:58-05:00	Informational	caddy	"info","ts":"2024-08-15T21:33:58Z","logger":"tls.issuance.acme","msg":"done waiting on internal rate limiter","identifiers":["opnsense-test.marquez.com"],"ca":"https://acme.zerossl.com/v2/DV90","account":"example.com"}	
2024-08-15T16:33:58-05:00	Informational	caddy	"info","ts":"2024-08-15T21:33:58Z","logger":"tls.issuance.acme","msg":"waiting on internal rate limiter","identifiers":["opnsense-test.marquez.com"],"ca":"https://acme.zerossl.com/v2/DV90","account":"example.com"}	
2024-08-15T16:33:58-05:00	Error	caddy	"error","ts":"2024-08-15T21:33:58Z","logger":"tls.obtain","msg":"could not get certificate from issuer","identifier":"opnsense-test.marquez.com","issuer":"acme-v02.api.letsencrypt.org-directory","error":"HTTP 429 urn:ietf:params:acme:error:rateLimited - Error creating new order :: too many failed authorizations recently: see https://letsencrypt.org/docs/failed-validation-limit/"}	
2024-08-15T16:33:57-05:00	Error	caddy	"error","ts":"2024-08-15T21:33:57Z","logger":"tls.issuance.acme.acme_client","msg":"validating authorization","identifier":"opnsense-test.marquez.com","problem":{"type":"urn:ietf:params:acme:error:unauthorized","title":"","detail":"Cannot negotiate ALPN protocol \"acme-tls/1\" for tls-alpn-01 challenge","instance":"","subproblems":[]},"order":"https://acme-v02.api.letsencrypt.org/acme/order/1893209516/296580698816","attempt":1,"max_attempts":3}	
2024-08-15T16:33:57-05:00	Error	caddy	"error","ts":"2024-08-15T21:33:57Z","logger":"tls.issuance.acme.acme_client","msg":"challenge failed","identifier":"opnsense-test.marquez.com","challenge_type":"tls-alpn-01","problem":{"type":"urn:ietf:params:acme:error:unauthorized","title":"","detail":"Cannot negotiate ALPN protocol \"acme-tls/1\" for tls-alpn-01 challenge","instance":"","subproblems":[]}}	
2024-08-15T16:33:57-05:00	Informational	caddy	"info","ts":"2024-08-15T21:33:57Z","logger":"tls.issuance.acme.acme_client","msg":"trying to solve challenge","identifier":"opnsense-test.marquez.com","challenge_type":"tls-alpn-01","ca":"https://acme-v02.api.letsencrypt.org/directory"}	
2024-08-15T16:33:56-05:00	Informational	caddy	"info","ts":"2024-08-15T21:33:56Z","logger":"tls.issuance.acme","msg":"using ACME account","account_id":"https://acme-v02.api.letsencrypt.org/acme/acct/1893209516","account_contact":["mailto:example.com"]}	
2024-08-15T16:33:56-05:00	Informational	caddy	"info","ts":"2024-08-15T21:33:56Z","logger":"tls.issuance.acme","msg":"done waiting on internal rate limiter","identifiers":["opnsense-test.marquez.com"],"ca":"https://acme-v02.api.letsencrypt.org/directory","account":"example.com"}	
2024-08-15T16:33:56-05:00	Informational	caddy	"info","ts":"2024-08-15T21:33:56Z","logger":"tls.issuance.acme","msg":"waiting on internal rate limiter","identifiers":["opnsense-test.marquez.com"],"ca":"https://acme-v02.api.letsencrypt.org/directory","account":"example.com"}	
2024-08-15T16:33:56-05:00	Informational	caddy	"info","ts":"2024-08-15T21:33:56Z","logger":"tls.obtain","msg":"obtaining certificate","identifier":"opnsense-test.marquez.com"}	
2024-08-15T16:33:56-05:00	Informational	caddy	"info","ts":"2024-08-15T21:33:56Z","logger":"tls.obtain","msg":"lock acquired","identifier":"opnsense-test.marquez.com"}	
2024-08-15T16:33:55-05:00	Error	caddy	"error","ts":"2024-08-15T21:33:55Z","logger":"tls","msg":"job failed","error":"opnsense-test.marquez.com: obtaining certificate: [opnsense-test.marquez.com] Obtain: [opnsense-test.marquez.com] solving challenges: [opnsense-test.marquez.com] context canceled (order=https://acme.zerossl.com/v2/DV90/order/IhwyzhrVcgql2EcQGWuRfA) (ca=https://acme.zerossl.com/v2/DV90)"}	
2024-08-15T16:33:55-05:00	Informational	caddy	"info","ts":"2024-08-15T21:33:55Z","logger":"tls.obtain","msg":"releasing lock","identifier":"opnsense-test.marquez.com"}	
2024-08-15T16:33:55-05:00	Error	caddy	"error","ts":"2024-08-15T21:33:55Z","logger":"tls.obtain","msg":"could not get certificate from issuer","identifier":"opnsense-test.marquez.com","issuer":"acme.zerossl.com-v2-DV90","error":"[opnsense-test.marquez.com] solving challenges: [opnsense-test.marquez.com] context canceled (order=https://acme.zerossl.com/v2/DV90/order/IhwyzhrVcgql2EcQGWuRfA) (ca=https://acme.zerossl.com/v2/DV90)"}	
2024-08-15T16:33:55-05:00	Error	caddy	"error","ts":"2024-08-15T21:33:55Z","logger":"tls.issuance.acme.acme_client","msg":"deactivating authorization","identifier":"opnsense-test.marquez.com","authz":"https://acme.zerossl.com/v2/DV90/authz/Ye9T1I559USYfvRYNf8ROw","error":"attempt 1: https://acme.zerossl.com/v2/DV90/authz/Ye9T1I559USYfvRYNf8ROw: context canceled"}	
2024-08-15T16:33:55-05:00	Error	caddy	"warn","ts":"2024-08-15T21:33:55Z","logger":"tls.issuance.acme.acme_client","msg":"HTTP request failed; retrying","url":"https://acme.zerossl.com/v2/DV90/authz/Ye9T1I559USYfvRYNf8ROw","error":"performing request: Post \"https://acme.zerossl.com/v2/DV90/authz/Ye9T1I559USYfvRYNf8ROw\": context canceled"}	
2024-08-15T16:33:55-05:00	Informational	caddy	"info","ts":"2024-08-15T21:33:55Z","logger":"admin","msg":"stopped previous server","address":"unix//var/run/caddy/caddy.sock"}	
2024-08-15T16:33:55-05:00	Informational	caddy	"info","ts":"2024-08-15T21:33:55Z","logger":"tls.obtain","msg":"acquiring lock","identifier":"opnsense-test.marquez.com"}
2024-08-15T16:33:55-05:00	Warning	caddy	"warn","ts":"2024-08-15T21:33:55Z","logger":"http.auto_https","msg":"server is listening only on the HTTP port, so no automatic HTTPS will be applied to this server","server_name":"srv1","http_port":80}	
2024-08-15T16:33:55-05:00	Informational	caddy	"info","ts":"2024-08-15T21:33:55Z","logger":"http.auto_https","msg":"enabling automatic HTTP->HTTPS redirects","server_name":"srv0"}	
2024-08-15T16:33:55-05:00	Informational	caddy	"info","ts":"2024-08-15T21:33:55Z","logger":"http.auto_https","msg":"server is listening only on the HTTPS port but has no TLS connection policies; adding one to enable TLS","server_name":"srv0","https_port":443}	
2024-08-15T16:33:55-05:00	Informational	caddy	"info","ts":"2024-08-15T21:33:55Z","logger":"admin","msg":"admin endpoint started","address":"unix//var/run/caddy/caddy.sock","enforce_origin":false,"origins":["//::1","","//127.0.0.1"]}	
2024-08-15T16:33:55-05:00	Informational	caddy	"info","ts":"2024-08-15T21:33:55Z","logger":"admin.api","msg":"received request","method":"POST","host":"127.0.0.1","uri":"/load","remote_ip":"","remote_port":"","headers":{"Accept-Encoding":["gzip"],"Cache-Control":["must-revalidate"],"Content-Length":["1382"],"Content-Type":["application/json"],"User-Agent":["Go-http-client/1.1"]}}	
2024-08-15T16:33:55-05:00	Informational	caddy	"info","ts":"2024-08-15T21:33:55Z","logger":"tls.cache.maintenance","msg":"stopped background certificate maintenance","cache":"0x87043da80"}	
2024-08-15T16:33:55-05:00	Warning	caddy	"warn","ts":"2024-08-15T21:33:55Z","logger":"http.auto_https","msg":"server is listening only on the HTTP port, so no automatic HTTPS will be applied to this server","server_name":"srv1","http_port":80}	
2024-08-15T16:33:55-05:00	Informational	caddy	"info","ts":"2024-08-15T21:33:55Z","logger":"tls.cache.maintenance","msg":"started background certificate maintenance","cache":"0x87043da80"}	
2024-08-15T16:33:55-05:00	Informational	caddy	"info","ts":"2024-08-15T21:33:55Z","logger":"http.auto_https","msg":"enabling automatic HTTP->HTTPS redirects","server_name":"srv0"}	
2024-08-15T16:33:55-05:00	Informational	caddy	"info","ts":"2024-08-15T21:33:55Z","logger":"http.auto_https","msg":"server is listening only on the HTTPS port but has no TLS connection policies; adding one to enable TLS","server_name":"srv0","https_port":443}	
2024-08-15T16:10:34-05:00	Informational	caddy	"info","ts":"2024-08-15T21:10:34Z","logger":"tls.issuance.acme.acme_client","msg":"trying to solve challenge","identifier":"opnsense-test.marquez.com","challenge_type":"http-01","ca":"https://acme.zerossl.com/v2/DV90"}	
2024-08-15T16:10:33-05:00	Informational	caddy	"info","ts":"2024-08-15T21:10:33Z","logger":"tls.issuance.acme","msg":"using ACME account","account_id":"https://acme.zerossl.com/v2/DV90/account/by02PR_gu1hgQgLgVnwLCQ","account_contact":["mailto:example.com"]}	
2024-08-15T16:10:33-05:00	Informational	caddy	"info","ts":"2024-08-15T21:10:33Z","logger":"tls.issuance.acme","msg":"done waiting on internal rate limiter","identifiers":["opnsense-test.marquez.com"],"ca":"https://acme.zerossl.com/v2/DV90","account":"example.com"}	
2024-08-15T16:10:33-05:00	Informational	caddy	"info","ts":"2024-08-15T21:10:33Z","logger":"tls.issuance.acme","msg":"waiting on internal rate limiter","identifiers":["opnsense-test.marquez.com"],"ca":"https://acme.zerossl.com/v2/DV90","account":"example.com"}	
2024-08-15T16:10:33-05:00	Error	caddy	"error","ts":"2024-08-15T21:10:33Z","logger":"tls.obtain","msg":"could not get certificate from issuer","identifier":"opnsense-test.marquez.com","issuer":"acme-v02.api.letsencrypt.org-directory","error":"HTTP 403 urn:ietf:params:acme:error:unauthorized - Cannot negotiate ALPN protocol \"acme-tls/1\" for tls-alpn-01 challenge"}	
2024-08-15T16:10:33-05:00	Error	caddy	"error","ts":"2024-08-15T21:10:33Z","logger":"tls.issuance.acme.acme_client","msg":"validating authorization","identifier":"opnsense-test.marquez.com","problem":{"type":"urn:ietf:params:acme:error:unauthorized","title":"","detail":"Cannot negotiate ALPN protocol \"acme-tls/1\" for tls-alpn-01 challenge","instance":"","subproblems":[]},"order":"https://acme-v02.api.letsencrypt.org/acme/order/1893209516/296576201246","attempt":2,"max_attempts":3}	
2024-08-15T16:10:33-05:00	Error	caddy	"error","ts":"2024-08-15T21:10:33Z","logger":"tls.issuance.acme.acme_client","msg":"challenge failed","identifier":"opnsense-test.marquez.com","challenge_type":"tls-alpn-01","problem":{"type":"urn:ietf:params:acme:error:unauthorized","title":"","detail":"Cannot negotiate ALPN protocol \"acme-tls/1\" for tls-alpn-01 challenge","instance":"","subproblems":[]}}	
2024-08-15T16:10:33-05:00	Informational	caddy	"info","ts":"2024-08-15T21:10:33Z","logger":"tls.issuance.acme.acme_client","msg":"trying to solve challenge","identifier":"opnsense-test.marquez.com","challenge_type":"tls-alpn-01","ca":"https://acme-v02.api.letsencrypt.org/directory"}	
2024-08-15T16:10:32-05:00	Error	caddy	"error","ts":"2024-08-15T21:10:32Z","logger":"tls.issuance.acme.acme_client","msg":"validating authorization","identifier":"opnsense-test.marquez.com","problem":{"type":"urn:ietf:params:acme:error:unauthorized","title":"","detail":"216.40.34.37: Invalid response from http://opnsense-test.marquez.com/.well-known/acme-challenge/G2zVqTW4zbl1anHrbN1XeqF2DjGwVqweIfRdVZt8dg0: 404","instance":"","subproblems":[]},"order":"https://acme-v02.api.letsencrypt.org/acme/order/1893209516/296576195026","attempt":1,"max_attempts":3}	
2024-08-15T16:10:32-05:00	Error	caddy	"error","ts":"2024-08-15T21:10:32Z","logger":"tls.issuance.acme.acme_client","msg":"challenge failed","identifier":"opnsense-test.marquez.com","challenge_type":"http-01","problem":{"type":"urn:ietf:params:acme:error:unauthorized","title":"","detail":"216.40.34.37: Invalid response from http://opnsense-test.marquez.com/.well-known/acme-challenge/G2zVqTW4zbl1anHrbN1XeqF2DjGwVqweIfRdVZt8dg0: 404","instance":"","subproblems":[]}}

3. Caddy version:

Caddy-os opn-plugin version - 1.6.2
CLI Version : v2.8.4 - h1:q3pe0wpBj1OcHFZ3n/1nl4V4bxBrYoSoab7rL9BMYNk=

4. How I installed and ran Caddy:

a. System environment:

Caddy Plugin running on OPNSense 24.7.1
OPNSense running on Proxmox 8.2.0 (running kernel: 6.8.12-1-pve)

b. Command:

installed via gui

c. Service/unit/compose file:

N/A

d. My complete Caddy config:

# DO NOT EDIT THIS FILE -- OPNsense auto-generated file


# caddy_user=root

# Global Options
{
        log {
                output net unixgram//var/run/caddy/log.sock {
                }
                format json {
                        time_format rfc3339
                }
        }

        email info@example.com
        grace_period 10s
        import /usr/local/etc/caddy/caddy.d/*.global
}

# Reverse Proxy Configuration


# Reverse Proxy Domain: "1b074538-9c6b-4142-b05a-644f6671dec2"
opnsense-test.marquez.com {
        handle {
                reverse_proxy 192.168.100.3:8443 {
                        transport http {
                                tls_insecure_skip_verify
                                tls_server_name opnsense-test.marquez.com
                        }
                }
        }
}

5. Links to relevant resources:

opnsense caddy tutorial website

2

Howdy @otakian, welcome to the Caddy community.

This means Caddy must have been attempting to get certificates for a while and been failing to do so, but we don’t see those logs. Is there more you haven’t posted?

I’m seeing errors from LetsEncrypt that it couldn’t negotiate ALPN, and context cancelled errors for ZeroSSL. The first thing I’d be checking is public DNS. Does it point where you think it points? Does it resolve do your public IP address? Does OPNsense receive packets going to that address?

You might try troubleshooting by running Caddy without HTTPS (just on port 80 with a http:// website) and trying to access it from the internet.

When redacting emails, it’s best not to replace your email with what is possibly someone else’s email address.

You could use an email address at example.com for this purpose instead - it is reserved for just this kind of usage.

3

Hi @Whitestrake , thank you for the suggestions. I’ve added more logs before those errors to the post for further context. I’ve also updated the email to info@example.com, glad to know the best practices.

How would I go about checking the DNS resolving location? But to try and answer, when I try to go to my location it ends up at some domain called RealNames. Let me try to troubleshoot without https and see how it goes.

4

I tried without https resolving and no luck. I also tried with a new domain name that doesn’t resolve to something weird with https back on and I got new log errors

2024-08-15T21:49:57-05:00	Informational	caddy	"info","ts":"2024-08-16T02:49:57Z","logger":"tls.issuance.acme","msg":"using ACME account","account_id":"https://acme.zerossl.com/v2/DV90/account/by02PR_gu1hgQgLgVnwLCQ","account_contact":["mailto:example.com"]}	
2024-08-15T21:49:57-05:00	Informational	caddy	"info","ts":"2024-08-16T02:49:57Z","logger":"tls.issuance.acme","msg":"done waiting on internal rate limiter","identifiers":["opnsense-test.jellyfin.com"],"ca":"https://acme.zerossl.com/v2/DV90","account":"example.com"}	
2024-08-15T21:49:57-05:00	Informational	caddy	"info","ts":"2024-08-16T02:49:57Z","logger":"tls.issuance.acme","msg":"waiting on internal rate limiter","identifiers":["opnsense-test.jellyfin.com"],"ca":"https://acme.zerossl.com/v2/DV90","account":"example.com"}	
2024-08-15T21:49:57-05:00	Error	caddy	"error","ts":"2024-08-16T02:49:57Z","logger":"tls.obtain","msg":"could not get certificate from issuer","identifier":"opnsense-test.jellyfin.com","issuer":"acme-v02.api.letsencrypt.org-directory","error":"HTTP 400 urn:ietf:params:acme:error:dns - DNS problem: NXDOMAIN looking up A for opnsense-test.jellyfin.com - check that a DNS record exists for this domain; DNS problem: NXDOMAIN looking up AAAA for opnsense-test.jellyfin.com - check that a DNS record exists for this domain"}	
2024-08-15T21:49:57-05:00	Error	caddy	"error","ts":"2024-08-16T02:49:57Z","logger":"tls.issuance.acme.acme_client","msg":"validating authorization","identifier":"opnsense-test.jellyfin.com","problem":{"type":"urn:ietf:params:acme:error:dns","title":"","detail":"DNS problem: NXDOMAIN looking up A for opnsense-test.jellyfin.com - check that a DNS record exists for this domain; DNS problem: NXDOMAIN looking up AAAA for opnsense-test.jellyfin.com - check that a DNS record exists for this domain","instance":"","subproblems":[]},"order":"https://acme-v02.api.letsencrypt.org/acme/order/1893209516/296646398166","attempt":2,"max_attempts":3}	
2024-08-15T21:49:57-05:00	Error	caddy	"error","ts":"2024-08-16T02:49:57Z","logger":"tls.issuance.acme.acme_client","msg":"challenge failed","identifier":"opnsense-test.jellyfin.com","challenge_type":"http-01","problem":{"type":"urn:ietf:params:acme:error:dns","title":"","detail":"DNS problem: NXDOMAIN looking up A for opnsense-test.jellyfin.com - check that a DNS record exists for this domain; DNS problem: NXDOMAIN looking up AAAA for opnsense-test.jellyfin.com - check that a DNS record exists for this domain","instance":"","subproblems":[]}}	
2024-08-15T21:49:57-05:00	Informational	caddy	"info","ts":"2024-08-16T02:49:57Z","logger":"tls.issuance.acme.acme_client","msg":"trying to solve challenge","identifier":"opnsense-test.jellyfin.com","challenge_type":"http-01","ca":"https://acme-v02.api.letsencrypt.org/directory"}	
2024-08-15T21:49:56-05:00	Error	caddy	"error","ts":"2024-08-16T02:49:56Z","logger":"tls.issuance.acme.acme_client","msg":"validating authorization","identifier":"opnsense-test.jellyfin.com","problem":{"type":"urn:ietf:params:acme:error:dns","title":"","detail":"DNS problem: NXDOMAIN looking up A for opnsense-test.jellyfin.com - check that a DNS record exists for this domain; DNS problem: NXDOMAIN looking up AAAA for opnsense-test.jellyfin.com - check that a DNS record exists for this domain","instance":"","subproblems":[]},"order":"https://acme-v02.api.letsencrypt.org/acme/order/1893209516/296646394106","attempt":1,"max_attempts":3}	
2024-08-15T21:49:56-05:00	Error	caddy	"error","ts":"2024-08-16T02:49:56Z","logger":"tls.issuance.acme.acme_client","msg":"challenge failed","identifier":"opnsense-test.jellyfin.com","challenge_type":"tls-alpn-01","problem":{"type":"urn:ietf:params:acme:error:dns","title":"","detail":"DNS problem: NXDOMAIN looking up A for opnsense-test.jellyfin.com - check that a DNS record exists for this domain; DNS problem: NXDOMAIN looking up AAAA for opnsense-test.jellyfin.com - check that a DNS record exists for this domain","instance":"","subproblems":[]}}	
2024-08-15T21:49:55-05:00	Informational	caddy	"info","ts":"2024-08-16T02:49:55Z","logger":"tls.issuance.acme.acme_client","msg":"trying to solve challenge","identifier":"opnsense-test.jellyfin.com","challenge_type":"tls-alpn-01","ca":"https://acme-v02.api.letsencrypt.org/directory"}	
2024-08-15T21:49:55-05:00	Informational	caddy	"info","ts":"2024-08-16T02:49:55Z","logger":"tls.issuance.acme","msg":"using ACME account","account_id":"https://acme-v02.api.letsencrypt.org/acme/acct/1893209516","account_contact":["mailto:example.com"]}	
2024-08-15T21:49:55-05:00	Informational	caddy	"info","ts":"2024-08-16T02:49:55Z","logger":"tls.issuance.acme","msg":"done waiting on internal rate limiter","identifiers":["opnsense-test.jellyfin.com"],"ca":"https://acme-v02.api.letsencrypt.org/directory","account":"example.com"}	
2024-08-15T21:49:55-05:00	Informational	caddy	"info","ts":"2024-08-16T02:49:55Z","logger":"tls.issuance.acme","msg":"waiting on internal rate limiter","identifiers":["opnsense-test.jellyfin.com"],"ca":"https://acme-v02.api.letsencrypt.org/directory","account":"example.com"}
5

You could check with a command line tool like dig or nslookup. Windows Powershell has Resolve-DnsName and MacOS has dscacheutil. You can also do a Google search for DNS tools - MXToolBox has a decent website you can check with, for example, but almost any choice should work.

That’s going to be a major problem.

When the ACME provider (e.g. LetsEncrypt or ZeroSSL) tries to validate your certificate request, they will attempt to connect to that domain via the public internet.

In order to successfully validate, this connection attempt must reach your Caddy server. If public connections to your domain name go to some other server you don’t control, then Caddy will not be able to complete HTTP or ALPN challenges.

You would need to find out why this is happening and correct it so that the domain you want a certificate for resolves to your Caddy server instead.

1 Like
6

Yeah after trying a few things I’m at a loss here. I’m not sure why my caddy plugin is not able to obtain certificates.

7

Figured out my issue, and it’s due to my lack of knowledge on the matter regarding reverse proxies and networking as a whole.

I was mistakenly under the impression that caddy setups a domain from whatever I chose. I did not realize that it assumes I have a domain ready to use. The documentation stating to point my domains A or AAAA to my public IP didn’t register to me as I did not understand what that meant.

So basically, I need a domain first, point it to my IP, or setup a dynamic DNS and then go from there. Hope this helps anyone in the future getting into reverse proxies.

1 Like
8

Ahh, right! Yeah, that would absolutely be it.

If anyone’s looking for a free domain to try Caddy with, we get a lot of people that use the free subdomain from DuckDNS for that. Also, the dot TK registrar gives out free (short-lived, manually renewed) domains.

1 Like
9

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.