1. Output of caddy version:
$ caddy version
v2.5.2 h1:eCJdLyEyAGzuQTa5Mh3gETnYWDClo1LjtQm2q9RNZrs=
2. How I run Caddy:
Dockerized inside of AWS ECS Fargate containers
RUN go install github.com/caddyserver/caddy/v2/cmd/caddy@v2.5.2
WORKDIR /root/project/
COPY Caddyfile /root/project/Caddyfile
CMD caddy run
TaskDefinition:
Type: AWS::ECS::TaskDefinition
Properties:
RequiresCompatibilities:
- FARGATE
ContainerDefinitions:
- Name: caddy-proxy
PortMappings:
- ContainerPort: 8080
- ContainerPort: 8081
CaddyProxyTargetGroupHTTP:
Type: AWS::ElasticLoadBalancingV2::TargetGroup
Properties:
TargetType: ip
Port: 8081
Listener80:
Type: AWS::ElasticLoadBalancingV2::Listener
Properties:
Port: 80
Protocol: TCP
DefaultActions:
- Type: forward
Order: 1
TargetGroupArn: !Ref CaddyProxyTargetGroupHTTP
LoadBalancerArn: !Ref CaddyProxyLoadBalancer
Service:
Type: AWS::ECS::Service
Properties:
LoadBalancers:
- TargetGroupArn: !Ref CaddyProxyTargetGroup
ContainerName: caddy-proxy
ContainerPort: 8080
- TargetGroupArn: !Ref CaddyProxyTargetGroupHTTP
ContainerName: caddy-proxy
ContainerPort: 8081
d. My complete Caddy config:
{
debug
log
acme_ca https://acme-staging-v02.api.letsencrypt.org/directory
http_port 8081
https_port 8080
}
tcp/https://localhost:8080,
tcp/https://localhost:8081 {
log
tls internal
handle {
respond 200 {
body `200_CADDYPROXY_OK`
}
}
}
tcp/https://textio.tech:8080 {
log
tls {
issuer acme {
dir https://acme-staging-v02.api.letsencrypt.org/directory
}
}
handle {
respond 200 {
body `200_CADDYPROXY_OK`
}
}
}
3. The problem I’m having:
$ curl http://textio.tech/.well-known/acme-challenge/somerandomstringhere -i
HTTP/1.1 308 Permanent Redirect
Connection: close
Location: https://textio.tech/.well-known/acme-challenge/somerandomstringhere
Server: Caddy
Date: Wed, 31 Aug 2022 19:38:00 GMT
Content-Length: 0
4. caddy log output:
From oldest (top) to newest (bottom)
{
"logger":"tls.issuance.acme.acme_client",
"msg":"trying to solve challenge",
"identifier":"textio.tech",
"challenge_type":"http-01",
"ca":"https://acme-staging-v02.api.letsencrypt.org/directory"
}
{
"logger":"tls.issuance.acme.acme_client",
"msg":"challenge accepted",
"identifier":"textio.tech",
"challenge_type":"http-01"
}
{
"logger":"tls.issuance.acme.acme_client",
"msg":"validating authorization",
"identifier":"textio.tech",
"problem":{
"type":"urn:ietf:params:acme:error:connection",
"title":"",
"detail":"34.223.128.227: Fetching http://textio.tech/.well-known/acme-challenge/somerandomstringhere: Timeout during connect (likely firewall problem)",
"instance":"",
"subproblems":[]},"order":"https://acme-staging-v02.api.letsencrypt.org/acme/order/66614213/3865304433",
"attempt":1,"max_attempts":3}
{
"logger":"tls.issuance.acme.acme_client",
"msg":"challenge failed",
"identifier":"textio.tech",
"challenge_type":"http-01",
"problem":{
"type":"urn:ietf:params:acme:error:connection",
"title":"",
"detail":"34.223.128.227: Fetching http://textio.tech/.well-known/acme-challenge/somerandomstringhere: Timeout during connect (likely firewall problem)",
"instance":"",
"subproblems":[]}}
{
"logger":"tls.obtain",
"msg":"could not get certificate from issuer",
"identifier":"textio.tech",
"issuer":"acme-staging-v02.api.letsencrypt.org-directory",
"error":"HTTP 400 urn:ietf:params:acme:error:tls - 34.223.128.227: Fetching https://textio.tech/.well-known/acme-challenge/somerandomstringhere: remote error: tls: internal error"}
5. What I think is happening
[The http challenge] challenge is enabled by default and does not require explicit configuration.
But I get the impression that there is some configuration required here. How do I get caddy to stop 308’ing me and actually respond to the http challenge? Does anyone have a fully working example of a Caddyfile that does a http challenge?
6. Links to relevant resources:
My goal is to implement the “http challenge” as described here: Automatic HTTPS — Caddy Documentation