Dokku + letsencrypt: able to get ssl for subdomain, but not root domain

Question

I am using server side CLI to get an SSL for my web app (following these instructions: https://github.com/dokku/dokku-letsencrypt).

After following the setup I ran:

root@taaalk:~# dokku letsencrypt taaalk

=====> Let's Encrypt taaalk

-----> Updating letsencrypt docker image...

0.1.0: Pulling from dokku/letsencrypt

Digest: sha256:af5f8529c407645e97821ad28eba328f4c59b83b2141334f899303c49fc07823

Status: Image is up to date for dokku/letsencrypt:0.1.0

docker.io/dokku/letsencrypt:0.1.0

Done updating

-----> Enabling ACME proxy for taaalk...

[ ok ] Reloading nginx configuration (via systemctl): nginx.service.

-----> Getting letsencrypt certificate for taaalk...

- Domain 'taaalk.taaalk.co'

darkhttpd/1.12, copyright (c) 2003-2016 Emil Mikulic.

listening on: http://0.0.0.0:80/

2020-04-28 23:12:10,728:INFO:__main__:1317: Generating new account key

2020-04-28 23:12:11,686:INFO:__main__:1343: By using simp_le, you implicitly agree to the CA's terms of service: https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf

2020-04-28 23:12:12,017:INFO:__main__:1406: Generating new certificate private key

2020-04-28 23:12:14,753:ERROR:__main__:1388: CA marked some of the authorizations as invalid, which likely means it could not access http://example.com/.well-known/acme-challenge/X. Did you set correct path in -d example.com:path or --default_root? Are all your domains accessible from the internet? Please check your domains' DNS entries, your host's network/firewall setup and your webserver config. If a domain's DNS entry has both A and AAAA fields set up, some CAs such as Let's Encrypt will perform the challenge validation over IPv6. If your DNS provider does not answer correctly to CAA records request, Let's Encrypt won't issue a certificate for your domain (see https://letsencrypt.org/docs/caa/). Failing authorizations: https://acme-v02.api.letsencrypt.org/acme/authz-v3/4241725520

2020-04-28 23:12:14,757:INFO:__main__:396: Saving account_key.json

2020-04-28 23:12:14,758:INFO:__main__:396: Saving account_reg.json

Challenge validation has failed, see error log.

Debugging tips: -v improves output verbosity. Help is available under --help.

-----> Certificate retrieval failed!

-----> Disabling ACME proxy for taaalk...

[ ok ] Reloading nginx configuration (via systemctl): nginx.service.

done

root@taaalk:~#

So it's easier to read the error was:

2020-04-28 23:12:14,753:ERROR:__main__:1388: CA marked some of the authorizations as invalid, which likely means it could not access http://example.com/.well-known/acme-challenge/X. Did you set correct path in -d example.com:path or --default_root? Are all your domains accessible from the internet? Please check your domains' DNS entries, your host's network/firewall setup and your webserver config. If a domain's DNS entry has both A and AAAA fields set up, some CAs such as Let's Encrypt will perform the challenge validation over IPv6. If your DNS provider does not answer correctly to CAA records request, Let's Encrypt won't issue a certificate for your domain (see https://letsencrypt.org/docs/caa/). Failing authorizations: https://acme-v02.api.letsencrypt.org/acme/authz-v3/4241725520

I did a lot of googling around and the most promising post I found on the subject was this one:

https://veryjoe.com/tech/2019/07/06/HTTPS-dokku.html

In the post it suggested checking my Dokku domain misconfiguration and missing network listeners.

I ran dokku domains:report to check for the misconfiguration. This returned:

root@taaalk:~# dokku domains:report
=====> taaalk domains information
       Domains app enabled:           true                     
       Domains app vhosts:            taaalk.taaalk.co         
       Domains global enabled:        true                     
       Domains global vhosts:         taaalk.co

And I then ran dokku network:report to check for missing listeners:

root@taaalk:~# dokku network:report
=====> taaalk network information
       Network attach post create:    
       Network attach post deploy:    
       Network bind all interfaces:   false
       Network web listeners:         172.17.0.4:5000

After talking things through with a friend we tried adding an 'A' record to my DNS with the host 'taaalk.taaalk.co'.

I then ran:

root@taaalk:~# dokku letsencrypt taaalk
=====> Let's Encrypt taaalk
-----> Updating letsencrypt docker image...
0.1.0: Pulling from dokku/letsencrypt
Digest: sha256:af5f8529c407645e97821ad28eba328f4c59b83b2141334f899303c49fc07823
Status: Image is up to date for dokku/letsencrypt:0.1.0
docker.io/dokku/letsencrypt:0.1.0
       Done updating
-----> Enabling ACME proxy for taaalk...
[ ok ] Reloading nginx configuration (via systemctl): nginx.service.
-----> Getting letsencrypt certificate for taaalk...
        - Domain 'taaalk.taaalk.co'
darkhttpd/1.12, copyright (c) 2003-2016 Emil Mikulic.
listening on: http://0.0.0.0:80/
2020-04-30 13:39:58,623:INFO:__main__:1406: Generating new certificate private key
2020-04-30 13:40:03,879:INFO:__main__:396: Saving fullchain.pem
2020-04-30 13:40:03,880:INFO:__main__:396: Saving chain.pem
2020-04-30 13:40:03,880:INFO:__main__:396: Saving cert.pem
2020-04-30 13:40:03,880:INFO:__main__:396: Saving key.pem
-----> Certificate retrieved successfully.
-----> Installing let's encrypt certificates
-----> Unsetting DOKKU_PROXY_PORT
-----> Setting config vars
       DOKKU_PROXY_PORT_MAP:  http:80:5000
-----> Setting config vars
       DOKKU_PROXY_PORT_MAP:  http:80:5000 https:443:5000
-----> Configuring taaalk.taaalk.co...(using built-in template)
-----> Creating https nginx.conf
       Enabling HSTS
       Reloading nginx
-----> Configuring taaalk.taaalk.co...(using built-in template)
-----> Creating https nginx.conf
       Enabling HSTS
       Reloading nginx
-----> Disabling ACME proxy for taaalk...
[ ok ] Reloading nginx configuration (via systemctl): nginx.service.
       done

Which was successful.

However, now taaalk.taaalk.co has an SSL, but taaalk.co does not.

I don't know where to go from here. I feel it makes sense to change the vhost from taaalk.taaalk.co to taaalk.co, but I am not sure if this is correct or how to do it. The Dokku documentation does not seem to cover changing the vhost name: http://dokku.viewdocs.io/dokku/configuration/domains/

Thank you for any help

Update

I changed the vhost to taaalk.co, so I now have:

root@taaalk:~# dokku domains:report
=====> taaalk domains information
       Domains app enabled:           true                     
       Domains app vhosts:            taaalk.co                
       Domains global enabled:        true                     
       Domains global vhosts:         taaalk.co

However, I still get the following error:

root@taaalk:~# dokku letsencrypt taaalk
=====> Let's Encrypt taaalk
-----> Updating letsencrypt docker image...
0.1.0: Pulling from dokku/letsencrypt
Digest: sha256:af5f8529c407645e97821ad28eba328f4c59b83b2141334f899303c49fc07823
Status: Image is up to date for dokku/letsencrypt:0.1.0
docker.io/dokku/letsencrypt:0.1.0
       Done updating
-----> Enabling ACME proxy for taaalk...
[ ok ] Reloading nginx configuration (via systemctl): nginx.service.
-----> Getting letsencrypt certificate for taaalk...
        - Domain 'taaalk.co'
darkhttpd/1.12, copyright (c) 2003-2016 Emil Mikulic.
listening on: http://0.0.0.0:80/
2020-04-30 17:01:12,996:INFO:__main__:1406: Generating new certificate private key
2020-04-30 17:01:46,068:ERROR:__main__:1388: CA marked some of the authorizations as invalid, which likely means it could not access http://example.com/.well-known/acme-challenge/X. Did you set correct path in -d example.com:path or --default_root? Are all your domains accessible from the internet? Please check your domains' DNS entries, your host's network/firewall setup and your webserver config. If a domain's DNS entry has both A and AAAA fields set up, some CAs such as Let's Encrypt will perform the challenge validation over IPv6. If your DNS provider does not answer correctly to CAA records request, Let's Encrypt won't issue a certificate for your domain (see https://letsencrypt.org/docs/caa/). Failing authorizations: https://acme-v02.api.letsencrypt.org/acme/authz-v3/4277663330
Challenge validation has failed, see error log.

Debugging tips: -v improves output verbosity. Help is available under --help.
-----> Certificate retrieval failed!
-----> Disabling ACME proxy for taaalk...
[ ok ] Reloading nginx configuration (via systemctl): nginx.service.
       done
root@taaalk:~#

Again, reproduced below for ease of reading:

2020-04-30 17:01:46,068:ERROR:__main__:1388: CA marked some of the authorizations as invalid, which likely means it could not access http://example.com/.well-known/acme-challenge/X. Did you set correct path in -d example.com:path or --default_root? Are all your domains accessible from the internet? Please check your domains' DNS entries, your host's network/firewall setup and your webserver config. If a domain's DNS entry has both A and AAAA fields set up, some CAs such as Let's Encrypt will perform the challenge validation over IPv6. If your DNS provider does not answer correctly to CAA records request, Let's Encrypt won't issue a certificate for your domain (see https://letsencrypt.org/docs/caa/). Failing authorizations: https://acme-v02.api.letsencrypt.org/acme/authz-v3/4277663330 Challenge validation has failed, see error log.

score 1 · Answer 1 · answered May 01 '20 at 11:27

The fix was quite simple. First I made A records for both www. and root for my url pointing at my server.

I then set my vhosts to be both taaalk.co and www.taaalk.co with dokku domains:add taaalk www.taaalk.co, etc...

I then removed all the certs associated with taaalk.co with dokku certs:remove taaalk.

I then ran dokku letsencrypt taaalk and everything worked fine.

score 1 · Answer 2 · edited Nov 16 '20 at 01:04

To anyone looking on who tried what Joshua did and still didn't get letsencrypt to generate certs:

My problem was that I didn't have any port mapping for port 80 on dokku, so letsencrypt was unable to communicate with the server to authorise the new cert, giving this error:

ERROR:__main__:1388: CA marked some of the authorizations as invalid, which likely means it could not access http://example.com/.well-known/acme-challenge/X. Did you set correct path in -d example.com:path or --default_root? Are all your domains accessible from the internet? Please check your domains' DNS entries, your host's network/firewall setup and your webserver config. If a domain's DNS entry has both A and AAAA fields set up, some CAs such as Let's Encrypt will perform the challenge validation over IPv6. If your DNS provider does not answer correctly to CAA records request, Let's Encrypt won't issue a certificate for your domain (see https://letsencrypt.org/docs/caa/). Failing authorizations: https://acme-v02.api.letsencrypt.org/acme/authz-v3/4277663330
Challenge validation has failed, see error log.

Silly me - I had removed the port http 80 mapping in dokku as I thought it was unnecessary.

To fix the problem I just added the port mapping again:

dokku proxy:ports-add myapp http:80:4000

(Note: my app connects to port 4000 hence above, your port may be different)

And then ran dokku letsencrypt:

dokku letsencrypt myapp

This sequence is important, setting the proxy ports correctly allows letsencrypt to connect and autorenew the TLS certs again.

Dokku + letsencrypt: able to get ssl for subdomain, but not root domain

2 Answers2