[QUESTION] follow the youtube tutorial and the ssl test fail and log does not give a lot of info

[Victorhpinheiro]

Hello,

Follow the installation on youtube the same versions and could not run the SSL test successfully.
fresh.start I set up the ip correctly and set the following versions:

jrcs/letsencrypt-nginx-proxy-companion
2.1
Docker-gen
0.7.7

I ran
sudo ./ssl_test.sh mydomainname.com

and ran the logs.
sudo docker logs -f --tail 50 letsencrypt-auto

I check the jrcs/letsencrypt-nginx-proxy-companion and apparently is a legacy registry, I do not know if that is the cause?

Do you mind help me find out why is the test unsuccessfully ?

This is the end of the log.

Info: running acme-companion version v2.1.0
Info: Custom Diffie-Hellman group found, generation skipped.
Reloading nginx docker-gen (using separate container docker-gen-auto)...
Reloading nginx (using separate container 7dd92c4715ab1183d45da620b84b23c31f03d5a2eb858cb3398a3d2dafb290f4)...
2021/09/03 03:14:43 Generated '/app/letsencrypt_service_data' from 4 containers
2021/09/03 03:14:43 Running '/app/signal_le_service'
2021/09/03 03:14:43 Watching docker events
2021/09/03 03:14:43 Contents of /app/letsencrypt_service_data did not change. Skipping notification '/app/signal_le_service'
2021/09/03 03:14:54 Received event die for container 460a1872f1d1
2021/09/03 03:14:54 Received event stop for container 460a1872f1d1
2021/09/03 03:14:58 Received event start for container 30d4c3db4c26
2021/09/03 03:15:03 Debounce minTimer fired
2021/09/03 03:15:03 Generated '/app/letsencrypt_service_data' from 4 containers
2021/09/03 03:15:03 Running '/app/signal_le_service'
[Fri Sep 3 03:16:55 UTC 2021] Please refer to https://curl.haxx.se/libcurl/c/libcurl-errors.html for error code: 28
[Fri Sep 3 03:16:55 UTC 2021] Can not init api.
[Fri Sep 3 03:16:55 UTC 2021] Registering account: https://acme-v02.api.letsencrypt.org/directory
[Fri Sep 3 03:17:13 UTC 2021] Please refer to https://curl.haxx.se/libcurl/c/libcurl-errors.html for error code: 28
[Fri Sep 3 03:17:13 UTC 2021] Can not init api.
[Fri Sep 3 03:17:13 UTC 2021] Registering account: https://acme-v02.api.letsencrypt.org/directory

and the log stop there

I also tried the the version 2.0 for jrcs/letsencrypt-nginx-proxy-companion
and I got a different error (code:7)

[Victorhpinheiro]

I found out it was the ufw firewall that was get in the wat of the communication between the containers.

I follow this https://github.com/chaifeng/ufw-docker and manage the docker containers to be able to talk with each other.

I disable the ufw and manage to get the SSL certification without problems.

however, when I use the ufw, I am getting the following problem:

[Fri Sep  3 09:03:23 UTC 2021] The domain key is here: /etc/acme.sh/[email protected]/www.domain.com/www.domain.com.key
[Fri Sep  3 09:03:23 UTC 2021] Single domain='www.domain.com'
[Fri Sep  3 09:03:23 UTC 2021] Getting domain auth token for each domain
[Fri Sep  3 09:03:25 UTC 2021] Getting webroot for domain='www.domain.com'
[Fri Sep  3 09:03:26 UTC 2021] Verifying: www.domain.com
[Fri Sep  3 09:03:29 UTC 2021] Pending
[Fri Sep  3 09:03:32 UTC 2021] Pending
[Fri Sep  3 09:03:35 UTC 2021] Pending
[Fri Sep  3 09:03:38 UTC 2021] www.domain.com:Verify error:Fetching http://www.domain.com/.well-known/acme-challenge/wNZSzBiwlQ: Timeout during connect (likely firewall problem)
[Fri Sep  3 09:03:38 UTC 2021] Please check log file for more details: /dev/null

I replaced domain with my real one

Not sure how to config it correctly :( maybe the container letsencrypt-auto needs an external door for verifying? I am allowing incoming traffic on 80 and 443. not sure how to proceed from here.

[evertramos]

Hello @Victorhpinheiro!

If you are planning on using this repo (I did a quick look at it) you must really know what you are doing and understand IpTables which you probably do, if you got this far. If all settings are correct using this ufw-docker, you should face no trouble to issue your certificate. The Lets Encrypt service uses port 80 and 443 to check the veracity of your domain and issue the ssl.

I myself just use regular docker network once my clients only access through ftp and ssh using a bastion ssh container I put it together, so, even if they share the same docker network, the comunication between app/site's container is done by ssh keys and won't have access to each other. For large server/clients or agencies I use it's own servers so, no worries that much about this access.

One last thing I do for security is to hide all IP addresses (at least the most possible) using CloudFlare services... and some more other stuff.

Hope it helped in some way.

Cheers!

[Victorhpinheiro]

Thanks so much for the return.

I am kind of new in docker but find this universe so fascinating. Thanks for all work you make available.

Will support for one month on patreon.

Cheers!

[pathros]

Hello, Evert!

I have tested again your nginx proxy automation by selecting the newest versions.

Now I am getting errors with the Let's Encrypt.

For example, I have installed the proxy automation and the Docker Wordpress package of your repositories.

Now the wordpress website is not displaying because from the logs of the letsencrypt-auto container I see the following:

domain.com:Verify error:Fetching http://domain.com/.well-known/acme-challenge/long_random_string: Timeout during connect (likely firewall problem)

And from the side of the Docker Wordpress site container I get the following error:

| AH00558: apache2: Could not reliably determine the server's fully qualified domain name, using 172.18.0.7. Set the 'ServerName' directive globally to suppress this message

Do you know how to overcome this?

[evertramos]

Hello @pathros!!

When you update the proxy you must update a few things... did you folllow the update tutorial?

If not, please try to follow it up. If you did all these steps, let me know and we will need some logs to see whats going on.

[pathros]

Hello, @evertramos !!!
Just like the best answer in this post, the problem was the ufw.

For the sake of testing I executed:

$ sudo ufw allow 80

$ sudo ufw allow 443

$ sudo ufw status

Then finally I could see it was working properly:

docker run -dit -e VIRTUAL_HOST=mydomain.com -e LETSENCRYPT_HOST=mydomain.com -e [email protected] --network=proxy --name test-domain-1 httpd:alpine

Thank you! I'll keep exploring the repo! yeahhh

BTW, I installed the latest version of everything here in this repo. I mean:
nginxproxy/docker-gen 0.8.2
nginxproxy/acme-companion 2.1
etc

[evertramos]

Hello @pathros!

Thanks for your reply. Somehow you might have updated the docker or it got block by the netfilter, the docker socket by pass the ufw once it goes directly on netfilter using iptables, so ufw does not see or block anything that docker is running or binding.

But, as I remember you are running rootless so, this might be the reason you needed to open the firewall, but still not sure.

Really glad you had it up and running with the latest version!