[QUESTION] follow the youtube tutorial and the ssl test fail and log does not give a lot of info

[Victorhpinheiro]

Hello,

Follow the installation on youtube the same versions and could not run the SSL test successfully.
fresh.start I set up the ip correctly and set the following versions:

jrcs/letsencrypt-nginx-proxy-companion
2.1
Docker-gen
0.7.7

I ran
sudo ./ssl_test.sh mydomainname.com

and ran the logs.
sudo docker logs -f --tail 50 letsencrypt-auto

I check the jrcs/letsencrypt-nginx-proxy-companion and apparently is a legacy registry, I do not know if that is the cause?

Do you mind help me find out why is the test unsuccessfully ?

This is the end of the log.

Info: running acme-companion version v2.1.0
Info: Custom Diffie-Hellman group found, generation skipped.
Reloading nginx docker-gen (using separate container docker-gen-auto)...
Reloading nginx (using separate container 7dd92c4715ab1183d45da620b84b23c31f03d5a2eb858cb3398a3d2dafb290f4)...
2021/09/03 03:14:43 Generated '/app/letsencrypt_service_data' from 4 containers
2021/09/03 03:14:43 Running '/app/signal_le_service'
2021/09/03 03:14:43 Watching docker events
2021/09/03 03:14:43 Contents of /app/letsencrypt_service_data did not change. Skipping notification '/app/signal_le_service'
2021/09/03 03:14:54 Received event die for container 460a1872f1d1
2021/09/03 03:14:54 Received event stop for container 460a1872f1d1
2021/09/03 03:14:58 Received event start for container 30d4c3db4c26
2021/09/03 03:15:03 Debounce minTimer fired
2021/09/03 03:15:03 Generated '/app/letsencrypt_service_data' from 4 containers
2021/09/03 03:15:03 Running '/app/signal_le_service'
[Fri Sep 3 03:16:55 UTC 2021] Please refer to https://curl.haxx.se/libcurl/c/libcurl-errors.html for error code: 28
[Fri Sep 3 03:16:55 UTC 2021] Can not init api.
[Fri Sep 3 03:16:55 UTC 2021] Registering account: https://acme-v02.api.letsencrypt.org/directory
[Fri Sep 3 03:17:13 UTC 2021] Please refer to https://curl.haxx.se/libcurl/c/libcurl-errors.html for error code: 28
[Fri Sep 3 03:17:13 UTC 2021] Can not init api.
[Fri Sep 3 03:17:13 UTC 2021] Registering account: https://acme-v02.api.letsencrypt.org/directory

and the log stop there

I also tried the the version 2.0 for jrcs/letsencrypt-nginx-proxy-companion
and I got a different error (code:7)

[Victorhpinheiro]

I found out it was the ufw firewall that was get in the wat of the communication between the containers.

I follow this https://github.com/chaifeng/ufw-docker and manage the docker containers to be able to talk with each other.

I disable the ufw and manage to get the SSL certification without problems.

however, when I use the ufw, I am getting the following problem:

[Fri Sep  3 09:03:23 UTC 2021] The domain key is here: /etc/acme.sh/domain@protonmail.com/www.domain.com/www.domain.com.key
[Fri Sep  3 09:03:23 UTC 2021] Single domain='www.domain.com'
[Fri Sep  3 09:03:23 UTC 2021] Getting domain auth token for each domain
[Fri Sep  3 09:03:25 UTC 2021] Getting webroot for domain='www.domain.com'
[Fri Sep  3 09:03:26 UTC 2021] Verifying: www.domain.com
[Fri Sep  3 09:03:29 UTC 2021] Pending
[Fri Sep  3 09:03:32 UTC 2021] Pending
[Fri Sep  3 09:03:35 UTC 2021] Pending
[Fri Sep  3 09:03:38 UTC 2021] www.domain.com:Verify error:Fetching http://www.domain.com/.well-known/acme-challenge/wNZSzBiwlQ: Timeout during connect (likely firewall problem)
[Fri Sep  3 09:03:38 UTC 2021] Please check log file for more details: /dev/null

I replaced domain with my real one

Not sure how to config it correctly :( maybe the container letsencrypt-auto needs an external door for verifying? I am allowing incoming traffic on 80 and 443. not sure how to proceed from here.

[evertramos]

Hello @Victorhpinheiro!

If you are planning on using this repo (I did a quick look at it) you must really know what you are doing and understand IpTables which you probably do, if you got this far. If all settings are correct using this ufw-docker, you should face no trouble to issue your certificate. The Lets Encrypt service uses port 80 and 443 to check the veracity of your domain and issue the ssl.

I myself just use regular docker network once my clients only access through ftp and ssh using a bastion ssh container I put it together, so, even if they share the same docker network, the comunication between app/site's container is done by ssh keys and won't have access to each other. For large server/clients or agencies I use it's own servers so, no worries that much about this access.

One last thing I do for security is to hide all IP addresses (at least the most possible) using CloudFlare services... and some more other stuff.

Hope it helped in some way.

Cheers!