Replies: 6 comments
-
|
In In a2c logs, I found the following that I believe corresponds to this: Is this referring to the internal CA that should be renewing my certificate? The name I should also note that win-acme is requesting a certificate that's already been created by the CA, so enroll -> get_cert eventually calls get_existing_cert; a response is generated with cert data of content type So it seems that get_cert() works, but get_chain() fails, and as a resule, _cert_bundle_create(...) also fails, which invalidates the order. So, I'm just not sure how to correct get_chain(). Any input would be appreciated -- thank you! |
Beta Was this translation helpful? Give feedback.
-
|
Hi, your assumption is right. The function _cert_bundle_create expects both ca-chain and certificate. Both will be fetched from the CA server and I see from the above logs that the request to fetch the ca chain failes with an error:
The Can you please share the full log via email to Which windows server version are you running? Further out of curiosity: why did you decide to use the mscertsrv handler instead of the WCCE one? /G. |
Beta Was this translation helpful? Give feedback.
-
|
Hello, Just sent you an email; I'll summarize briefly here. I attached full logs to the email (win-acme portion seen below). I tried, as your suggested, to switch to the mswcce CA handler and it worked better -- I got past the issue I was having earlier once I provided proper config details in acme_srv.cfg (although, including target_domain and domain_controller kept giving errors, but removing both allowed for seemingly more success). I'm running win-acme on a Windows Servers 2019 Datacenter version 1809 with sites hosted via IIS 10. Now, the issue seems to be more win-acme related, where the certificate binding in IIS fails despite it being (seemingly) properly found. I've found a variety of forums/issues/discussions on win-acme's GitHub relating to this, but none of those solutions seem to be relevant to this specific case of using ADCS (rather than LE or ZeroSSL or another environment difference). Is this something you've encountered? Let me know and thank you again for your promptness! end of win-acme logs: end of a2c logs: Thank you! |
Beta Was this translation helpful? Give feedback.
-
|
Hi, happy to hear that you overcame the issue. I would always prefer the usage of the wcce_handler with Kerberos activated due to [the announcement from Microsoft to retire NTLM] (https://techcommunity.microsoft.com/t5/windows-it-pro-blog/the-evolution-of-windows-authentication/ba-p/3926848). On my side it works by using the following parameters in acme_srv.cg I unfortunately cannot help with the winacme issue as my knowledge there is rather limited. But if you drill-down the issue again to a2c let me know. I am happy to help.. /G. |
Beta Was this translation helpful? Give feedback.
-
|
Thank you again for the information, seriously so much appreciated!We’ll move forward with WCCE handler; will look into Kerberos over NTLM too.Briefly, could you explain the fields for “target_domain” and “domain_controller?” My understanding is that they’re both related to the “host” field (if not the same value) but I may be mistaken; would they be IPs or specific/entire domain names rather than just an alias? Please let me know — thank you!GarrettOn Mar 24, 2024, at 11:23 AM, grindsa ***@***.***> wrote:Hi,
happy to hear that you overcame the issue. I would always prefer the usage of the wcce_handler with Kerberos activated due to [the announcement from Microsoft to retire NTLM] (https://techcommunity.microsoft.com/t5/windows-it-pro-blog/the-evolution-of-windows-authentication/ba-p/3926848).
On my side it works by using the following parameters in acme_srv.cg
handler_file: /var/www/acme2certifier/examples/ca_handler/mswcce_ca_handler.py
host: <WCCE_FQDN>
user: <WCCE_USER>
password: <WCCE_PASSWORD>
template: <WCCE_TEMPLATE>
ca_name: <WCCE_CA_NAME>
target_domain: <ADS_DOMAIN>
domain_controller: <DC_IP>
ca_bundle: <BUNDLE>
use_kerberos: True
I unfortunately cannot help with the winacme issue as my knowledge there is rather limited. But if you drill-down the issue again to a2c let me know. I am happy to help..
/G.
—Reply to this email directly, view it on GitHub, or unsubscribe.You are receiving this because you authored the thread.Message ID: ***@***.***>
|
Beta Was this translation helpful? Give feedback.
-
|
Thank you again for the information, seriously so much appreciated!We’ll move forward with WCCE handler; will look into Kerberos over NTLM too.Briefly, could you explain the fields for “target_domain” and “domain_controller?” My understanding is that they’re both related to the “host” field (if not the same value) but I may be mistaken; would they be IPs or specific/entire domain names rather than just an alias? Please let me know — thank you!GarrettOn Mar 24, 2024, at 11:23 AM, grindsa ***@***.***> wrote:Hi,
happy to hear that you overcame the issue. I would always prefer the usage of the wcce_handler with Kerberos activated due to [the announcement from Microsoft to retire NTLM] (https://techcommunity.microsoft.com/t5/windows-it-pro-blog/the-evolution-of-windows-authentication/ba-p/3926848).
On my side it works by using the following parameters in acme_srv.cg
handler_file: /var/www/acme2certifier/examples/ca_handler/mswcce_ca_handler.py
host: <WCCE_FQDN>
user: <WCCE_USER>
password: <WCCE_PASSWORD>
template: <WCCE_TEMPLATE>
ca_name: <WCCE_CA_NAME>
target_domain: <ADS_DOMAIN>
domain_controller: <DC_IP>
ca_bundle: <BUNDLE>
use_kerberos: True
I unfortunately cannot help with the winacme issue as my knowledge there is rather limited. But if you drill-down the issue again to a2c let me know. I am happy to help..
/G.
—Reply to this email directly, view it on GitHub, or unsubscribe.You are receiving this because you authored the thread.Message ID: ***@***.***>
|
Beta Was this translation helpful? Give feedback.
-
Hello,
I've made substantial progress in connecting win-acme to my internal microsoft CA server that uses ADCS through a2c's mscertsrv handler. Right now, I'm just trying to create a new certificate for an IIS site on my network via win-acme so that it can set up a renewal. win-acme is on Windows and a2c is on a linux machine.
I'm encountering an error in the
CAhandler.enroll(<template>)method, specifically when it calls theself._pkcs7_to_pem(ca_pkcs7)method; below are a2c logs pertaining to this.From a2c logs, it appears that a challenge validation is being passed/working properly before the logs are generated (http-01, I believe), that the mscertsrv CA handler is being properly accessed and run/used, and that
CAhandler.__check_credentials()ended withTruehttps://<host>/certsrv/certcarc.asprenewals == 0certsrv/certnew.p7breturns'application/x-pkcs7-certificates'headeracme_srv.cfgI also confirmed that
certsrvis installed within the docker container.Everything seems to run smoothly until the
CAhandler._pkcs7_to_pem()method is called; I believe there's an issue happening where the data is attempting to be read as bytes into cryptography'sload_pem_pkcs7_certificates()method but is being read as a string instead; this wouldn't make sense, though, becauseconvert_string_to_byteis called before this.I saw that in
mscertsrv.md, the md4 algo inopenssl.cfgmust be allowed; my a2c host does not have an/etc/ssl/openssl.cnffile, only/etc/pki/tls/openssl.cnf, and it does not have the lines that the$ sedcommand relies on for text search/replacement.I also confirmed that the internal CA is included in the
ca_bundlefile that the docker container is using, although it's a.crtfile rather than a.pemfile.Any idea what might be going wrong with this, specifically the HTTP requests being made and the data that is supposed to be pulled from them? I was originally worried it was a ca-bundle issue, but it seems to be data parsing related as a result of something unexpected being returned by an API call.
win-acmelogs after"Send POST to http://<host>:22280/acme/order/<order_id>/finalize"are located below the a2c logs I've provided.I'm happy to share more logs or other information about the situation, should it be helpful. Looking forward to resolving this soon -- Thank you!
a2c LOGS
win-acme LOGS
Beta Was this translation helpful? Give feedback.
All reactions