docker and ACME clients

[avance-ed]

Assistance please:

step-ca running in docker container. Works fine with sample https server on 8443
health check on https://IP:9000/health connects and displays properly.

Trying to get ACME working. Am I missing something?

In the container, I run:
% step ca provisioner add acme --type ACME

In the host run:
% sudo /home/user/acme.sh/acme.sh --standalone --issue -d foo.com --server https://IP:9000/acme/acme/directory -w /tmp/foo

output is:
[Fri 25 Feb 2022 09:40:14 AM CST] Using CA: https://IP:9000/acme/acme/directory
[Fri 25 Feb 2022 09:40:14 AM CST] Standalone mode.
[Fri 25 Feb 2022 09:40:14 AM CST] Single domain='foo.com'
[Fri 25 Feb 2022 09:40:14 AM CST] Getting domain auth token for each domain
[Fri 25 Feb 2022 09:40:14 AM CST] Getting webroot for domain='foo.com'
[Fri 25 Feb 2022 09:40:14 AM CST] Verifying: foo.com
[Fri 25 Feb 2022 09:40:14 AM CST] Standalone mode server
[Fri 25 Feb 2022 09:40:19 AM CST] Pending, The CA is processing your order, please just wait. (1/30)
[Fri 25 Feb 2022 09:40:24 AM CST] Pending, The CA is processing your order, please just wait. (2/30)
[Fri 25 Feb 2022 09:40:29 AM CST] Pending, The CA is processing your order, please just wait. (3/30)
[Fri 25 Feb 2022 09:40:34 AM CST] Pending, The CA is processing your order, please just wait. (4/30)
[Fri 25 Feb 2022 09:40:40 AM CST] Pending, The CA is processing your order, please just wait. (5/30)
[...]
[Fri 25 Feb 2022 09:42:39 AM CST] Pending, The CA is processing your order, please just wait. (28/30)
[Fri 25 Feb 2022 09:42:44 AM CST] Pending, The CA is processing your order, please just wait. (29/30)
[Fri 25 Feb 2022 09:42:49 AM CST] foo.com:Timeout
[Fri 25 Feb 2022 09:42:49 AM CST] Please add '--debug' or '--log' to check more details.
[Fri 25 Feb 2022 09:42:49 AM CST] See: https://github.com/acmesh-official/acme.sh/wiki/How-to-debug-acme.sh

Thanks!

[tashian]

@avance-ed In order to validate the ACME http-01 challenge, the CA container will need to be able to resolve and reach the ACME client on port 80. You'll have to adjust your Docker networking settings to make that possible.

[avance-ed]

Thanks. Closer, but now a different issue:

(1) I stopped apache on the host, stopped and restarted the docker container, exposing port 80 (with nothing there on the host)
docker run -d -p 9000:9000 -p 80:80 -v step:/home/step smallstep/step-ca

(2) acme.sh --standalone --issue -d foo.com --server https://IP:9000/acme/acme/directory -w /tmp/foo

(tried both localhost and the IP address, same result)

[Mon 28 Feb 2022 09:49:34 AM CST] Using CA: https://localhost:9000/acme/acme/directory
[Mon 28 Feb 2022 09:49:34 AM CST] Standalone mode.
[Mon 28 Feb 2022 09:49:34 AM CST] LISTEN 0 4096 0.0.0.0:80 0.0.0.0:*
LISTEN 0 4096 [::]:80 [::]:*
[Mon 28 Feb 2022 09:49:34 AM CST] tcp port 80 is already used by
80 [
[Mon 28 Feb 2022 09:49:34 AM CST] Please stop it first
[Mon 28 Feb 2022 09:49:34 AM CST] _on_before_issue.

Thx.

[tashian]

You may need to use a different style of container networking. Port 80 on the CA doesn't need to be exposed, but the CA needs to be able to make an outbound request to the client on port 80. So, the issue is usually either DNS, or network reachability of the client from the CA. Hope this helps.

[pcornelissen]

But the step-cli has a way to provide a different listener-address, where you can provide a port != 80. I was not able to find in the documentation, how it s able to convey the different callback port to the step-ca server fot the acme provisioner.