Cert Expired, Acmetool Service Failed [invalid IPv6 record in DNS]

Chatmail Relays
,
1

Hello,

My certificate expired and it seems that the failing service acmetool-reconcile is to blame. The redacted output from journalctl is,

error satisfying Target(chat.example.com,mta-sts.chat.example.com,www.chat.example.com;https://acme-v02.api.letsencrypt.org/directory;0): the following errors occurred:
exhausted all possible challenges in authorization "https://acme-v02.api.letsencrypt.org/acme/authz/1234/5678" [due to inner error: the following errors occurred:
could not install DNS challenge, no hooks succeeded;
challenge type not supported];

I checked with cmdeploy dns and the CAA record that it is providing, Namecheap does not think is valid. This is the first time the certificate has attempted to be renewed, so I am not certain if this DNS record is the issue.

Can I use acmetool to manually renew the cert somehow?

Thank you!

2

I tried removing the CAA record I had in my domain settings, but that did not change anything.

I do not see any challenges in /var/www/html/.well-known/acme-challenge so that might line up with the message that it could not install the challenge.

I noticed that /var/www/html was owned by my non-priviledged user, probably an error on my part when I was messing around with adding another site to the same VPS. I’ve changed the owner and group to root with no success unfortunately. Should that be owned by a different user?

Running acmetool --xlog.severity=debug reconcile shows that it was able to create the challenge, but when it failed, it deleted the files afterwards. It seems I’m getting rate limited now too, so will have to try again later.

3

I’ll note that this error: acmetool.solver: unsuccessful challenge: authorization only fails for the IPv6 address. Nothing is mentioned about this challenge with the IPv4 address, so I must assume that it is working for that address?

acmetool is looking to use ports 402 and 4402, as port 80 is already in use, so I’ve opened those in the firewall to no avail.

4

It turns out that my VPS had an IPv6 address assigned to it like 1234:3456:4578:6789::2 and my DNS records were set up like 1234:3456:4578:6789::

Adjusting the record has fixed the issue. :folded_hands:

EDIT: Adding a link here that was quite helpful in figuring this all out: https://letsdebug.net/

5

Similar thread with incorrectly configured IPv6 resulting in failure to get certificates even with IPv4 working: My relay has expired certificate and cmdeploy run fails