Solved Lets Encrypt SSL certificate Renewed FAIL

[Richard Apthorp]

Hi,

Let's enrypt renewal is failing with the following error:

Lets Encrypt SSL certificate was failed to renew. Error:
PostInstall.LetsEncrypt.LetsEncryptRegistrationException: Network error
at PostInstall.CertificateHelper.ProcessCertificatesDirectory(String directory, CloudServerStatus statuses, String appBin)
at PostInstall.CertificateHelper.RenewCertificates(String appBin, String nginxConfigFolder, String configurationPath)​

I assume this is a problem with my firewall configuration, we restrict communication both ways and have allowed communication with *.letsencrypt.org on ports 80 and 443. Is anything else needed, some posts on letsencrypt.org were suggesting direct dns communication?

Is there a way to force the certificate renewal now so we can monitor the firewall for dropped packets etc.?

Thanks, Richard.

 

[dab]

Let's encrypt use:

acme-v01.api.letsencrypt.org

You need double wildcard or just use the hostname above

 

[Richard Apthorp]

Thanks for the suggestion but the firewall allows anything with a * so pointing my web browser to the url above works.

 

[YiannisH_3CX]

Do you also allow communication to activation.3cx.com? If not please do as this is required for licence and maintenance checks.

 

[Richard Apthorp]

Hi,
I have now added as per your suggestion so I have the following domains allowed:

erp.3cx.com
downloads.3cx.com
activation.3cx.com
*.letsencrypt.org

This definitely helped as I am now getting a different error:

Lets Encrypt SSL certificate was failed to renew. Error: System.AggregateException: One or more errors occurred. ---> PostInstall.LetsEncrypt.LetsEncryptRegistrationException: Lets Encrypt authorization status 'invalid'. Authorization not completed.   type : urn:acme:error:connection;  detail : DNS problem: NXDOMAIN looking up TXT for _acme-challenge.#########.3cx.co.uk;  status : 400

   at PostInstall.LetsEncrypt.LetsEncryptClient.<CompleteCertificateGeneration>d__13.MoveNext()

   --- End of inner exception stack trace ---

   at System.Threading.Tasks.Task`1.GetResultCore(Boolean waitCompletionNotification)

   at PostInstall.LetsEncrypt.LetsEncryptClient.RegenerateCertificate(CertificateGenerationData certGenerationData, String keyFilePath, String csrFilePath, String domainName)

   at PostInstall.CertificateHelper.ProcessCertificatesDirectory(String directory, CloudServerStatus statuses, String appBin)

   at PostInstall.CertificateHelper.RenewCertificates(String appBin, String nginxConfigFolder, String configurationPath)

---> (Inner Exception #0) PostInstall.LetsEncrypt.LetsEncryptRegistrationException: Lets Encrypt authorization status 'invalid'. Authorization not completed.   type : urn:acme:error:connection;  detail : DNS problem: NXDOMAIN looking up TXT for _acme-challenge.#########.3cx.co.uk;  status : 400

   at PostInstall.LetsEncrypt.LetsEncryptClient.<CompleteCertificateGeneration>d__13.MoveNext()<---

Thanks, Richard.

 

[YiannisH_3CX]

Try settings the DNS of the PBX to google DNS if possible (8.8.8.8) then flushdns and restart all PBX services including the nginx service.
And wait for it to try again

 

[Richard Apthorp]

Changing the DNS is problematic as the firewall looks for our internal DNS servers making requests to valid firewall rules with wildcards.

The PBX tried again last night and was successful.

 

[YiannisH_3CX]

Glad to hear the certificate is now renewed and the issue is resolved. Did you make any changes to make this work?
If yes please share as it will help someone else down the line

 

[Richard Apthorp]

No adding the friewall rule for activation.3cx.com ports 80 and 443 as per your suggestion was the only change I made.
Thanks for your help.