Renewal fails, but new cert issues ok #9

syndic-will commented 2023年06月20日 21:55:53 +02:00

With another app where I use this library besides Guppe, https://github.com/immers-space/immers, we recently found all of the different deploys in a project unable to renew.

Similar to #6 (comment), the logs would show

| 🔒 ❨auto-encrypt❩ HTTP server is now only responding to Let’s Encrypt challenges.
| ⚠ ❨auto-encrypt❩ Received non-ACME HTTP request for /, not responding.

and then it would stay in ACME mode forever, occasionally logging out more of those "non-ACME HTTP request" warnings as stray requests came in.

One thing both projects have in common is a recent change to be moved behind a non-tls-terminating load balancer, but one was docker swarm while the other is Amazon NLB.

Interestingly, for this case we were able to resume service for now by deleting the stored certs and restarting the server, triggering a fresh cert request which completed without issue.

We're also a little behind on version, using auto-encrypt 3.1.0, because we're still on node 16.

With another app where I use this library besides Guppe, https://github.com/immers-space/immers, we recently found all of the different deploys in a project unable to renew. Similar to https://codeberg.org/small-tech/auto-encrypt/issues/6#issuecomment-771989, the logs would show ``` | 🔒 ❨auto-encrypt❩ HTTP server is now only responding to Let’s Encrypt challenges. | ⚠ ❨auto-encrypt❩ Received non-ACME HTTP request for /, not responding. ``` and then it would stay in ACME mode forever, occasionally logging out more of those "non-ACME HTTP request" warnings as stray requests came in. One thing both projects have in common is a recent change to be moved behind a non-tls-terminating load balancer, but one was docker swarm while the other is Amazon NLB. Interestingly, for this case we were able to resume service for now by deleting the stored certs and restarting the server, triggering a fresh cert request which completed without issue. We're also a little behind on version, using auto-encrypt 3.1.0, because we're still on node 16.

aral commented 2023年07月04日 14:31:24 +02:00

@syndic-will Appreciate the issue and sorry for the slow response.

It’s very possible that the load balancer is the issue. That’s where I’d look. By its very nature, Small Tech stuff isn’t tested for that use case so I’m afraid I can’t be of too much help there :)

Version 3.1.0 should not be the cause of the issue as it meets the latest requirements from the Let’s Encrypt side of things.

Closing this issue as load balancing is not a supported feature but if you do figure it out, please feel free to update the issue with what you find. (Or, if it turns out not to be related to the load balancer, please also feel free to reopen it.)

@syndic-will Appreciate the issue and sorry for the slow response. It’s very possible that the load balancer is the issue. That’s where I’d look. By its very nature, Small Tech stuff isn’t tested for that use case so I’m afraid I can’t be of too much help there :) Version 3.1.0 should not be the cause of the issue as it meets the latest requirements from the Let’s Encrypt side of things. Closing this issue as load balancing is not a supported feature but if you do figure it out, please feel free to update the issue with what you find. (Or, if it turns out not to be related to the load balancer, please also feel free to reopen it.)