Issue with Let's Encrypt on a subdomain | Discord Gophers | Page 1

elfin tree Nov 10, 2023, 1:11 AM

#

no need to get a cert for the root, just the leaf domain

#

it’s hard to know what postman means by that, i’m not familiar with its errors. perhaps another client (e.g. a browser, or a Go TLS client) may be more informative?

vapid fable Nov 10, 2023, 5:05 AM

#

on the browser is fine. Only Curl and Postman having issue with the cert

elfin tree Nov 10, 2023, 12:57 PM

#

what does curl say? (and just to be clear, you’re using public CAs, not your own root, right?)

vapid fable Nov 11, 2023, 4:57 AM

#

elfin tree what does curl say? (and just to be clear, you’re using public CAs, not your own...

what do you mean by public CAs and not my own root?
All i do is to run certbot commands to register a cert for my domain in the ec2 terminal.

elfin tree Nov 11, 2023, 11:49 AM

#

ok, then the answer is yes 😁

#

again, what does curl say? and could you provide your code for setting up the TLS config on the server side?

vapid fable Nov 12, 2023, 12:48 AM

#

the curl giving me this

* ALPN, offering h2
* ALPN, offering http/1.1
*  CAfile: /etc/ssl/certs/ca-certificates.crt
*  CApath: /etc/ssl/certs
* TLSv1.0 (OUT), TLS header, Certificate Status (22):
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.2 (IN), TLS header, Certificate Status (22):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS header, Finished (20):
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (OUT), TLS header, Unknown (21):
* TLSv1.3 (OUT), TLS alert, unknown CA (560):
* SSL certificate problem: unable to get local issuer certificate
* Closing connection 0
curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: https://curl.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.

#

oh the browser i can access it without any issue. status code 200 and the data is displayed

#

sudo snap install --classic certbot
sudo ln -s /snap/bin/certbot /usr/bin/certbot
sudo certbot certonly --standalone

#

ListenAndServeTLS("/etc/letsencrypt/live/sub.domain.com/cert.pem", "/etc/letsencrypt/live/sub.domain.com/privkey.pem")

vapid fable Nov 12, 2023, 2:10 AM

#

vapid fable `ListenAndServeTLS("/etc/letsencrypt/live/sub.domain.com/cert.pem", "/etc/letsen...

even I change the cert.pem with fullchain.pem still is the same

vapid fable Nov 12, 2023, 3:06 AM

#

@elfin tree I have tried different setting too

server := &http.Server{
        Addr: ":https", // ":443" also tried
        TLSConfig: &tls.Config{
            MinVersion:               tls.VersionTLS12,
            PreferServerCipherSuites: true,
            GetCertificate: func(info *tls.ClientHelloInfo) (*tls.Certificate, error) {
                return loadTLSCertificate(fullChainFile, privKeyFile)
            },
        },
    }
func loadTLSCertificate(fullChainFile, privKeyFile string) (*tls.Certificate, error) {
    fullChain, err := tls.LoadX509KeyPair(fullChainFile, privKeyFile)
    if err != nil {
        return nil, err
    }

    return &fullChain, nil
}

elfin tree Nov 12, 2023, 3:13 AM

#

i’m not too familiar with how certbot outputs its information, and that appears to be the crux of the issue here. if you open the full chain file, how many BEGIN CERTIFICATEs do you see?

#

it should be three. if you see two, it’s probably not including the root for some reason (but including the intermediate). if you only see one, it’s only outputting the leaf cert.

#

if you don’t need these certs for other programs, i’d suggest just using the autocert library. you just pass it a domain name and LE credentials and it takes care of the certs for you in the background (including renewals) for any number of domains, no commands or worrying about keeping services alive necessary.

vapid fable Nov 12, 2023, 3:30 AM

#

there is 2 BEGIN CERTIFICATE s

#

@elfin tree Ok , so you mean with the autocert package, we don't need to setup certbot on the host?

sudo snap install --classic certbot
sudo ln -s /snap/bin/certbot /usr/bin/certbot
sudo certbot certonly --standalone

elfin tree Nov 12, 2023, 3:43 AM

#

correct

#

it’s all handled within the go program (though it does cache the certificates on disk so it survives a program restart)

vapid fable Nov 12, 2023, 3:50 AM

#

i've tried but apparently now the curl cannot get any response

* ALPN, offering h2
* ALPN, offering http/1.1
*  CAfile: /etc/ssl/certs/ca-certificates.crt
*  CApath: /etc/ssl/certs
* TLSv1.0 (OUT), TLS header, Certificate Status (22):
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.2 (IN), TLS header, Unknown (21):
* TLSv1.3 (IN), TLS alert, internal error (592):
* error:0A000438:SSL routines::tlsv1 alert internal error
* Closing connection 0
curl: (35) error:0A000438:SSL routines::tlsv1 alert internal error

#

checked my cert directory and read the acme_account+key value. apparently is pretty short. supposed to be this short?

-----BEGIN EC PRIVATE KEY-----
1
2
3 lines
-----END EC PRIVATE KEY-----

#

so my golang code basicallyis

 m := &autocert.Manager{ 
     Cache:      autocert.DirCache("secret-dir"),
     Prompt:     autocert.AcceptTOS,
     HostPolicy: autocert.HostWhitelist(subDomain),
 }
 s.HttpServer.Addr = ":443"
 s.HttpServer.TLSConfig = m.TLSConfig()

 log.Fatal(s.HttpServer.ListenAndServeTLS("", ""))

vapid fable Nov 12, 2023, 8:24 AM

#

@elfin tree

vapid fable Nov 12, 2023, 8:41 AM

#

one more thing, the golang program is running on docker compose.

west chasm Nov 12, 2023, 11:10 AM

#

vapid fable checked my cert directory and read the `acme_account+key` value. apparently is p...

Elliptic curve keys are surprisingly short. So it looks correct.

#

Are you getting any log output on the server side when it starts up and/or when a client makes a request?

vapid fable Nov 12, 2023, 1:00 PM

#

west chasm Are you getting any log output on the server side when it starts up and/or when ...

Nothing. Seems to be okay on the server program

elfin tree Nov 12, 2023, 2:35 PM

#

it seems pretty likely at this point that you’re doing something funky with your deployment external to your program, but it’s really hard for us to tell without more knowledge and the domain obfuscation. i understand the motivation for that but in doing so it may be covering up the actual issue

#

originally, it seemed that your server wasn’t returning the root certificate in the chain. browsers may be fine with that being elided and look it up in their store, but other programs may not.

#

i’m not so sure now.

#

you may be able to get more verbose logging on what specifically the clients don’t like with openssl s_client.

#

or a simple go program that does a TLS dial. i think its errors are typically pretty descriptive.

vapid fable Nov 13, 2023, 2:31 AM

#

It's funny, when I changed the cert.pam to fullchain.pam it worked and all the errors from CURL & Postman were gone.

But now I cannot connect to my Postgres that is running on the same EC2 and the error is Connection attempt timed out.

vapid fable Nov 13, 2023, 3:05 AM

#

btw, i am using DBeaver and this is the url to connect jdbc:postgresql://sub.domain.com:Port/db_name

#Issue with Let's Encrypt on a subdomain