auto-ssl / auto-ssl/lua-resty-auto-ssl

Unknown certificate type

Open
#115 4 comments 0 reactions 0 assignees View on GitHub
Dominant language
Lua
Stars
2k
Forks
184
PR merge metrics
No merged PRs in 30d

Description

I'm using Azure virtual machine with only os disk. resty-auto-ssl failed to get the certificate. Checking the following error message for details. I used to run the same set up with Alicloud, everything was OK.

```
lua-resty-auto-ssl
0.12.0-1 (installed) - /usr/lib64/luarocks/rocks
```

```
2018/02/24 10:57:31 [error] 1565#1565: *68 [lua] lets_encrypt.lua:41: issue_cert(): auto-ssl: dehydrated failed: env HOOK_SECRET=4d32f6f51deece2cf538251a59fa91eaa7b737db188cdfe293f8677ab2738803 HOOK_SERVER_PORT=8999 /usr/bin/resty-auto-ssl/dehydrated --cron --accept-terms --no-lock --domain liucai.kosun.rocks --challenge http-01 --config /etc/resty-auto-ssl/letsencrypt/config --hook /usr/bin/resty-auto-ssl/letsencrypt_hooks status: 256 out: # INFO: Using main config file /etc/resty-auto-ssl/letsencrypt/config
+ Generating account key...
+ Registering account key with ACME server...
Processing liucai.kosun.rocks
+ Signing domains...
+ Creating new directory /etc/resty-auto-ssl/letsencrypt/certs/liucai.kosun.rocks ...
+ Creating chain cache directory /etc/resty-auto-ssl/letsencrypt/chains
+ Generating private key...
+ Generating signing request...
+ Requesting authorization for liucai.kosun.rocks...
+ 1 pending challenge(s)
+ Deploying challenge tokens...
+ Responding to challenge for liucai.kosun.rocks authorization...
+ Challenge is valid!
+ Requesting certificate...
+ Checking certificate...
+ Done!
+ Creating fullchain.pem...
+ Walking chain...
err: ERROR: Unknown certificate type in chain
ERROR: Walking chain has failed, your certificate has been created and can be found at /etc/resty-auto-ssl/letsencrypt/certs/liucai.kosun.rocks/cert-1519441040.pem, the corresponding private key at privkey-1519441040.pem. If you want you can manually continue on creating and linking all necessary files. If this error occurs again you should manually generate the certificate chain and place it under /etc/resty-auto-ssl/letsencrypt/chains/4f06f81d.chain (see http://cert.int-x3.letsencrypt.org/)
, context: ssl_certificate_by_lua*, client: 202.131.84.133, server: 0.0.0.0:443
2018/02/24 10:57:31 [error] 1565#1565: *68 [lua] ssl_certificate.lua:97: issue_cert(): auto-ssl: issuing new certificate failed: dehydrated failure, context: ssl_certificate_by_lua*, client: 202.131.84.133, server: 0.0.0.0:443
2018/02/24 10:57:31 [error] 1565#1565: *68 [lua] ssl_certificate.lua:286: auto-ssl: could not get certificate for liucai.kosun.rocks - using fallback - failed to get or issue certificate, context: ssl_certificate_by_lua*, client: 202.131.84.133, server: 0.0.0.0:443
```

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with the logged flow through lets_encrypt.lua:41 and ssl_certificate.lua:97, then inspect the dehydrated output for the chain-walking failure under the shown /etc/resty-auto-ssl/letsencrypt paths. Compare certificate issuance on the Azure setup with the working Alicloud setup. Done means the certificate chain is handled without the “Unknown certificate type” error and issuance no longer falls back.

Written by the indexing model from the issue text.

Assessment

Tech stack
lua, nginx
Domain
security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.