Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

x/crypto/acme: Bad error description if website reject authorization query #32747

Open
rekby opened this issue Jun 24, 2019 · 2 comments
Open

x/crypto/acme: Bad error description if website reject authorization query #32747

rekby opened this issue Jun 24, 2019 · 2 comments
Labels
NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one.
Milestone
Unreleased

Comments

@rekby
Copy link

rekby commented Jun 24, 2019

  1. Website reject authorization from Lets encrypt with 403 error.
  2. Lets encrypt can't authorize domain and return error.
  3. Library error return description ""acme: authorization error for : " in err.Error() after WaitAuthorization <-- PROBLEM

Ideal description in error I see as:
"acme: authorization error for 'domain': website reject authorization error with 403 status"

fmt.Printf("%#v", err)
&acme.AuthorizationError{URI:"https://acme-staging.api.letsencrypt.org/acme/challenge/XXX/YYY", Identifier:"", Errors:[]error(nil)}

curl https://acme-staging.api.letsencrypt.org/acme/challenge/XXX/YYY

{
  "type": "http-01",
  "status": "invalid",
  "error": {
    "type": "urn:acme:error:unauthorized",
    "detail": "Invalid response from http://ZZZ/.well-known/acme-challenge/HfS3oxj9D7WXST1VKtnDMxeLxTvgn62oLWwYWw-SplQ [XXX]: \"\u003c!DOCTYPE HTML PUBLIC \\\"-//IETF//DTD HTML 2.0//EN\\\"\u003e\\n\u003chtml\u003e\u003chead\u003e\\n\u003ctitle\u003e403 Forbidden\u003c/title\u003e\\n\u003c/head\u003e\u003cbody\u003e\\n\u003ch1\u003eForbidden\u003c/h1\u003e\\n\u003cp\"",
    "status": 403
  },
  "uri": "https://acme-staging.api.letsencrypt.org/acme/challenge/XXX/YYY",
  "token": "ASD-ASD",
  "validationRecord": [
    {
      "url": "http://XXX/.well-known/acme-challenge/AAA",
      "hostname": "XXX",
      "port": "80",
      "addressesResolved": [
        "YYY"
      ],
      "addressUsed": "ZZZ"
    }
  ]
}
@gopherbot gopherbot added this to the Unreleased milestone Jun 24, 2019
@x1ddos
Copy link

x1ddos commented Jun 25, 2019

The above JSON is from a single challenge resource. The AuthorizationError is constructed from the whole authorization resource, not a single challenge.

Could you post the failed authorization resource? It should be available somewhere at https://acme-staging.api.letsencrypt.org/acme/authz/xxx.

@rekby
Copy link
Author

rekby commented Jun 25, 2019 

{
  "identifier": {
    "type": "dns",
    "value": "XXX"
  },
  "status": "invalid",
  "expires": "2019-07-02T11:39:09Z",
  "challenges": [
    {
      "type": "dns-01",
      "status": "invalid",
      "uri": "https://acme-staging.api.letsencrypt.org/acme/challenge/XXX/XXX",
      "token": "humF-jopUK1o9DmA-w2v1HhrbyIxTv4YmUp1wVc7rZA"
    },
    {
      "type": "tls-alpn-01",
      "status": "invalid",
      "uri": "https://acme-staging.api.letsencrypt.org/acme/challenge/XXX/XXX",
      "token": "zTTr2H00bDEG4RdIZBWj35MCZhmS7-EDNTASZd-0wWw"
    },
    {
      "type": "http-01",
      "status": "invalid",
      "error": {
        "type": "urn:acme:error:unauthorized",
        "detail": "Invalid response from http://XXX/.well-known/acme-challenge/BNx06A619GgwYep4ZQGSbCcA_Mo0uaPgj1W9asdwh3k [YYY]: \"\u003c!DOCTYPE HTML PUBLIC \\\"-//IETF//DTD HTML 2.0//EN\\\"\u003e\\n\u003chtml\u003e\u003chead\u003e\\n\u003ctitle\u003e403 Forbidden\u003c/title\u003e\\n\u003c/head\u003e\u003cbody\u003e\\n\u003ch1\u003eForbidden\u003c/h1\u003e\\n\u003cp\"",
        "status": 403
      },
      "uri": "https://acme-staging.api.letsencrypt.org/acme/challenge/XXX/XXX",
      "token": "BNx06A619GgwYep4ZQGSbCcA_Mo0uaPgj1W9asdwh3k",
      "validationRecord": [
        {
          "url": "http://XXX/.well-known/acme-challenge/BNx06A619GgwYep4ZQGSbCcA_Mo0uaPgj1W9asdwh3k",
          "hostname": "XXX",
          "port": "80",
          "addressesResolved": [
            "YYY"
          ],
          "addressUsed": "YYY"
        }
      ]
    }
  ],
  "combinations": [
    [
      0
    ],
    [
      1
    ],
    [
      2
    ]
  ]
}

@andybons andybons added the NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one. label Jun 25, 2019
@tumido tumido mentioned this issue May 21, 2021
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one.
Projects
None yet
Milestone
Unreleased
Development

No branches or pull requests
4 participants
@x1ddos @andybons @rekby @gopherbot