Alternate port for http challenges

[mexoboy]

Hi. I have some question about option --http.port. I want to generate cert using http challange, but default port already taken. I thought I can solve my problem using lego with arguments:

lego -a -m [email protected] --http --http.port :8080 --path /opt/lego -d domain.com run

I realy thought that lego create standalone server and will bind to 0.0.0.0:8080 for pass letsencrypt challanges, but in fact challange was failed. I try do that on new server and it's seem's like the --http.port doesn't work. My challanges didn't pass. But if I not use the --http.port option, challanges pass well.

[ldez]

hi,

--http.port works as expected: starts an HTTP server on the specified port.

Can you provide some logs?

[mexoboy]

@ldez Thanks for reply. Ok - just create new machine on hetzner:

1. Install nginx with default config (for be sure 80 port was allocated)
2. Create A record for domain in cloudflare
3. Download latest lego client 4.7.0
4. Run command
5. Got error :(

Here is full log

root@ubuntu-2gb-hel1-3:/opt/lego# ./lego -a -m [email protected] --http --http.port :8080 --path /opt/lego -d test.bulenkov.dev run
2022/06/29 20:40:03 No key found for account [email protected]. Generating a P256 key.
2022/06/29 20:40:03 Saved key to /opt/lego/accounts/acme-v02.api.letsencrypt.org/[email protected]/keys/[email protected]
2022/06/29 20:40:04 [INFO] acme: Registering account for [email protected]
!!!! HEADS UP !!!!

Your account credentials have been saved in your Let's Encrypt
configuration directory at "/opt/lego/accounts".

You should make a secure backup of this folder now. This
configuration directory will also contain certificates and
private keys obtained from Let's Encrypt so making regular
backups of this folder is ideal.
2022/06/29 20:40:04 [INFO] [test.bulenkov.dev] acme: Obtaining bundled SAN certificate
2022/06/29 20:40:05 [INFO] [test.bulenkov.dev] AuthURL: https://acme-v02.api.letsencrypt.org/acme/authz-v3/125180032326
2022/06/29 20:40:05 [INFO] [test.bulenkov.dev] acme: Could not find solver for: tls-alpn-01
2022/06/29 20:40:05 [INFO] [test.bulenkov.dev] acme: use http-01 solver
2022/06/29 20:40:05 [INFO] [test.bulenkov.dev] acme: Trying to solve HTTP-01
2022/06/29 20:40:08 [INFO] Deactivating auth: https://acme-v02.api.letsencrypt.org/acme/authz-v3/125180032326
2022/06/29 20:40:08 Could not obtain certificates:
	error: one or more domains had a problem:
[test.bulenkov.dev] acme: error: 403 :: urn:ietf:params:acme:error:unauthorized :: 95.216.217.254: Invalid response from http://test.bulenkov.dev/.well-known/acme-challenge/s2_7MXWuXpIw2SbzvwMQxMtAc0K0Nos-T74uJGBaWP0: 404

[ldez]

The HTTP is done on the port 80 (it's an ACME constraint) as you can see in the error log (http://test.bulenkov.dev/.well-known/acme-challenge/s2_7MXWuXpIw2SbzvwMQxMtAc0K0Nos-T74uJGBaWP0 no port = port 80).

[mexoboy]

@ldez Yes, I see. But I pass port 8080 and expect challenge will be come on this port

[ldez]

The challenge will never come on 8080 because Let's Encrypt always checks on port 80 (it's not an option, it's a constraint)

https://letsencrypt.org/docs/challenge-types/

The HTTP-01 challenge can only be done on port 80.

when you set a different port you must have something that redirects port 80 to port 8080.

[mexoboy]

@ldez Ok, thanks for explain.