九零不老心
发布于 2024-09-25 / 123 阅读 / 0 评论 / 0 点赞

caddy自动续签证书异常

记录一次caddy自动续签证书异常的情况

报错日志:

{"level":"error","ts":1727245917.1525042,"logger":"tls.issuance.acme.acme_client","msg":"validating authorization","identifier":"example.com","problem":{"type":"urn:ietf:params:acme:error:connection","title":"","detail":"1.1.1.1: Connection reset by peer","instance":"","subproblems":[]},"order":"https://acme-staging-v02.api.letsencrypt.org/acme/order/144255834/19366061543","attempt":1,"max_attempts":3}
{"level":"info","ts":1727245918.7341564,"logger":"tls.issuance.acme.acme_client","msg":"trying to solve challenge","identifier":"example.com","challenge_type":"http-01","ca":"https://acme-staging-v02.api.letsencrypt.org/directory"}
{"level":"error","ts":1727245929.0918722,"logger":"tls.issuance.acme.acme_client","msg":"challenge failed","identifier":"example.com","challenge_type":"http-01","problem":{"type":"urn:ietf:params:acme:error:connection","title":"","detail":"1.1.1.1: Fetching http://example.com/.well-known/acme-challenge/Vr3s69MDx7yZ0h5Fdl2HRte4iCItmHJ_u7LDf9GxKwI: Timeout during connect (likely firewall problem)","instance":"","subproblems":[]}}
{"level":"error","ts":1727245929.091915,"logger":"tls.issuance.acme.acme_client","msg":"validating authorization","identifier":"example.com","problem":{"type":"urn:ietf:params:acme:error:connection","title":"","detail":"1.1.1.1: Fetching http://example.com/.well-known/acme-challenge/Vr3s69MDx7yZ0h5Fdl2HRte4iCItmHJ_u7LDf9GxKwI: Timeout during connect (likely firewall problem)","instance":"","subproblems":[]},"order":"https://acme-staging-v02.api.letsencrypt.org/acme/order/144255834/19366062033","attempt":2,"max_attempts":3}
{"level":"error","ts":1727245930.951832,"logger":"tls.obtain","msg":"could not get certificate from issuer","identifier":"example.com","issuer":"acme-v02.api.letsencrypt.org-directory","error":"[example.com] solving challenges: example.com: no solvers available for remaining challenges (configured=[http-01 tls-alpn-01] offered=[http-01 tls-alpn-01 dns-01] remaining=[dns-01]) (order=https://acme-staging-v02.api.letsencrypt.org/acme/order/144255834/19366065083) (ca=https://acme-staging-v02.api.letsencrypt.org/directory)"}
{"level":"warn","ts":1727245930.9523506,"logger":"tls.issuance.zerossl","msg":"missing email address for ZeroSSL; it is strongly recommended to set one for next time"}
{"level":"error","ts":1727245932.5499218,"logger":"tls.obtain","msg":"could not get certificate from issuer","identifier":"example.com","issuer":"acme.zerossl.com-v2-DV90","error":"account pre-registration callback: failed getting EAB credentials: HTTP 422: caddy_legacy_user_removed (code 2977)"}
{"level":"error","ts":1727245932.549952,"logger":"tls.obtain","msg":"will retry","error":"[example.com] Obtain: account pre-registration callback: failed getting EAB credentials: HTTP 422: caddy_legacy_user_removed (code 2977)","attempt":7,"retrying_in":1200,"elapsed":2550.167961103,"max_duration":2592000}

解决办法:

caddy启动以后默认监听http 80和https 443端口,开放cvm的网络防火墙,允许外部访问80和443端口,问题解决

当然还有国内域名没有进行备案,或者已备案服务商服务器过期,而新的服务商接入备案未完成, www域名可能会被拦截,caady也无法自动续期成功。