Can't create Let's Encrypt SSL Certificate

[HydrelioxGitHub]

Problem/Motivation

Can't add SSL Certificates with Let's Encrypt

Expected behavior

Can use Let's Encrypt SSL with my nginx hosts

Actual behavior

When I try to add a new SSL Certificate using webui. I've just a popup with "Internal Error"

This is my log

 [5/11/2019] [11:28:56 PM] [SSL      ] › ℹ  info      Requesting Let'sEncrypt certificates for Cert #10: xxx.duckdns.org

[5/11/2019]` [11:29:08 PM] [Nginx    ] › ℹ  info      Reloading Nginx

[5/11/2019] [11:29:08 PM] [Express  ] › ⚠  warning   Command failed: /usr/bin/certbot certonly --cert-name "npm-10" --agree-tos --email "xxx@gmail.com" --preferred-challenges "http" -n -a webroot -d "xxx.duckdns.org" 

Saving debug log to /data/logs/letsencrypt/letsencrypt.log

Plugins selected: Authenticator webroot, Installer None

Obtaining a new certificate

Performing the following challenges:

http-01 challenge for xxx.duckdns.org

Using the webroot path /data/letsencrypt-acme-challenge for all unmatched domains.

Waiting for verification...

Cleaning up challenges

Failed authorization procedure. xxx.duckdns.org (http-01): urn:ietf:params:acme:error:connection :: The server could not connect to the client to verify the domain :: Fetching http://xxx.duckdns.org/.well-known/acme-challenge/xxx: Connection refused

Steps to reproduce

Just try to add a new SSL Certificate via webui

I've tried to use the duckdns hassio addon with Let's Encrypt and I can successfully access to HA using https without any problem.

Proposed changes

I have no idea on how to fix this ? Is my setup broken ? Is this an addon problem ?

[addons-assistant]

👋 Thanks for opening your first issue here! If you're reporting a 🐛 bug, please make sure you include steps to reproduce it. Also, logs, error messages and information about your hardware might be usefull.

[tjorim]

Have you forwarded port 80 -> 80 and 443 -> 443? The Duck DNS add-on doesn't need that because it's based on dns check.

[HydrelioxGitHub]

Yes 80 443 and 8123 are forwarded to the raspberry with HA.

[BlueBlueBlob]

You don't have to forward 8123. Only 80 and 443.

[osmartjr]

same problem here

[HydrelioxGitHub]

You don't have to forward 8123. Only 80 and 443.

I've forwarded this port to see if it changes something... but nothing more.

[HydrelioxGitHub]

Any news on this issue ? I've seen an update for the addon but the issue is still here.

[DrKuba]

same problem here.
[5/21/2019] [2:56:33 PM] [Nginx ] › ℹ info Reloading Nginx
[5/21/2019] [2:57:11 PM] [Nginx ] › ℹ info Reloading Nginx
[5/21/2019] [2:57:30 PM] [Nginx ] › ℹ info Reloading Nginx
[5/21/2019] [2:57:30 PM] [SSL ] › ℹ info Requesting Let'sEncrypt certificates for Cert #8: XXXXXXXX.duckdns.org:8123
[5/21/2019] [2:57:44 PM] [Nginx ] › ℹ info Reloading Nginx
[5/21/2019] [2:57:44 PM] [Express ] › ⚠ warning Command failed: /usr/bin/certbot certonly --cert-name "npm-8" --agree-tos --email "xxxxxxxxx@outlook.com" --preferred-challenges "dns,http" -n -a webroot -d "xxxxxxxx.duckdns.org:8123"
Saving debug log to /data/logs/letsencrypt/letsencrypt.log
Plugins selected: Authenticator webroot, Installer None

[frenck]

In all the above, I only see misconfigured port forwardings. Please note, if you had it misconfigured and tried multiple times, Let's Encrypt will ban you for an hour (unless you keep trying it will be longer).

None of the logs indicate anything wrong with the add-on, nor have I been able to reproduce an issue with it.

[DrKuba]

OK, so forward external port 80 and 443 for my local 8123 (hassio port) ?
Thank you!

[frenck]

No, forward port 80 to port 80, port 443 to 443.

[pmillsap]

Has anyone figured this out. I have forwarded port 80 to port 80 and port 443 to 443. Nothing else is forwarded. I added a proxy host with scheme:http, forward host: homeassistant, forward port:8123 and websockets support checked. When request a new certificate I get the error shown in the first post. I would like to get this working because it looks a lot better than the official addon, but I cannot see what I am doing wrong.

[5/22/2019] [4:46:42 PM] [Nginx ] › ℹ info Reloading Nginx
[5/22/2019] [4:52:33 PM] [Nginx ] › ℹ info Reloading Nginx
[5/22/2019] [4:53:06 PM] [Nginx ] › ℹ info Reloading Nginx
[5/22/2019] [4:53:06 PM] [SSL ] › ℹ info Requesting Let'sEncrypt certificates for Cert #13: stringpicker.duckdns.org
[5/22/2019] [4:53:29 PM] [Nginx ] › ℹ info Reloading Nginx
[5/22/2019] [4:53:29 PM] [Express ] › ⚠ warning Command failed: /usr/bin/certbot certonly --cert-name "npm-13" --agree-tos --email "xxxxxxxxxr@cox.net" --preferred-challenges "dns,http" -n -a webroot -d "xxxxxxxx.duckdns.org"
Saving debug log to /data/logs/letsencrypt/letsencrypt.log
Plugins selected: Authenticator webroot, Installer None
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for xxxxxxxxxxx.duckdns.org
Using the webroot path /data/letsencrypt-acme-challenge for all unmatched domains.
Waiting for verification...
Cleaning up challenges
Failed authorization procedure. xxxxxxx.duckdns.org (http-01): urn:ietf:params:acme:error:connection :: The server could not connect to the client to verify the domain :: Fetching http://xxxxxxx.duckdns.org/.well-known/acme-challenge/RhvqtC8FNzz2woZvtBBxRjDOz5USKFEfAch9s3y9qRo: Timeout during connect (likely firewall problem)
[5/22/2019] [4:54:00 PM] [Nginx ] › ℹ info Reloading Nginx

[HydrelioxGitHub]

Maybe it's hardware related ? Everyone having this problem, what kind of router do you use ?

[nickneos]

I had this issue. Turns out my internet service provider blocks inbound ports 80 and 443 by default. I had to call up to request they unblock those ports. All good now.

[Sjeff]

Receiving the same error with the hass.io addon.
When running separated containers instead of the addon i have no issue's.

[7/28/2019] [9:48:14 AM] [Express  ] › ⚠  warning   Command failed: /usr/bin/certbot certonly --cert-name "npm-1" --agree-tos --email "xxxx@gmail.com" --preferred-challenges "dns,http" -n -a webroot -d "domainname" 
Saving debug log to /data/logs/letsencrypt/letsencrypt.log
Plugins selected: Authenticator webroot, Installer None
An unexpected error occurred:
Traceback (most recent call last):
  File "/usr/lib/python3.6/site-packages/urllib3/connection.py", line 141, in _new_conn
    (self.host, self.port), self.timeout, **extra_kw)
  File "/usr/lib/python3.6/site-packages/urllib3/util/connection.py", line 60, in create_connection
    for res in socket.getaddrinfo(host, port, family, socket.SOCK_STREAM):
  File "/usr/lib/python3.6/socket.py", line 745, in getaddrinfo
    for res in _socket.getaddrinfo(host, port, family, type, proto, flags):
socket.gaierror: [Errno -3] Try again

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/usr/lib/python3.6/site-packages/urllib3/connectionpool.py", line 601, in urlopen
    chunked=chunked)
  File "/usr/lib/python3.6/site-packages/urllib3/connectionpool.py", line 346, in _make_request
    self._validate_conn(conn)
  File "/usr/lib/python3.6/site-packages/urllib3/connectionpool.py", line 850, in _validate_conn
    conn.connect()
  File "/usr/lib/python3.6/site-packages/urllib3/connection.py", line 284, in connect
    conn = self._new_conn()
  File "/usr/lib/python3.6/site-packages/urllib3/connection.py", line 150, in _new_conn
    self, "Failed to establish a new connection: %s" % e)
urllib3.exceptions.NewConnectionError: <urllib3.connection.VerifiedHTTPSConnection object at 0x7fb34801fdd8>: Failed to establish a new connection: [Errno -3] Try again

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/usr/lib/python3.6/site-packages/requests/adapters.py", line 445, in send
    timeout=timeout
  File "/usr/lib/python3.6/site-packages/urllib3/connectionpool.py", line 639, in urlopen
    _stacktrace=sys.exc_info()[2])
  File "/usr/lib/python3.6/site-packages/urllib3/util/retry.py", line 388, in increment
    raise MaxRetryError(_pool, url, error or ResponseError(cause))
urllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='acme-v02.api.letsencrypt.org', port=443): Max retries exceeded with url: /directory (Caused by NewConnectionError('<urllib3.connection.VerifiedHTTPSConnection object at 0x7fb34801fdd8>: Failed to establish a new connection: [Errno -3] Try again',))

During handling of the above exception, another exception occurred:

requests.exceptions.ConnectionError: HTTPSConnectionPool(host='acme-v02.api.letsencrypt.org', port=443): Max retries exceeded with url: /directory (Caused by NewConnectionError('<urllib3.connection.VerifiedHTTPSConnection object at 0x7fb34801fdd8>: Failed to establish a new connection: [Errno -3] Try again',))
Please see the logfiles in /data/logs/letsencrypt for more details.