Generating Lets Encrypt Certificate - requested host does not resolve to IP

FreePBX
1

Hello,

I have a FreePb v14 system running. It works great :slight_smile:
But there is one thing I could not yet really get over to.

I have tried to generate a Let`s Encrypt certificate for this machine using the FreePbx administration web frontend for certificates (Admin -> Certificate Manager -> Create New Lets Encrypt Cert).

This are my systems details (values slightly modified ONLY SIMILAR EXAMPLE FOR DEMONSTRATION!):

Hostname: srv01.xyz.com
IP: 218.17.123.123
Version: FreePBX 14.0.1.4 (from latest official distro)

DNS entry for xyz.com:
A 3600 srv01 218.17.123.123

Lets Encrypt cert details:
Certificate Host Name: srv01.xyz.com

This is the error output on generation:
There was an error updating the certificate: Error ‘Requested host ‘srv01.xyz.com’ does not resolve to ‘91.130.242.22’ (Found 213.17.123.123)’ when requesting “srv01.xyz.com//.freepbx-known/c70667a06e8fb13d35fb770ddc2c0023”

The strange thing is, I can reach the URL srv01.xyz.com//.freepbx-known/c70667a06e8fb13d35fb770ddc2c0023 without any problems from outside with any browser and the response does come from the host/apache with the IP 213.17.123.123.

Firewall module is enabled and configured on the pbx, the needed LE exclusions were made.

The IP which was resolved by the LE module “91.130.242.22” seems to be the last IP before my ISP hands over the connection to my network.
In my network, the pbx device is in a DMZ and public IP is set for it.
I have no other active firewall. I can also not image that my ISP blocks any ports as all parts of the device are connective (ssh, apache, ssl etc.) from outside.

How does the certificate manager resolve the IP, does it need any further settings ?
Why does it resolve to the last gateway of my ISP and not to that what is set in the DNS entry ?

I am curious about that. Please help ! Thank you !

2

Hello,

ok i`ve discovered one strange thing.

My network settings for the pbx are as follows (in System Admin Module):

Type: Static
IP: 218.17.123.123
Gateway: 218.17.123.122

If I now go to “Asterisk SIP Settings” and click on “Detect Network settings” there the resolved external IP is set to 91.130.242.22.

How does FreePbx/Asterisk resolve the external IP ??

3

FreePBX does not resolve that IP. You hard set that IP in SIP Setting module. Update it and you should be good to go.

4

You also can’t just “make up” a domain. The domain has to be resolvable and open on port 80.

5

Hello,

fixed it :slight_smile:

My router did a NAT translation on the inital packet, so what the LE service was receiving was not my (configured) static IP but instead my secondary dynamic IP which assigned by my provider to the modem on every PPPoe connection. So turn off nat if it`s behind a subnet.

Thanks anyway!

6

So turn off nat if it`s behind a subnet. - You did this in your router?