I get this error while generating let’s encrypt certificate :
Self test error: Pest_Curl_Exec - Failed connect to myname.ddns.net:80; Connection refused
Does DNS for myname.ddns.net resolve correctly? Local DNS result: 127.0.0.1, External DNS result: 93.66.241.165
The FreePBX Firewall is not enabled.
The LetsEncrypt servers only send challenge queries to port 80. Certificate requests will fail if public access via port 80 is not available.
Processing: myname.ddns.net, Local IP: 127.0.0.1, Public IP: 93.68.245.166
Self test: trying http://myname.ddns.net/.freepbx-known/34dc7ea212e11e1206b68671d9c4c4f8
Self test error: Pest_Curl_Exec - Failed connect to myname.ddns.net:80; Connection refused
pbx port 80 is assigned to let’s encrypt service in sysadmin
public ip port 80 is natted to pbx ip port 80
trying http://lan_pbxaddress or
http://lan_pbxaddress/.freepbx-known/34dc7ea212e11e1206b68671d9c4c4f8
from pc inside LAN , I get a ERR_CONNECTION_REFUSED
Normally I use port 80 for http GUI management
For let’s Encrypt purpose I set 8080 for GUI and 80 for Let’s Encrypt in system admin.
Doing so, the system refuses connections in port 80
Right !
I have another Freepbx machine on the same LAN I hadn’t tried yet, with same settings (and right router port redirection) , LE certificate has been succesfully generated.
Wondering what is not working on the first machine…
stat /var/www/html/.freepbx-known/ /var/www/html/.well-known/
echo -e "this is only a test\n" >/var/www/html/.freepbx-known/test.txt
curl -v http://127.0.0.1/.freepbx-known/test.txt
Well… no words…
Back on first machine, try to generate LE certificate and… boom, certificate succesfully generated
I don’t really know what happened on previous attempts failing with refuse in port 80
Probably something messed up in sysadmin port changes…
Same here! Certificate generation failed with the same error on a brand new installation (it was pretty much the first thing I tried after the installation).
Now a few days later it just worked
Question :
the certificate your trying to issue is related to your pbx hostname , i.e. mypbx.mydomain.com
that has to be a FQDN resolvable by internet DNS
What if I can’t handle my domain, i.e. like noip etc. with no wildcard allowed (subdomains) on free ddns service ?
I have understood there is no more way to fool up LAN browsers with your own self-signed certificate.
Is there any workaround ?
I haven’t had cause to do it recently, but I can think of no sensible reason why a browser, on a mainstream OS, wouldn’t accept a user provided root CA certificate (which by definition is self signed), which was then used to sign the individual device certificates.
I’d expect large, security conscious organisations to actually disable most of the standard root and intermediate ones, and in particular Lets Encrypt and CACert, on the basis that they didn’t adequately authenticate clients, and might be controlled by a hostile country, but then add a corporate root certificate.
Nothing prevents issuing a LetsEncrypt cert for a dynamic DNS address as long as there is something to serve the http challenge token at the ddns endpoint.
It’s even possible to use dns-01 auth with some ddns providers, with no http server requirement at all.
It’s mostly done, but without getting into the drama, I’m suddenly faced with selling two homes and buying another in this crazy market. Any free time I had to polish things up is gone for the short term.
Should get back to it in a couple of weeks after moving and getting the old house listed.
