Lets Encypt failing

Getting the following error requesting Lets Encypt certificate

"type":"urn:ietf:params:acme:error:connection"

"detail":"xx.xx.xx.xx: Fetching xxxxxxxxxxxx/.../mhmbdFphj1tfMCrRkrqqrp2CrgNY54ipSQeI66mcGFQ: Timeout during connect (likely firewall problem)"

"status":400

Sophos says:

There are three main things to check:
• First, that the firewall port can be reached on port 80.
• Second, that the domain in the certificate request resolves the interface selected.
• Third, that there is no DNAT rule configured on port 80, as this will supersede the inbound requests

Firewall can't be reached on Port 80 - but my understanding is that port 80 is only opened for the time the certificate request is checked. I've done a packet capture on the interface WAN IP and Port 80 and nothing comes in

The domain definitely resolves to the interface selected

There are no DNAT rules configured on Port 80

Notably, I'm using Sophos XGS in Azure - but there is an inbound rule in the NSG to allow all traffic and all ports

Any ideas?

Added TAGs
[edited by: Erick Jan at 8:01 AM (GMT -8) on 7 Nov 2024]

Top Replies

Stuart James 14 days ago in reply to Stuart James +2 verified

All good - sorted this out - a stupid copy and paste error from the wrong field at the start of the process.

0 LuCar Toni 14 days ago

Basically: Let´s Encrypt Deep Dive & Debugging in SFOSv21.0

Try an client in the internet (phone) and open your browser with https://domain:80

It should at least show port 80 packets in the packet capture. If not --> You have an firewall issue / routing issue.

SFOS will start a WAF Rule - but the waf rule will expect traffic on Port 80. If this cannot flow, it could be blocked by something in front of the firewall.

__________________________________________________________________________________________________________________
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 LuCar Toni 14 days ago in reply to LuCar Toni

I recapped the Recommended Read for the global community: Let´s Encrypt Deep Dive & Debugging in SFOSv21.0

__________________________________________________________________________________________________________________
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Stuart James 14 days ago in reply to LuCar Toni

Yep, I'm seeing traffic in the packet capture doing that.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 LuCar Toni 14 days ago in reply to Stuart James

To be sure: You updated to V21.0 GA? Or are you still running EAP1?

__________________________________________________________________________________________________________________
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Stuart James 14 days ago in reply to LuCar Toni

GA.

Some additional info that I've just found. If I try and access port 80 on the firewalls primary Port B address, it works fine. If I try and access port 80 on the firewalls secondary addresses, all of them fail.

BUT, I can access ports that have active NAT rules on the secondary addresses going to various servers, so it looks like the firewall itself isn't responding to secondary addresses destined for the system itself.

I'll keep digging a bit further and see what I can find.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
+1 Stuart James 14 days ago in reply to Stuart James

All good - sorted this out - a stupid copy and paste error from the wrong field at the start of the process.
Cancel
Vote Up +2 Vote Down

Sign in to reply

Reject Answer

Cancel