This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

UTM 9 & Webadmin & Letsencrypt certificate

I have UTM 9, version 9.703-3. I wanted to create a Let'sEncrypt certificate for the WebAdmin. I went to Remote Access -> Certificate Management -> New Certificate. I chose Method: Let'sEncrypt, and in Interface, the only option was "Internal (Address)". However, I got the error "An error occurred while communicating with the Let’s Encrypt server. Automatic renewals will be tried again during the next renewal attempt. Manual renewal can be attempted again at any time."

Any ideas?

The letsencrypt.log shows

2020:07:13-10:06:02 sophos letsencrypt[18586]: I Renew certificate: running command: /var/storage/chroot-reverseproxy/usr/dehydrated/bin/dehydrated -x -f /var/storage/chroot-reverseproxy/usr/dehydrated/conf/config -c --accept-terms --domain sophos.example.com
2020:07:13-10:06:23 sophos letsencrypt[18586]: I Renew certificate: command completed with exit code 256
2020:07:13-10:06:23 sophos letsencrypt[18586]: E Renew certificate: COMMAND_FAILED: ERROR: Challenge is invalid! (returned: invalid) (result: {
2020:07:13-10:06:23 sophos letsencrypt[18586]: E Renew certificate: COMMAND_FAILED:   "type": "http-01",
2020:07:13-10:06:23 sophos letsencrypt[18586]: E Renew certificate: COMMAND_FAILED:   "status": "invalid",
2020:07:13-10:06:23 sophos letsencrypt[18586]: E Renew certificate: COMMAND_FAILED:   "error": {
2020:07:13-10:06:23 sophos letsencrypt[18586]: E Renew certificate: COMMAND_FAILED:     "type": "urn:ietf:params:acme:error:connection",
2020:07:13-10:06:23 sophos letsencrypt[18586]: E Renew certificate: COMMAND_FAILED:     "detail": "Fetching sophos.example.com/.../foo_-bar: Timeout during connect (likely firewall problem)",
2020:07:13-10:06:23 sophos letsencrypt[18586]: E Renew certificate: COMMAND_FAILED:     "status": 400
2020:07:13-10:06:23 sophos letsencrypt[18586]: E Renew certificate: COMMAND_FAILED:   },
2020:07:13-10:06:23 sophos letsencrypt[18586]: E Renew certificate: COMMAND_FAILED:   "url": "acme-v02.api.letsencrypt.org/.../u0bkFQ",
2020:07:13-10:06:23 sophos letsencrypt[18586]: E Renew certificate: COMMAND_FAILED:   "token": "foo_-bar",
2020:07:13-10:06:23 sophos letsencrypt[18586]: E Renew certificate: COMMAND_FAILED:   "validationRecord": [
2020:07:13-10:06:23 sophos letsencrypt[18586]: E Renew certificate: COMMAND_FAILED:     {
2020:07:13-10:06:23 sophos letsencrypt[18586]: E Renew certificate: COMMAND_FAILED:       "url": "sophos.example.com/.../foo_-bar",
2020:07:13-10:06:23 sophos letsencrypt[18586]: E Renew certificate: COMMAND_FAILED:       "hostname": "sophos.example.com",
2020:07:13-10:06:23 sophos letsencrypt[18586]: E Renew certificate: COMMAND_FAILED:       "port": "80",
2020:07:13-10:06:23 sophos letsencrypt[18586]: E Renew certificate: COMMAND_FAILED:       "addressesResolved": [
2020:07:13-10:06:23 sophos letsencrypt[18586]: E Renew certificate: COMMAND_FAILED:         "1.2.3.4"
2020:07:13-10:06:23 sophos letsencrypt[18586]: E Renew certificate: COMMAND_FAILED:       ],
2020:07:13-10:06:23 sophos letsencrypt[18586]: E Renew certificate: COMMAND_FAILED:       "addressUsed": "1.2.3.4"
2020:07:13-10:06:23 sophos letsencrypt[18586]: E Renew certificate: COMMAND_FAILED:     }
2020:07:13-10:06:23 sophos letsencrypt[18586]: E Renew certificate: COMMAND_FAILED:   ]
2020:07:13-10:06:23 sophos letsencrypt[18586]: E Renew certificate: COMMAND_FAILED: })
2020:07:13-10:06:24 sophos letsencrypt[18586]: I Renew certificate: sending notification WARN-603
2020:07:13-10:06:24 sophos letsencrypt[18586]: [WARN-603] Let's Encrypt certificate renewal failed accessing Let's Encrypt service
2020:07:13-10:06:24 sophos letsencrypt[18586]: I Renew certificate: execution completed (CSRs renewed: 0, failed: 1)

This thread was automatically locked due to age.

Parents

0 emmosophos over 4 years ago

Hello Vangelis,

Thank you for contacting the Sophos Community.

Yes, you need to select the WAN interface for Letsencrypt to be able to create your certificate.

What interfaces you have configured in your UTM?

Regards,

Emmanuel (EmmoSophos)

Technical Team Lead, Global Community Support
Sophos Support Videos | Product Documentation | @SophosSupport | Sign up for SMS Alerts
If a post solves your question use the 'Verify Answer' link.
Cancel
Vote Up 0 Vote Down

Cancel
0 Vangelis Katsikaros over 4 years ago in reply to emmosophos

Hello

Thanks for the prompt reply. Indeed there is no WAN interface configured. I see that only the default internal one is defined.

I would like to ask what are the security implications if I create a WAN interface. The Sophos UTM runs on AWS EC2 (from the marketplace), and a security group allows incoming traffic only from specific IPs.

Regards

Vangelis
Cancel
Vote Up 0 Vote Down

Cancel
0 emmosophos over 4 years ago in reply to Vangelis Katsikaros

Hello Vangelis,

Oh I see, yes the UTM on AWS only needs one interface.

You could create an additional interface for the UTM, and have this interface to have the Public IP, then in the Security Group just allow port 80 and 443 while the Certificate is created, and then basically open the ports you would need later on.

However, this raises another question, what is the main goal for you to use the Let's Encrypt certificates?

Regards,

Emmanuel (EmmoSophos)

Technical Team Lead, Global Community Support
Sophos Support Videos | Product Documentation | @SophosSupport | Sign up for SMS Alerts
If a post solves your question use the 'Verify Answer' link.
Cancel
Vote Up 0 Vote Down

Cancel
0 Vangelis Katsikaros over 4 years ago in reply to emmosophos

Hello

Thanks again for the prompt reply.

We are currently using a self-signed certificate and we would like to switch to an SSL certificate signed from a known CA (like Let's Encrypt). If we don't use Let's Encrypt we have to a) increase costs and b) manually perform the importing when it needs renewal (once every 2 years - yes it's not often). For these reasons we picked Let's Encrypt.

Regarding the additional interface, on the EC2 security group level we a) restrict ingress to a specific set of IPs and b) restrict to port 443. Would that be a problem?

Regards

Vangelis
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 Vangelis Katsikaros over 4 years ago in reply to emmosophos

Hello

Thanks again for the prompt reply.

We are currently using a self-signed certificate and we would like to switch to an SSL certificate signed from a known CA (like Let's Encrypt). If we don't use Let's Encrypt we have to a) increase costs and b) manually perform the importing when it needs renewal (once every 2 years - yes it's not often). For these reasons we picked Let's Encrypt.

Regarding the additional interface, on the EC2 security group level we a) restrict ingress to a specific set of IPs and b) restrict to port 443. Would that be a problem?

Regards

Vangelis
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 emmosophos over 4 years ago in reply to Vangelis Katsikaros

Hello Vangelis,

So yes you would need to allow the IPs for Let's Encrypt, unfortunately, I am not sure which IPs they use as they don't share these due to security concerns. So I think you could simply try to run the Certificate creation, and once you get the certificate restrict access to your specific IPs.

Regards,

Emmanuel (EmmoSophos)

Technical Team Lead, Global Community Support
Sophos Support Videos | Product Documentation | @SophosSupport | Sign up for SMS Alerts
If a post solves your question use the 'Verify Answer' link.
Cancel
Vote Up 0 Vote Down

Cancel
0 Vangelis Katsikaros over 4 years ago in reply to emmosophos

Hello

Thanks for the reply. The approach of allowing LetsEncrypt IPs sounds clunky and increases maintenance rather than decreasing it. Would it be possible to perform LetsEncrypt DNS domain based validation? This way we can safely add an AWS IAM role to the EC2 instance to perform the proper aws cli/API commands.

Regards

Vangelis
Cancel
Vote Up 0 Vote Down

Cancel
0 Vangelis Katsikaros over 4 years ago in reply to Vangelis Katsikaros

Hello again

I would like to ask if it would it be possible to perform LetsEncrypt DNS domain based validation? This way we can add an AWS IAM role to the Sophos EC2 instance and avoid any hardcoded credentials.

Regards
Vangelis
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 4 years ago in reply to Vangelis Katsikaros

Geiasou Vangelis,

If you try this, please come back here and share your results.

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
0 Vangelis Katsikaros over 4 years ago in reply to BAlfson

Hi BAlfson :)

I don't see a straightforward (through the Sophos interface) way to do the Letsencrypt via DNS validation. I am waiting for an official answer on whether this is possible or not.

Regards
Vangelis
Cancel
Vote Up 0 Vote Down

Cancel
0 emmosophos over 4 years ago in reply to Vangelis Katsikaros

Hello Vangelis,

So checking it doesn't seem that DNS validation is an option.

Regards,

Emmanuel (EmmoSophos)

Technical Team Lead, Global Community Support
Sophos Support Videos | Product Documentation | @SophosSupport | Sign up for SMS Alerts
If a post solves your question use the 'Verify Answer' link.
Cancel
Vote Up 0 Vote Down

Cancel