This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Latest UTM and Let's Encrypt Failures

Exrace 4 months ago

Having issues recently with renewing LE certificates.
For some time, I had a _acme-challenge. TXT record in my UTM firewall domain name.
I don't recall how I got the token, but LE was working fine until this year. Possibly the April changes broke validation using this token as the notes talk about requiring a way to automate adding a challenge record to DNS.

What are others doing to fix this?

Need see if there is a way to create this token at Lets' Encrypt.

The LE log is a bit useless for this:
2024:07:04-00:46:02 xxx letsencrypt[31867]: I Renew certificate: execution failed
2024:07:04-08:47:01 xxx letsencrypt[13531]: E Renew certificate: Incorrect response code from ACME server: 500
2024:07:04-08:47:01 xxx letsencrypt[13531]: E Renew certificate: URL was: acme-v02.api.letsencrypt.org/directory
2024:07:04-08:47:01 xxx letsencrypt[13531]: I Renew certificate: handling CSR REF_CaCsrYellowExt12 for domain set [xxx.domain.com]
2024:07:04-08:47:01 xxx letsencrypt[13531]: E Renew certificate: TOS_UNAVAILABLE: Could not obtain the current version of the Let's Encrypt Terms of Service

This thread was automatically locked due to age.

0 Vivek Jagad 4 months ago

Hi Exrace ,

Thank you for reaching out the community, Refer the following thread Sophos UTM 9.707-5 - Let’s Encrypt failed: Failed to retrieve the current Terms of Service link

Thanks & Regards,
_______________________________________________________________

Vivek Jagad | Team Lead, Technical Support, Global Customer Experience

Log a Support Case | Sophos Service Guide
Best Practices – Support Case | Security Advisories
Compare Sophos next-gen Firewall | Fortune Favors the prepared
Sophos Community | Product Documentation | Sophos Techvids | SMS
If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel
0 Exrace 4 months ago in reply to Vivek Jagad

That doesn't look to resolve the issue for me.
I tried removing the X1 cert and reuploading the cert but have same issue.
I also tried the step disabling the LE service and reenable and now we have the "E Create account: failed to create account" message. I don't have shell access to this server right now so I can't test the wget to see if there is another issue with certs.
Cancel
Vote Up 0 Vote Down

Cancel
0 Exrace 4 months ago in reply to Exrace

I got shell access via portal and this is a cert issue.
wget acme-v02.api.letsencrypt.org/directory
--2024-07-04 23:23:25-- acme-v02.api.letsencrypt.org/directory
Resolving acme-v02.api.letsencrypt.org... 172.65.32.248
Connecting to acme-v02.api.letsencrypt.org|172.65.32.248|:443... connected.
ERROR: cannot verify acme-v02.api.letsencrypt.org's certificate, issued by `/C=US/O=Let's Encrypt/CN=R11':
unable to get issuer certificate
To connect to acme-v02.api.letsencrypt.org insecurely, use `--no-check-certificate'.
Unable to establish SSL connection.

Looking now to see if we are missing this certificate.
Cancel
Vote Up 0 Vote Down

Cancel
0 Exrace 4 months ago in reply to Exrace

I wonder if this server has a corrupted cert store.
I tried adding the R11 CA and it made no difference.
Odd is I have another server I copied this current servers config from by importing and the source server has no issues.
Curl shows similar errors when run with the -vvvv -I -L -k parameters.
What is the best way to force UTM to refresh the certs required for LE?
Cancel
Vote Up 0 Vote Down

Cancel
0 Exrace 3 months ago in reply to Vivek Jagad

None of these suggestions work.
Anyone else have suggestions on how to get the certs properly installed?
Cancel
Vote Up 0 Vote Down

Cancel
0 Martin Choy 3 months ago

Just ran into this on my xgs device.

It seems it is using a new CA to generate the cert

Try downloading the R11 cert from letsencrypt.org/certificates (the link next to where it says signed by ISRG Root X1)

and install into the certificate authorities on the device.

Oh i did a firmware update just before i did this, was wondering if that would fix the validation error but it didnt and i had to upload that cert.

My previous certs were using the R3 CA, which has apparently been retired.
Cancel
Vote Up 0 Vote Down

Cancel
0 Harro Verton 3 months ago
You can get this error if you have IPv6 configured, but there is a connectivity issue. Most tools fall back to IPv4 without problems, but the ACME client on the UTM doesn't.

If you have this issue, get it fixed, or as a workaround, edit /var/storage/chroot-reverseproxy/usr/dehydrated/conf/config, and set
IP_VERSION=4

to force a connection using IPv4.
Cancel
Vote Up 0 Vote Down

Cancel
0 Exrace 3 months ago in reply to Martin Choy

I did try that cert but made no difference.
Cancel
Vote Up 0 Vote Down

Cancel
0 Exrace 3 months ago in reply to Harro Verton

I tried this edit and rebooted system. Same error message.
Cancel
Vote Up 0 Vote Down

Cancel
0 Exrace 3 months ago in reply to Exrace

Reboot reset file back to default, so I tried the edit and no reboot. Still fails.
Cancel
Vote Up 0 Vote Down

Cancel