You are not logged in.
- Topics: Active | Unanswered
Pages: 1
#1 2023-10-08 03:14:29
- lfyey121
- Member
- From: china
- Registered: 2022-08-25
- Posts: 66
mormot.net.acme error
An error occurred while calling the completedomainregistero function:
EXC EJwsHttp {Message:"Error 400 [Error parsing certificate request: asn1: structure error: tags don't match (16 vs {class:0 tag:13 length:45 isCompound:true}) {optional:false explicit:false application:false private:false defaultValue:<nil> tag:<nil> stringType:0 timeType:0 set:false omitEmpty:false} certificateRequest @2] while querying https://acme-v02.api.letsencrypt.org/acme/finalize/1349321746/213579860876"} [CheckCertificates] at 4c4526
Offline
#2 2023-10-10 10:16:02
- Chaa
- Member
- Registered: 2011-03-26
- Posts: 249
Re: mormot.net.acme error
Please try the following changes:
--- a/src/net/mormot.net.acme.pas
+++ b/src/net/mormot.net.acme.pas
@@ -868,8 +868,8 @@ var
begin
try
// Generate a new PKCS#10 Certificate Signing Request
- csr := fHttpClient.fCert.CertAlgo.CreateSelfSignedCsr(
- fSubjects, aPrivateKeyPassword, pk);
+ csr := PemToDer(fHttpClient.fCert.CertAlgo.CreateSelfSignedCsr(
+ fSubjects, aPrivateKeyPassword, pk));
// Before sending a POST request to the server, an ACME client needs to
// have a fresh anti-replay nonce to put in the "nonce" header of the JWS
fHttpClient.Head(fNewNonce);Note, there is added PemToDer conversion.
Offline
#3 2023-10-11 01:07:01
- lfyey121
- Member
- From: china
- Registered: 2022-08-25
- Posts: 66
Re: mormot.net.acme error
Yes, it works correctly and the certificate file has been generated
thanks
Offline
#4 2023-10-11 07:37:00
Re: mormot.net.acme error
Thanks a lot Chaa for the fix.
Please try with https://github.com/synopse/mORMot2/commit/b8a5e82b
By the way, it may be a good idea to add a sample about mormot.net.acme.
Like a self-hosted HTTPS server based on THttpAsyncServer, with automated Let's Encrypt certificates renewal.
Offline
#5 2023-10-11 12:48:50
- lfyey121
- Member
- From: china
- Registered: 2022-08-25
- Posts: 66
Re: mormot.net.acme error
I use nginx, the Settings are as follows, but https is not accessible,, I don't know what the problem is
server {
listen 443 ssl;
server_name xxx.xx.com;
ssl_certificate d://sslkeystore//xxx.xx.com.crt.pem;
ssl_certificate_key d://sslkeystore//xxx.xx.com.key.pem;
ssl_session_cache shared:SSL:1m;
ssl_session_timeout 5m;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;
ssl_ciphers EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH;
location / {
proxy_pass http://127.0.0.1:81;
proxy_redirect default;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_next_upstream error timeout invalid_header http_500 http_502 http_503 http_504;
proxy_max_temp_file_size 0;
proxy_connect_timeout 180;
proxy_send_timeout 180;
proxy_read_timeout 180;
proxy_buffer_size 4k;
proxy_buffers 4 32k;
proxy_busy_buffers_size 64k;
proxy_temp_file_write_size 64k;
}
}
Offline
#6 2023-10-11 12:52:13
- lfyey121
- Member
- From: china
- Registered: 2022-08-25
- Posts: 66
Re: mormot.net.acme error
d:\sslkeystore\xxx.xx.com.crt.pem;
d:\sslkeystore\xxx.xx.com.crt.pem;
This is the file generated by mormot.net.acme
Offline
#8 2023-10-12 09:40:56
- lfyey121
- Member
- From: china
- Registered: 2022-08-25
- Posts: 66
Re: mormot.net.acme error
After the test, you cannot set the password when applying for a certificate. After the password is set, the https service cannot run. After removing the password and re-applying for a certificate, it can run normally
Offline
#9 2023-10-12 09:43:15
- lfyey121
- Member
- From: china
- Registered: 2022-08-25
- Posts: 66
Re: mormot.net.acme error
gAcmeLetsEncryptServer:=TAcmeLetsEncryptServer.create(TsynLog, TacmeDaemonSettings(settings).keyStoreFolder,
ACME_LETSENCRYPT_URL{ACME_LETSENCRYPT_DEBUG_URL},'',''{There can be no passwords here},-1,'8084');
Offline
#10 2023-10-12 10:30:44
- Chaa
- Member
- Registered: 2011-03-26
- Posts: 249
Re: mormot.net.acme error
You can try ssl_password_file for nginx (https://nginx.org/en/docs/http/ngx_http … sword_file).
May be it helps.
Offline
#11 2023-10-12 11:21:51
- lfyey121
- Member
- From: china
- Registered: 2022-08-25
- Posts: 66
Re: mormot.net.acme error
After many attempts, the ssl_password_file parameter does the job, but strangely, the file name specified after this parameter must be in the standard windows path, and the certificate file specified path must replace the '\' in the path with '//'.
Offline
#12 2023-10-12 11:23:45
- lfyey121
- Member
- From: china
- Registered: 2022-08-25
- Posts: 66
Re: mormot.net.acme error
Thank you, https is finally working
Offline
#13 2024-10-26 04:32:26
- lfyey121
- Member
- From: china
- Registered: 2022-08-25
- Posts: 66
Re: mormot.net.acme error
In TAcmeLetsEncrypt checkCertificates procedure(line 1110), check the expiration date of error code:
cc. GetNotAfter < expired
should be:
cc.getNotAfter-fRenewBeforeEndDays < NowUtc
Offline
#15 2024-10-26 08:55:57
- lfyey121
- Member
- From: china
- Registered: 2022-08-25
- Posts: 66
Re: mormot.net.acme error
Am I wrong? How do I feel that your code will trigger renew after the expiration of rnewBeforeEndDays? My previous program has not triggered after the expiration, and I need to delete all certificate files each time before I can get it again.
Offline
#16 2024-10-26 09:00:56
- lfyey121
- Member
- From: china
- Registered: 2022-08-25
- Posts: 66
Re: mormot.net.acme error
For example, if the certificate expired yesterday (cc.GetNotAfter), your code: Expired := NowUtc-fRenewBeforeEndDays; expired is one month ago, cc.getNotAfter<expired is not valid.
Offline
#17 2024-11-01 21:12:28
- calvcol
- Member
- Registered: 2024-10-31
- Posts: 1
Re: mormot.net.acme error
In TAcmeLetsEncrypt checkCertificates procedure(line 1110), check the expiration date of error code:
cc. GetNotAfter < expired
should be:
cc.getNotAfter-fRenewBeforeEndDays < NowUtc
lfyey121 is right.
This "chart" shows when the value of cc.getNotAfter-fRenewBeforeEndDays < NowUtc changes, and works as expected
FALSE FALSE FALSE >|< TRUE TRUE TRUE TRUE TRUE TRUE
---------------------------|----------------------------|--------------
GetNotAfter-fRenewBeforeEndDays GetNotAfter
NowUtc -->
---------------------------|----------------------------|--------------The previous expression is equivalent to: cc.getNotAfter < NowUtc+fRenewBeforeEndDays
In actual code a expired value is precaltulated before entring the loop, and then the renewal of each certificate is checked with cc.GetNotAfter < expired, so line 1154 should be:
expired := NowUtc + fRenewBeforeEndDays;Offline
#18 2024-11-01 22:06:14
Re: mormot.net.acme error
Make sense.
Please try
https://github.com/synopse/mORMot2/commit/0640cb64
Thanks a lot, you all, for your input!
Offline
Pages: 1