Duckdns SSL Challenge is invalid!

Installation Home Assistant OS
1

I’ve tried configuring duckdns with SSL as per the guide addons/duckdns/README.md at master · home-assistant/addons · GitHub

I have port forwarded 443 to 8312

I can access http://xxxx.duckdns.org:443/ but not https://xxxx.duckdns.org (ERR_SSL_PROTOCOL_ERROR)

is this correct?

Untitled

Log

INFO: Using main config file /data/workdir/config

  • Generating account key…
  • Registering account key with ACME server…
  • Fetching account ID…
  • Done!
    [00:26:47] INFO: OK
    “public ip”
    NOCHANGE

INFO: Using main config file /data/workdir/config

  • Creating chain cache directory /data/workdir/chains
    Processing xxxx.duckdns.org
  • Creating new directory /data/letsencrypt/xxxx.duckdns.org …
  • Signing domains…
  • Generating private key…
  • Generating signing request…
  • Requesting new certificate order from CA…
  • Received 1 authorizations URLs from the CA
  • Handling authorization for xxxx.duckdns.org
  • 1 pending challenge(s)
  • Deploying challenge tokens…
    OK + Responding to challenge for xxxx.duckdns.org authorization…
  • Challenge is valid!
  • Cleaning challenge tokens…
    OK + Requesting certificate…

1
1735×240 8.39 KB

1 Like
2

Sorry, what has ssh got to do with this ?

3

That looks ok to me.
Do you have a base_url configured under http: ?
(it should be https://domain)

4

You missed a bit - see further down that page

1 Like
5

Thanks! You’re right I had missed that.

my duckdns config now looks like this;
Untitled

Untitled

now I get an error in the log;

INFO: Using main config file /data/workdir/config

  • Account already registered!
    [13:39:22] INFO: KO

INFO: Using main config file /data/workdir/config

Processing xxxxx.duckdns.org with alternative names: *.xxxxx.duckdns.org

  • Signing domains…
  • Generating private key…
  • Generating signing request…
  • Requesting new certificate order from CA…
  • Received 2 authorizations URLs from the CA
  • Handling authorization for xxxxx.duckdns.org
  • Handling authorization for xxxxx.duckdns.org
  • 2 pending challenge(s)
  • Deploying challenge tokens…
    OKOK + Responding to challenge for xxxxx.duckdns.org authorization…
  • Cleaning challenge tokens…
    OKOK + Challenge validation has failed :frowning:
    ERROR: Challenge is invalid! (returned: invalid) (result: {
    “type”: “dns-01”,
    “status”: “invalid”,
    “error”: {
    “type”: “urn:ietf:params:acme:error:unauthorized”,
    “detail”: “Incorrect TXT record "_zXPaSSzGuW1t6D8dfO642ryPOB_Kb0KpAPNZu70lXA" found at _acme-challenge.xxxxx.duckdns.org”,
    “status”: 403
    },
    “url”: “https://acme-v02.api.letsencrypt.org/acme/chall-v3/1726424646/YHjgIA”,
    “token”: “vxJWpm8TPoEf2VpPUuMGJeGNOdZ4fceS7vqI89U-4RQ”
    })

I’ve also noticed the \hassio\ssl folder is empty. Shouldn’t this have the fullchain.pem and privkey.pem files in it?

6

Ok. Got past that issue.

I think there was a error in configuration.yaml. I had a different problem of not being able to update HA to to the latest version. Clearing configuration.yaml allowed the update to run.

So I started again, reinstalled duckdns and re-entered the config.

The log in duckdns now looks correct…

  • Challenge is valid!
  • Cleaning challenge tokens…
    OK + Requesting certificate…
  • Checking certificate…
  • Done!
  • Creating fullchain.pem…
  • Done!

But I still can’t access from https://xxxx.duckdns.org.

I’m forwarding the local 8213 port to 443
Capture

7

Your base URL is telling ha that it’s on port 8123, yet you’re trying to use port 443. Remove the :8123 from your HA config

8

Seems to be working now… just required a full restart.

I still have the 8123 port in http;

http:
  base_url: https://xxxx.duckdns.org:8123
  ssl_certificate: /ssl/fullchain.pem
  ssl_key: /ssl/privkey.pem

I can only connect on - https://xxxx.duckdns.org, http or 8123 on the public url doesnt work. (which is correct I think). I can also connect locally on 192.168.1.4:8123 but I get a warning that the site isnt secure. https://192.168.1.4 doesn’t work.

9

Because you told HA to only listen on SSL.

You don’t have port 8123 open externally so that’s fine. What I’m saying is that your base_url is wrong. I don’t know how else to say it, but remove the 8123 off of it. You’re not using it.

Correct. This is working as it should then.

10

Thanks, removed :slight_smile:

http:
  base_url: https://xxxx.duckdns.org
  ssl_certificate: /ssl/fullchain.pem
  ssl_key: /ssl/privkey.pem
11

How did you fix this? I’m stuck in the same place. I seem to recall using certbot last time but i’m not sure.

Thanks :slight_smile: