無法獲取域 \"mydomain.com,www.mydomain.com\" 的 ACME 證書

Question

我正在使用帶有 docker 部署的 cookiecutter-django 開始一個項目，由於某種原因 traefik 無法獲得letsencrypt證書，這是錯誤：

traefik_1       | time="2022-01-29T03:23:51Z" level=error msg="Unable to obtain ACME certificate for domains \"somedomain.com,www.somedomain.com\": unable to generate a certificate for the domains [somedomain.com www.somedomain.com]: error: one or more domains had a problem:\n[somedomain.com] acme: error: 403 :: urn:ietf:params:acme:error:unauthorized :: Invalid response from http://somedomain.com/.well-known/acme-challenge/XsBT222XeYdWT04Gdekbvla26NgRLbDh1890UQ_QHuM [2607:f1c0:100f:f000::290]: 204, url: \n[www.somedomain.com] acme: error: 403 :: urn:ietf:params:acme:error:unauthorized :: Invalid response from http://www.somedomain.com/.well-known/acme-challenge/AcnM8qIjv-RFpBKxDfkXzUfuSG2fRk-rjhrisHUlcTE [2607:f1c0:100f:f000::290]: 204, url: \n" providerName=letsencrypt.acme routerName=web-secure-router@file rule="Host(`somedomain.com`) || Host(`www.somedomain.com`)"

我也試過讓我們加密暫存端點，錯誤是一樣的：caServer: https://acme-staging-v02.api.letsencrypt.org/directory

traefik_1       | time="2022-01-29T03:51:26Z" level=info msg="Starting provider *acme.Provider {\"email\":\"my@email.com\",\"caServer\":\"https://acme-staging-v02.api.letsencrypt.org/directory\",\"storage\":\"/etc/traefik/acme/acme.json\",\"keyType\":\"RSA4096\",\"httpChallenge\":{\"entryPoint\":\"web\"},\"ResolverName\":\"letsencrypt\",\"store\":{},\"ChallengeStore\":{}}"
traefik_1       | time="2022-01-29T03:51:26Z" level=info msg="Testing certificate renew..." providerName=letsencrypt.acme
traefik_1       | time="2022-01-29T03:51:26Z" level=info msg="Starting provider *traefik.Provider {}"
traefik_1       | time="2022-01-29T03:51:47Z" level=info msg=Register... providerName=letsencrypt.acme
traefik_1       | time="2022-01-29T04:55:48Z" level=error msg="Unable to obtain ACME certificate for domains \"somedomain.com\": unable to generate a certificate for the domains [somedomain.com]: error: one or more domains had a problem:\n[somedomain.com] acme: error: 403 :: urn:ietf:params:acme:error:unauthorized :: Invalid response from http://somedomain.com/.well-known/acme-challenge/gaF6RncNKy17seTRhr944DQlFwBLUAFoL2MnNCJo1YY [2607:f1c0:100f:f000::290]: 204, url: \n" routerName=flower-router@file providerName=letsencrypt.acme rule="Host(`somedomain.com`)"
traefik_1       | time="2022-01-29T04:55:57Z" level=error msg="Unable to obtain ACME certificate for domains \"somedomain.com,www.somedomain.com\": unable to generate a certificate for the domains [www.somedomain.com]: error: one or more domains had a problem:\n[somedomain.com] acme: error: 403 :: urn:ietf:params:acme:error:unauthorized :: Invalid response from http://somedomain.com/.well-known/acme-challenge/gaF6RncNKy17seTRhr944DQlFwBLUAFoL2MnNCJo1YY [2607:f1c0:100f:f000::290]: 204, url: \n[www.somedomain.com] acme: error: 403 :: urn:ietf:params:acme:error:unauthorized :: Invalid response from http://www.somedomain.com/.well-known/acme-challenge/AsukH8wIdJthZeFMFpbulQvVKDprMrIObVmo9yRTpzo [2607:f1c0:100f:f000::290]: 204, url: \n" providerName=letsencrypt.acme routerName=web-secure-router@file rule="Host(`somedomain.com`) || Host(`www.somedomain.com`)"

我找不到有關該錯誤的任何信息，我已經嘗試在此處設置非 tls 配置，它在此處鏈接

我可以通過在瀏覽器上添加例外來使用域名訪問我的應用程序。

Answer 1

您的 AAAA 記錄是否正確？

似乎 Let's Encrypt 在挑戰文件中獲得了 204。 通常的錯誤是讓 AAAA 記錄與 A 記錄轉到不同的服務器，並且 traefik 僅在 A 記錄服務器上提供挑戰文件。