Sticky: logRejectedDomains - tls SNI rejections #11

Closed
opened 2018-05-17 20:05:26 +00:00 by coolaj86 · 5 comments
Owner

Typically there are two types of tls SNI rejections:

  • Configuration Errors
  • Bots

Configuration Errors

When you're getting started with Greenlock™, it's common that you might forget to properly set a domain, or point a DNS record, or create the folder for the site to serve from.

You might see a rejection for 'example.com' that probably means you forgot to update the example file with your domain.

You might see an error 'www.youractualsite.com' which might mean you set up 'youractualsite.com' correctly, but forgot to set up the 'www' for proper redirects to the site.

The good news is that these types of errors are your fault, which means that you can fix them. Yay!

Obviously, we want you to see these messages, especially early on.

Bots

Bots are constantly probing the Internet to see how your server responds to a given request.

It will be very common to see requests come in from bot probes that are testing for bogus names on your server such as yahoo.com or google.com or some Chinese or Russian domain. There's nothing you can do about this.

Because we can't easily determine programmatically whether an error is created by a bot or a misconfiguration, we log all of these errors.

Turn off logging

Set logRejectedDomains: false to turn off logging, but be warned, if you have a configuration problem later, you've silenced the error.

Typically there are two types of tls SNI rejections: * Configuration Errors * Bots Configuration Errors ==================== When you're getting started with Greenlock™, it's common that you might forget to properly set a domain, or point a DNS record, or create the folder for the site to serve from. You might see a rejection for 'example.com' that probably means you forgot to update the example file with your domain. You might see an error 'www.youractualsite.com' which might mean you set up 'youractualsite.com' correctly, but forgot to set up the 'www' for proper redirects to the site. The good news is that these types of errors are your fault, which means that _you_ can fix them. Yay! Obviously, we want you to see these messages, especially early on. Bots ==== Bots are constantly probing the Internet to see how your server responds to a given request. It will be very common to see requests come in from bot probes that are testing for bogus names on your server such as yahoo.com or google.com or some Chinese or Russian domain. There's nothing you can do about this. Because we can't easily determine programmatically whether an error is created by a bot or a misconfiguration, we log all of these errors. Turn off logging ================ Set `logRejectedDomains: false` to turn off logging, but be warned, if you have a configuration problem later, you've silenced the error.

Hi again ) . Could you explain what to do if there is IP adress in this error, not domain? I use greenlock-express and there is no option to write a domain somewhere. There is just an array with two domains for sertificate creation. And sometimes this error occures:

[Error] approveDomains rejected tls sni '185.66.65.183'
[Error] (see coolaj86/greenlock.js#11)

It is not critical, but error log is full of this. And I afraid of turning "logRejectedDomains" off.
Thanks.

Hi again ) . Could you explain what to do if there is IP adress in this error, not domain? I use greenlock-express and there is no option to write a domain somewhere. There is just an array with two domains for sertificate creation. And sometimes this error occures: [Error] approveDomains rejected tls sni '185.66.65.183' [Error] (see https://git.coolaj86.com/coolaj86/greenlock.js/issues/11) It is not critical, but error log is full of this. And I afraid of turning "logRejectedDomains" off. Thanks.

I mean:
Error - approveDomains rejected tls sni '185.66.65.183'
Error - (see coolaj86/greenlock.js#11)

Can't edit previous post because of JS error:
Uncaught ReferenceError: issuesTribute is not defined
at HTMLAnchorElement. (index.js?v=c638d41d50d302cdc4c4e23aa40e960f:608)
at HTMLAnchorElement.dispatch (jquery.min.js:4)
at HTMLAnchorElement.r.handle (jquery.min.js:4)

I mean: Error - approveDomains rejected tls sni '185.66.65.183' Error - (see https://git.coolaj86.com/coolaj86/greenlock.js/issues/11) Can't edit previous post because of JS error: Uncaught ReferenceError: issuesTribute is not defined at HTMLAnchorElement.<anonymous> (index.js?v=c638d41d50d302cdc4c4e23aa40e960f:608) at HTMLAnchorElement.dispatch (jquery.min.js:4) at HTMLAnchorElement.r.handle (jquery.min.js:4)
Author
Owner

Sorry for the long wait.

It’s the same thing. It’s just some bit or music figured web client spewing out a random IP address at your server.

The longer your IP address has been rotating through cloud services, the more likely you are to get all sorts of random things.

Sorry for the long wait. It’s the same thing. It’s just some bit or music figured web client spewing out a random IP address at your server. The longer your IP address has been rotating through cloud services, the more likely you are to get all sorts of random things.
Author
Owner

I’ll have to double check on the logging option to see what’s up. It should turn off logging junk domains, but perhaps there’s some sort of check that happens before another that’s causing IPs to slip through while domains are dropped.

I’ll have to double check on the logging option to see what’s up. It _should_ turn off logging junk domains, but perhaps there’s some sort of check that happens before another that’s causing IPs to slip through while domains are dropped.
Author
Owner

Greenlock v3 no longer logs bad sni, and has a notify callback for handling other errors.

The manage callbacks take care of what used to be approveDomains.

Greenlock v3 no longer logs bad sni, and has a `notify` callback for handling other errors. The `manage` callbacks take care of what used to be `approveDomains`.
Sign in to join this conversation.
No Label
No Milestone
No Assignees
2 Participants
Notifications
Due Date
The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: coolaj86/greenlock.js-ARCHIVED#11
No description provided.