Greenlock is stuck with challenge state "invalid", when I remove private key, it starts to work correctly #27

New Issue

Ghost · 2018-12-12T16:11:22Z

Ghost commented

2018-12-12 16:11:22 +00:00

I have an issue with some domains, which receive the error below.
When I remove primary key, it starts to work correctly. Do you have any ideas how to deal with issues like this?

15:55:40
[acme-v2] (E_STATE_INVALID) challenge state: 'invalid'
15:55:40
[acme-v2] handled(?) rejection as errback:
15:55:40
Error: [acme-v2] [error] unacceptable challenge state 'invalid'
15:55:40
at /srv/shorturl_redirector/node_modules/acme-v2/node.js:374:31
15:55:40
at process._tickCallback (internal/process/next_tick.js:68:7)
15:55:40
Error loading/registering certificate for 'el-jj15asmr.asmrtistunited.org':
15:55:40
Error: [acme-v2] [error] unacceptable challenge state 'invalid'
Error: [acme-v2] [error] unacceptable challenge state 'invalid'

I have an issue with some domains, which receive the error below. When I remove primary key, it starts to work correctly. Do you have any ideas how to deal with issues like this? ``` 15:55:40 [acme-v2] (E_STATE_INVALID) challenge state: 'invalid' 15:55:40 [acme-v2] handled(?) rejection as errback: 15:55:40 Error: [acme-v2] [error] unacceptable challenge state 'invalid' 15:55:40 at /srv/shorturl_redirector/node_modules/acme-v2/node.js:374:31 15:55:40 at process._tickCallback (internal/process/next_tick.js:68:7) 15:55:40 Error loading/registering certificate for 'el-jj15asmr.asmrtistunited.org': 15:55:40 Error: [acme-v2] [error] unacceptable challenge state 'invalid' Error: [acme-v2] [error] unacceptable challenge state 'invalid' ```

coolaj86 commented

2018-12-12 16:17:04 +00:00

See the troubleshooting guide and first 2 videos at
https://git.coolaj86.com/coolaj86/greenlock-express.js

It sounds like you’re adding new domains and probably just need to use the approveDomains callback (or a more sophisticated storage plugin).

See the troubleshooting guide and first 2 videos at https://git.coolaj86.com/coolaj86/greenlock-express.js It sounds like you’re adding new domains and probably just need to use the approveDomains callback (or a more sophisticated storage plugin).

Ghost commented

2018-12-12 18:15:20 +00:00

The problem is not the error, it happens - some network issues, DNS cache and so on.

The problem is that this problem stays even when the original problem disappears and it requires manual intervention to be solved.

I have 10000+ domains in a system and fixing every domain is not a solution. It would be nice if you can suggest me how to implement a solution and I'll send a pull request

The problem is not the error, it happens - some network issues, DNS cache and so on. The problem is that this problem stays even when the original problem disappears and it requires manual intervention to be solved. I have 10000+ domains in a system and fixing every domain is not a solution. It would be nice if you can suggest me how to implement a solution and I'll send a pull request

Ghost commented

2018-12-12 18:17:58 +00:00

PS: for 99% of domains everything works fine

coolaj86 commented

2019-02-05 05:13:38 +00:00

There were some problems with the way the primary key thumbprint was being generated in some cases. I think that may have been related to this. I published the fix a while ago, but forgot to update you here.

I'm going to close this out, but please reopen it if this happens again with the latest version.

There were some problems with the way the primary key thumbprint was being generated in some cases. I think that may have been related to this. I published the fix a while ago, but forgot to update you here. I'm going to close this out, but please reopen it if this happens again with the latest version.

coolaj86 closed this issue

2019-02-05 05:13:38 +00:00

Ghost commented

2019-04-17 03:47:34 +00:00

@coolaj86 I am experiencing a similar issue. I have around 5,000 relatively low traffic domains. The vast majority work perfectly, but every once in a while I run into one that just won't validate, giving the error "unacceptable challenge state 'invalid'".

I have gone through all the troubleshooting steps and nothing seems to work. Every request to the domain results in the above error. Then it creates the directory for the domain in acme/live, with only privkey.pem inside of it. Deleting the directory for the domain doesn't seem to solve it.

@gugu, is that what you mean by removing the "primary key."

Any advice or direction you could be me here would be really helpful, thanks.

@coolaj86 I am experiencing a similar issue. I have around 5,000 relatively low traffic domains. The vast majority work perfectly, but every once in a while I run into one that just won't validate, giving the error "unacceptable challenge state 'invalid'". I have gone through all the troubleshooting steps and nothing seems to work. Every request to the domain results in the above error. Then it creates the directory for the domain in acme/live, with only `privkey.pem` inside of it. Deleting the directory for the domain doesn't seem to solve it. @gugu, is that what you mean by removing the "primary key." Any advice or direction you could be me here would be really helpful, thanks.

coolaj86 commented

2019-04-17 04:06:27 +00:00

Especially in light of the cleanup as part of the transition to v2.7+ / v3 it's very likely that the issue is specific to your situation, and not an issue with Greenlock itself.

Off the cuff my guess is that either you're over your limit per IP or the domain that you're trying to validate is a special non-supported tld (i.e. .newthing not .com) or that the domain has a CAA record set.

We're going to start offering commercial licensing and business support plans for priority support for these types of issues. As of right now I can offer consulting at an hourly rate to help troubleshoot. Please send an email to aj@therootcompany.com with your timezone and specific details about the failing domains.

We can get on a screen share and take a look at logs, get into specifics more than what you might want to share publicly on an issue, and quickly debug it.

Especially in light of the cleanup as part of the transition to v2.7+ / v3 it's very likely that the issue is specific to your situation, and not an issue with Greenlock itself. Off the cuff my guess is that either you're over your limit per IP or the domain that you're trying to validate is a special non-supported tld (i.e. `.newthing` not `.com`) or that the domain has a CAA record set. We're going to start offering commercial licensing and business support plans for priority support for these types of issues. As of right now I can offer consulting at an hourly rate to help troubleshoot. Please send an email to aj@therootcompany.com with your timezone and specific details about the failing domains. We can get on a screen share and take a look at logs, get into specifics more than what you might want to share publicly on an issue, and quickly debug it.

Ghost commented

2019-04-17 04:39:37 +00:00

Thanks, I just sent you an email.

coolaj86 referenced this issue from a commit

2019-11-01 11:10:12 +00:00

fix #27 use domainKeyPath, move to rsa-compat, use RSA.exportPrivatePem

Sign in to join this conversation.

No Label

No Milestone

No Assignees

2 Participants

Notifications

Due Date

The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: coolaj86/greenlock.js-ARCHIVED#27