TLS handschake error | acme can't get a cert for domain #6448

dion22 · 2021-04-14T08:42:36Z

Description

What happened:
Followed instruction:
https://goteleport.com/docs/getting-started/
and for TLS certs
https://goteleport.com/blog/letsencrypt-teleport-ssh/

DNS records: (renamed to teleport.com for this purpose)
A record connect.teleport.com
A record *.connect.teleport.com

First 20/24 hours everything was working as it should be. Except for this TLS error showing in the server log.
After some time i noticed that the server section on the teleport webpage showed No Data Available

Error:

ERRO [PROXY:SER] "proxy2021/04/14 10:15:58 http: TLS handshake error from <client_ip>:46010: acme can't get a cert for domain 636f6e6e6563742e616c6c63732e636c6f7564.teleport.cluster.local, add it to the proxy_service.public_addr, or use one of the domains: connect.teleport.com\n" utils/cli.go:304
ERRO [PROXY:SER] "proxy2021/04/14 10:15:58 http: TLS handshake error from <client_ip>:46008: acme can't get a cert for domain 636f6e6e6563742e616c6c63732e636c6f7564.teleport.cluster.local, add it to the proxy_service.public_addr, or use one of the domains: connect.teleport.com\n" utils/cli.go:304
ERRO [PROXY:SER] "proxy2021/04/14 10:19:17 http: TLS handshake error from <client_ip>:46022: acme can't get a cert for domain 636f6e6e6563742e616c6c63732e636c6f7564.teleport.cluster.local, add it to the proxy_service.public_addr, or use one of the domains: connect.teleport.com\n" utils/cli.go:304
ERRO [PROXY:SER] "proxy2021/04/14 10:19:17 http: TLS handshake error from <client_ip>:46020: acme can't get a cert for domain 636f6e6e6563742e616c6c63732e636c6f7564.teleport.cluster.local, add it to the proxy_service.public_addr, or use one of the domains: connect.teleport.com\n" utils/cli.go:304

Server config:

teleport:
  nodename: connect.teleport.com
  data_dir: /var/lib/teleport
  auth_servers:
  - 127.0.0.1:3025
  log:
    output: stderr
    severity: INFO
  ca_pin: sha256:<ca_pin>
auth_service:
  enabled: "yes"
  listen_addr: 0.0.0.0:3025
  public_addr: connect.teleport.com:3025
  cluster_name: connect.teleport.com
ssh_service:
  enabled: "yes"
  labels:
    teleport: server
  commands:
  - name: hostname
    command: [hostname]
    period: 1m0s
proxy_service:
  enabled: "yes"
  listen_addr: 0.0.0.0:3023
  web_listen_addr: 0.0.0.0:443
  tunnel_listen_addr: 0.0.0.0:3024
  public_addr: connect.teleport.com:443
  https_keypairs:
    - key_file: /etc/letsencrypt/live/connect.teleport.com/privkey.pem
      cert_file: /etc/letsencrypt/live/connect.teleport.com/fullchain.pem
  acme:
    enabled: "yes"
    email: [email protected]

node config:

teleport:
  nodename: node-100101
  data_dir: /var/lib/teleport
  auth_token: <auth_token>
  ca_pin: sha256:<ca_pin>
  auth_servers:
    - connect.teleport.com:443
  log:
    output: stderr
    severity: INFO
auth_service:
  enabled: no
ssh_service:
  enabled: yes
  labels:
    teleport: node
  commands:
  - name: hostname
    command: [hostname]
    period: 1m0s
proxy_service:
  enabled: no

Server Details

Teleport version (run teleport version): Teleport v6.1.1 git:v6.1.1-0-geacd474d8 go1.15.5
Server OS (e.g. from /etc/os-release): Ubuntu 18.04.5 LTS

Client Details

Tsh version (tsh version): Teleport v6.1.1 git:v6.1.1-0-geacd474d8 go1.15.5
Computer OS (e.g. Linux, macOS, Windows): Ubuntu 20.04.2 LTS
Browser version (for UI-related issues): Chrome
Installed via (e.g. apt, yum, brew, website download): apt

Debug Logs

included

teleport-log.txt
teleport-log-client.txt

The text was updated successfully, but these errors were encountered:

stevenGravy · 2021-04-14T14:14:09Z

@dion22 is port 443 open and can be connected from the internet? That's required for Acme to call back. We typically ask these type of issues entered into the github discussion tab..

dion22 · 2021-04-16T06:30:40Z

@stevenGravy port 443 is open and can be connected from the internet. When a new node is added its showing up for 24 hours (no alarm or anything) after 24 hours it is showing the http: TLS handshake error. Also the nodes are gone from the servers list.

I tried changing port 443 to 3080 (public + web) but same issue. Even with fresh install of the teleport server and client.

Sorry, next time i will ask this type of issues into the discussion tab.

inertial-frame · 2021-06-17T00:07:22Z

@dion22 - we're in the process of further improving our documentation surrounding ACME. Hopefully, #7340 addresses some of the items you mentioned a bit better. Cheers!

gramosbr · 2021-08-04T11:33:29Z

Any updates on this?

Our Getting Started guides often include instructions for configuring Let's Encrypt and ACME before starting Teleport, but not all of these instructions have the same level of detail, and some are missing some context around how Teleport uses ACME and why you need to open port 443 on your Proxy Service host. This change adds an include that spells out these instructions and invokes the include in the appropriate guides. The intention was to include as much relevant information within the guides themselves to prevent the reader from having to navigate to other pages. Closes #6448

* Standardize ACME instruction details Our Getting Started guides often include instructions for configuring Let's Encrypt and ACME before starting Teleport, but not all of these instructions have the same level of detail, and some are missing some context around how Teleport uses ACME and why you need to open port 443 on your Proxy Service host. This change adds an include that spells out these instructions and invokes the include in the appropriate guides. The intention was to include as much relevant information within the guides themselves to prevent the reader from having to navigate to other pages. Closes #6448 * Respond to PR feedback - Substitute "proxy" for "node" where it was incorrectly used - Some small stylistic fixes - Clarify that "teleport configure" does not write the config itself

Our Getting Started guides often include instructions for configuring Let's Encrypt and ACME before starting Teleport, but not all of these instructions have the same level of detail, and some are missing some context around how Teleport uses ACME and why you need to open port 443 on your Proxy Service host. This change adds an include that spells out these instructions and invokes the include in the appropriate guides. The intention was to include as much relevant information within the guides themselves to prevent the reader from having to navigate to other pages. Closes #6448

* Standardize ACME instruction details Our Getting Started guides often include instructions for configuring Let's Encrypt and ACME before starting Teleport, but not all of these instructions have the same level of detail, and some are missing some context around how Teleport uses ACME and why you need to open port 443 on your Proxy Service host. This change adds an include that spells out these instructions and invokes the include in the appropriate guides. The intention was to include as much relevant information within the guides themselves to prevent the reader from having to navigate to other pages. Closes #6448 * Respond to PR feedback - Substitute "proxy" for "node" where it was incorrectly used - Some small stylistic fixes - Clarify that "teleport configure" does not write the config itself

Our Getting Started guides often include instructions for configuring Let's Encrypt and ACME before starting Teleport, but not all of these instructions have the same level of detail, and some are missing some context around how Teleport uses ACME and why you need to open port 443 on your Proxy Service host. This change adds an include that spells out these instructions and invokes the include in the appropriate guides. The intention was to include as much relevant information within the guides themselves to prevent the reader from having to navigate to other pages. Closes #6448

* Standardize ACME instruction details Our Getting Started guides often include instructions for configuring Let's Encrypt and ACME before starting Teleport, but not all of these instructions have the same level of detail, and some are missing some context around how Teleport uses ACME and why you need to open port 443 on your Proxy Service host. This change adds an include that spells out these instructions and invokes the include in the appropriate guides. The intention was to include as much relevant information within the guides themselves to prevent the reader from having to navigate to other pages. Closes #6448 * Respond to PR feedback - Substitute "proxy" for "node" where it was incorrectly used - Some small stylistic fixes - Clarify that "teleport configure" does not write the config itself

Backports #9556 * Standardize ACME instruction details Our Getting Started guides often include instructions for configuring Let's Encrypt and ACME before starting Teleport, but not all of these instructions have the same level of detail, and some are missing some context around how Teleport uses ACME and why you need to open port 443 on your Proxy Service host. This change adds an include that spells out these instructions and invokes the include in the appropriate guides. The intention was to include as much relevant information within the guides themselves to prevent the reader from having to navigate to other pages. Closes #6448 * Respond to PR feedback - Substitute "proxy" for "node" where it was incorrectly used - Some small stylistic fixes - Clarify that "teleport configure" does not write the config itself

dion22 added the bug label Apr 14, 2021

webvictim mentioned this issue Apr 19, 2021

6.1.0 dialing teleport.cluster.local, works anyway #6308

Closed

inertial-frame mentioned this issue Jun 17, 2021

[v6.2] docs: add ACME and other Setup steps + Setup FAQ #7340

Closed

ptgott added this to the Documentation: Make it easier to get started milestone Dec 13, 2021

ptgott added documentation docs-edit and removed docs-scope-single labels Dec 16, 2021

ptgott mentioned this issue Dec 23, 2021

Standardize ACME instruction details #9556

Merged

ptgott closed this as completed in #9556 Mar 3, 2022

ptgott mentioned this issue Mar 9, 2022

[v7 backport] Standardize ACME instruction details #11009

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

TLS handschake error | acme can't get a cert for domain #6448

TLS handschake error | acme can't get a cert for domain #6448

dion22 commented Apr 14, 2021

stevenGravy commented Apr 14, 2021

dion22 commented Apr 16, 2021 •

edited

Loading

inertial-frame commented Jun 17, 2021

gramosbr commented Aug 4, 2021

TLS handschake error | acme can't get a cert for domain #6448

TLS handschake error | acme can't get a cert for domain #6448

Comments

dion22 commented Apr 14, 2021

Description

Server Details

Client Details

Debug Logs

stevenGravy commented Apr 14, 2021

dion22 commented Apr 16, 2021 • edited Loading

inertial-frame commented Jun 17, 2021

gramosbr commented Aug 4, 2021

dion22 commented Apr 16, 2021 •

edited

Loading