LoginSignup
1
2

More than 3 years have passed since last update.

https-portal productionで証明書が取得できない時 (Response Code: 403)

Posted at

stagingではlet's encryptからテスト用の証明書を発行できるが
productionに変更しコンテナを立ち上げると以下の様なエラーが発生する

エラー内容

https-portalコンテナのログ
Response Code: 403
Response: {u'status': 403, u'type': u'urn:ietf:params:acme:error:unauthorized', u'detail': u'An account with the provided public key exists but is deactivated'}
================================================================================
Failed to sign ドメイン名
Make sure you DNS is configured correctly and is propagated to this host
machine. Sometimes that takes a while.
================================================================================
Failed to obtain certs for ドメイン名

レート制限かかっているかも?

https://crt.sh/
にてドメインでggっても証明書を発行した履歴が見つからない、、これ証明書発行できてないんじゃないか?

ポート DNSの設定を確認

一通りポート、DNSの設定を確認するも特にこれといったエラー項目は確認できず

解決方法

https-portalのリポジトリのREADME.mdの説明を全て読んでみる

Automatic Container Discovery
WARNING: WE STRONGLY RECOMMEND AGAINST USING THIS FEATURE UNLESS ABSOLUTELY NECESSARY as exposing Docker socket to a container (even with :ro) essentially gives the container root access to your host OS. If you insist, verify the source code carefully. Read more
HTTPS-PORTAL is capable of discovering other Docker containers running on the same host, as long as the Docker API socket is accessible within the container.

あれ、、もしかしてコンテナ検出できてない?

以下記載通りにvolumeの記述を変更してみる

services:
  https-portal:
    # ...
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro # DANGEROUS, see the warning above

コンテナを再度立ち上げログを確認しつつ数分待ってみる

証明書が取得できました!!!!

1
2
0

Register as a new user and use Qiita more conveniently

  1. You get articles that match your needs
  2. You can efficiently read back useful information
  3. You can use dark theme
What you can do with signing up
1
2