defguard installation problem accessing enrollment site

[rongitone]

Hello, I'm not able to access the defguard enroll and basic sites after the installation following the instructions here using docker. https://defguard.gitbook.io/defguard/tutorials/step-by-step-setting-up-a-vpn-server.
Thanks for the help!

It seems to complete and has this message at the end of the installation.
"defguard setup finished successfully"
The firewall is open on ports 50055, 50052, 80, 443. and 51820.
"mydomain.com" is owned by me though I don't have any account for cme.zerossl.com or other services if that's required?

When I try to access the websites I get the error
"This site can’t provide a secure connection "mydomain.com" sent an invalid response."

Running curl -v I get

* Connected to dgenroll.mydomain.com (xx.xxx.xxx.xxx) port 443
* ALPN: curl offers h2,http/1.1
* (304) (OUT), TLS handshake, Client hello (1):
*  CAfile: /etc/ssl/cert.pem
*  CApath: none
* LibreSSL/3.3.6: error:1404B438:SSL routines:ST_CONNECT:tlsv1 alert internal error
* Closing connection
curl: (35) LibreSSL/3.3.6: error:1404B438:SSL routines:ST_CONNECT:tlsv1 alert internal error

Looking into the docker logs for caddy.
Note: The 1111111 and XXXXXX indicate redacted info.

`{"level":"error","ts":111111111.1111111111,"logger":"http.acme_client","msg":"challenge failed","identifier":"dgenroll.mydomain.com","challenge_type":"http-01","problem":{"type":"urn:ietf:params:acme:error:connection","title":"","detail":"<publicip redacted>: Fetching http://dgenroll.mydomain.com/.well-known/acme-challenge/XXXXXXXXXXXXXXX Timeout during connect (likely firewall problem)","instance":"","subproblems":[]}}
{"level":"error","ts":111111111.1111111111,"logger":"http.acme_client","msg":"validating authorization","identifier":"dgenroll.mydomain.com","problem":{"type":"urn:ietf:params:acme:error:connection","title":"","detail":"<publicip redacted>: Fetching http://dgenroll.mydomain.com/.well-known/acme-challenge/XXXXXXXXXXXXXXXXX Timeout during connect (likely firewall problem)","instance":"","subproblems":[]},"order":"https://acme-staging-v02.api.letsencrypt.org/acme/order/111111111111/11111111111","attempt":2,"max_attempts":3}
{"level":"error","ts":111111111.1111111111,"logger":"tls.obtain","msg":"could not get certificate from issuer","identifier":"dgenroll.mydomain.com","issuer":"acme-v02.api.letsencrypt.org-directory","error":"HTTP 400 urn:ietf:params:acme:error:connection - <publicip redacted>:: Fetching http://dgenroll.mydomain.com/.well-known/acme-challenge/XXXXXXXXXXXX: Timeout during connect (likely firewall problem)"}
{"level":"error","ts":1111111111.1111111111,"logger":"tls.obtain","msg":"could not get certificate from issuer","identifier":"dg.mydomain.com","issuer":"acme.zerossl.com-v2-DV90","error":"account pre-registration callback: failed getting EAB credentials: HTTP 422: caddy_legacy_user_removed (code 2977)"}
{"level":"error","ts":111111111.1111111111,"logger":"tls.obtain","msg":"will retry","error":"[dg.mydomain.com] Obtain: account pre-registration callback: failed getting EAB credentials: HTTP 422: caddy_legacy_user_removed (code 2977)","attempt":5,"retrying_in":600,"elapsed":702.27334234,"max_duration":2592000}
{"level":"warn","ts":111111111.1111111111,"logger":"http","msg":"missing email address for ZeroSSL; it is strongly recommended to set one for next time"}
{"level":"error","ts":111111111.1111111111,"logger":"tls.obtain","msg":"could not get certificate from issuer","identifier":"dgenroll.mydomain.com","issuer":"acme.zerossl.com-v2-DV90","error":"account pre-registration callback: failed getting EAB credentials: HTTP 422: caddy_legacy_user_removed (code 2977)"}
{"level":"error","ts":111111111.1111111111,"logger":"tls.obtain","msg":"will retry","error":"[dgenroll.mydomain.com] Obtain: account pre-registration callback: failed getting EAB credentials: HTTP 422: caddy_legacy_user_removed (code 2977)","attempt":5,"retrying_in":600,"elapsed":111111111.1111111111,"max_duration":2592000}

[rongitone]

It turns out it was a firewall issue. While the ports mentioned were open, inbound traffic to the dg.mydomain.com defguard server was only allowed from certain ip addresses. After removing the restriction the ssl registration process completed successfully.