[ACME] Too many currently pending authorizations #905
Comments
|
Which version of traefik are you running? (Just curious) |
I assume it's 1.1.0 as you store certs in Consul, right? |
|
Hi, Sorry, I forgot to mention, I'm indeed running containous/traefik:v1.1.0. |
|
It seems some of my certificates were generated, the limits must have expired, but the problem might still present. I don't get this all the time (I didn't have it when I initially posted the issue, but have had before), but have it now and keeps logging every few minutes. |
|
Any way I can help you track down this bug? This morning, all my remaining certificates were signed, so I started adding new services, but the same problem occurred again... :( I've done two things to my Traefik:
Traefik then logged: And only a few minutes later: On my end, both jira.something.com and jira.something2.com have valid certificates. |
|
@Mika56 1/ 2/ Duplicate certificates |
|
The issue you mentioned was closed a few days ago, but with no fix, shouldn't you reopen it? |
|
@Mika56 Please read entirely the issue ;) This is due to using the same account with prod/staging LE. |
|
Sorry, I didn't understand that when I first read it. Anyway, I'm not sure if I'm concerned, I'm not sure but I don't think I've used the same private key in the staging environment, plus I was able to generate some certificates... |
I know, me too :'(
Remove your account info. Yes, sadly, you will have to generate your cert again. This is really bad that LE allows to use the same key from staging to production and then produce some random errors... |
|
Any way to force Traefik to generate certificates in a given order? If I have to regenerate all my certificates, I'll hit many limits, and while I can disable automatic generation with |
|
I suggest to backup all your ACME config first (account + certs). Then you can generate a new account (deleting ACME your account in traefik config). Then delete your cert 5 by 5 (to avoid rate limiting) and force the generation of new certificates in traefik ACME config filling |
|
Fixed by #972 |
|
Hmm I'm still getting the I've got the following in my |
|
@Mika56 how did you solve |
|
I did not, my Traefik instances keep screaming that error, LE only renews certificates when I restart the service |
Hi,
I'm migrating my infrastructure to Docker. I was running an Apache server on one virtual machine, with only a few websites protected with TLS.
I'm now running Traefik in a Docker Swarm cluster composed of three hosts, and want to go full TLS (Let's Encrypt).
At first it worked correctly, but now it seems to be behaving oddly.
My Traefik gets its configuration from Consul, and stores the ACME certificates there too.
acme/onDemandused to be set totrue, but I've now set it tofalse.Even with
onDemandset tofalse, my log file keeps growing, with these messages:So, obviously, Traefik is trying to get new certificates, but too much authorizations are pending.
I've opened Consul and read my
acme/account/objectvalue, which is where things gets odd:{ "Email":"...", "Registration":{ "body":{ "resource":"reg", "id":0000, "key":{ "kty":"RSA", "n":"...", "e":"AQAB" }, "contact":[ "mailto:..." ], "agreement":"https://letsencrypt.org/documents/LE-SA-v1.1.1-August-1-2016.pdf" }, "uri":"https://acme-v01.api.letsencrypt.org/acme/reg/0000", "new_authzr_uri":"https://acme-v01.api.letsencrypt.org/acme/new-authz", "terms_of_service":"https://letsencrypt.org/documents/LE-SA-v1.1.1-August-1-2016.pdf" }, "PrivateKey":"...", "DomainsCertificate":{ "Certs":[ { "Domains":{ "Main":"stash.something2.com", "SANs":null }, "Certificate":{ "Domain":"stash.something2.com", "CertURL":"https://acme-v01.api.letsencrypt.org/acme/cert/...", "CertStableURL":"", "PrivateKey":"...", "Certificate":"..." } }, { "Domains":{ "Main":"stash.something2.com", "SANs":[ "bitbucket.something2.com" ] }, "Certificate":{ "Domain":"stash.something2.com", "CertURL":"https://acme-v01.api.letsencrypt.org/acme/cert/...", "CertStableURL":"", "PrivateKey":"...", "Certificate":"..." } }, { "Domains":{ "Main":"confluence.something2.com", "SANs":null }, "Certificate":{ "Domain":"confluence.something2.com", "CertURL":"https://acme-v01.api.letsencrypt.org/acme/cert/...", "CertStableURL":"", "PrivateKey":"...", "Certificate":"..." } }, { "Domains":{ "Main":"jira.something2.com", "SANs":null }, "Certificate":{ "Domain":"jira.something2.com", "CertURL":"https://acme-v01.api.letsencrypt.org/acme/cert/...", "CertStableURL":"", "PrivateKey":"...", "Certificate":"..." } }, { "Domains":{ "Main":"confluence.something2.com", "SANs":null }, "Certificate":{ "Domain":"confluence.something2.com", "CertURL":"https://acme-v01.api.letsencrypt.org/acme/cert/...", "CertStableURL":"", "PrivateKey":"...", "Certificate":"..." } }, { "Domains":{ "Main":"prtg.something1.com", "SANs":null }, "Certificate":{ "Domain":"prtg.something1.com", "CertURL":"https://acme-v01.api.letsencrypt.org/acme/cert/...", "CertStableURL":"", "PrivateKey":"...", "Certificate":"..." } }, { "Domains":{ "Main":"prtg.something1.com", "SANs":null }, "Certificate":{ "Domain":"prtg.something1.com", "CertURL":"https://acme-v01.api.letsencrypt.org/acme/cert/...", "CertStableURL":"", "PrivateKey":"...", "Certificate":"..." } }, { "Domains":{ "Main":"prtg.something1.com", "SANs":null }, "Certificate":{ "Domain":"prtg.something1.com", "CertURL":"https://acme-v01.api.letsencrypt.org/acme/cert/...", "CertStableURL":"", "PrivateKey":"...", "Certificate":"..." } }, { "Domains":{ "Main":"prtg.something1.com", "SANs":null }, "Certificate":{ "Domain":"prtg.something1.com", "CertURL":"https://acme-v01.api.letsencrypt.org/acme/cert/...", "CertStableURL":"", "PrivateKey":"...", "Certificate":"..." } }, { "Domains":{ "Main":"stats.something1.com", "SANs":null }, "Certificate":{ "Domain":"stats.something1.com", "CertURL":"https://acme-v01.api.letsencrypt.org/acme/cert/...", "CertStableURL":"", "PrivateKey":"...", "Certificate":"..." } }, { "Domains":{ "Main":"stats.something1.com", "SANs":null }, "Certificate":{ "Domain":"stats.something1.com", "CertURL":"https://acme-v01.api.letsencrypt.org/acme/cert/...", "CertStableURL":"", "PrivateKey":"...", "Certificate":"..." } }, { "Domains":{ "Main":"stats.something1.com", "SANs":null }, "Certificate":{ "Domain":"stats.something1.com", "CertURL":"https://acme-v01.api.letsencrypt.org/acme/cert/...", "CertStableURL":"", "PrivateKey":"...", "Certificate":"..." } }, { "Domains":{ "Main":"stats.something1.com", "SANs":null }, "Certificate":{ "Domain":"stats.something1.com", "CertURL":"https://acme-v01.api.letsencrypt.org/acme/cert/...", "CertStableURL":"", "PrivateKey":"...", "Certificate":"..." } }, { "Domains":{ "Main":"glados.something1.com", "SANs":null }, "Certificate":{ "Domain":"glados.something1.com", "CertURL":"https://acme-v01.api.letsencrypt.org/acme/cert/...", "CertStableURL":"", "PrivateKey":"...", "Certificate":"..." } }, { "Domains":{ "Main":"glados.something1.com", "SANs":null }, "Certificate":{ "Domain":"glados.something1.com", "CertURL":"https://acme-v01.api.letsencrypt.org/acme/cert/...", "CertStableURL":"", "PrivateKey":"...", "Certificate":"..." } }, { "Domains":{ "Main":"glados.something1.com", "SANs":null }, "Certificate":{ "Domain":"glados.something1.com", "CertURL":"https://acme-v01.api.letsencrypt.org/acme/cert/...", "CertStableURL":"", "PrivateKey":"...", "Certificate":"..." } }, { "Domains":{ "Main":"glados.something1.com", "SANs":null }, "Certificate":{ "Domain":"glados.something1.com", "CertURL":"https://acme-v01.api.letsencrypt.org/acme/cert/...", "CertStableURL":"", "PrivateKey":"...", "Certificate":"..." } } ] }, "ChallengeCerts":{ "bitbucket.something2.com":{ "Certificate":"...", "PrivateKey":"..." }, "confluence.something2.com":{ "Certificate":"...", "PrivateKey":"..." }, "jira.something2.com":{ "Certificate":"...", "PrivateKey":"..." }, "prtg.something2.com":{ "Certificate":"...", "PrivateKey":"..." }, "stash.something2.com":{ "Certificate":"...", "PrivateKey":"..." }, "stash.something1.com":{ "Certificate":"...", "PrivateKey":"..." }, "stats.something2.com":{ "Certificate":"...", "PrivateKey":"..." } } }It seems to me that I have multiple times the same certificates under
DomainsCertificate.However, some of the domains that are multiple times works, while some others don't.
I've also extracted one of the non-working certificate, and analysed it. It seems to me everything should work properly?
So, my questions are:
DomainsCertificate(at least the same name, I haven't compared the certificates themselves)?acme/account/objectvalue to remove incorrect certificates?The text was updated successfully, but these errors were encountered: