laravel - 无法续订 Let's Encrypt SSL

Question

我第一次轻松安装了 SSL 证书，但我无法更新它。

我计划终端命令每月自动更新证书，但它响应错误。手动运行时我也得到相同的响应。

终端命令

curl -X POST https://forge.laravel.com/api/servers/<serverNumber>/sites/<siteNumber>/ssl/renew?api_token=<my-token>

响应

Cloning into 'letsencrypt1462928414'...
nginx stop/waiting
nginx start/running, process 10734
# INFO: Using main config file /root/letsencrypt1462928414/config.sh
+ Generating account key...
+ Registering account key with letsencrypt...
Processing donniebrandt.com with alternative names: www.donniebrandt.com
 + Signing domains...
 + Creating new directory /root/letsencrypt1462928414/certs/donniebrandt.com ...
 + Generating private key...
 + Generating signing request...
 + Requesting challenge for donniebrandt.com...
 + Requesting challenge for www.donniebrandt.com...
 + Responding to challenge for donniebrandt.com...
ERROR: Challenge is invalid! (returned: invalid) (result: {"type":"http-01","status":"invalid","error":{"type":"urn:acme:error:unauthorized","detail":"Invalid response from http://donniebrandt.com/.well-known/acme-challenge/JdG5PtzEcqZMMDVhx2VNN5Wmvldwtl84B6q3j1AQcP0 [104.18.50.184]: 526"},"uri":"https://acme-v01.api.letsencrypt.org/acme/challenge/S6oIx5ZFyzu80fkpjoCcAgVDp7p8aLo6UGLLt7flP-g/81801388","token":"JdG5PtzEcqZMMDVhx2VNN5Wmvldwtl84B6q3j1AQcP0","keyAuthorization":"JdG5PtzEcqZMMDVhx2VNN5Wmvldwtl84B6q3j1AQcP0.0N_sDHF2rXqfyPHGi4ZmXDAkrmwbMJ-S_ZghYPtSN2g","validationRecord":[{"url":"http://donniebrandt.com/.well-known/acme-challenge/JdG5PtzEcqZMMDVhx2VNN5Wmvldwtl84B6q3j1AQcP0","hostname":"donniebrandt.com","port":"80","addressesResolved":["104.18.50.184","104.18.51.184"],"addressUsed":"104.18.50.184"},{"url":"https://donniebrandt.com/.well-known/acme-challenge/JdG5PtzEcqZMMDVhx2VNN5Wmvldwtl84B6q3j1AQcP0","hostname":"donniebrandt.com","port":"443","addressesResolved":["104.18.50.184","104.18.51.184"],"addressUsed":"104.18.50.184"}]})

我还验证了 .well-known/acme-challenge 目录存在，但它并没有改变错误。

Answer 1

错误消息显示您的网站对于其中一个域是离线的:

ERROR: [...]"Invalid response from http://donniebrandt.com/[...]526"},[...]

尝试访问http://donniebrandt.com您将收到错误 526(无效的 SSL 证书)。

作为云服务 states :

The HTTP Error Response Code 526 occurs when CloudFlare is unable to successfully validate the SSL certificate on the origin web server and the CloudFlare SSL configuration on the website is set to "Full SSL (Strict)".

换句话说，您在服务器前面设置的 CDN 尝试通过 HTTPS 访问您的服务器，但是您的 SSL 证书无效(可能已过期或 Cloudfare CDN 不信任根 CA)。 因此 Cloudfare 不会从您的服务器获取内容。

我不熟悉 Cloudfare，但您可以执行以下操作之一:

• 在您续订证书之前，在 cloudfare 中禁用临时严格的 SSL，下次在证书过期之前续订，这样就无需再次禁用它。
• 暂时将您的 DNS 直接重定向到您的服务器而不是 CDN，更新证书并再次重定向。这里的缺点是 DNS 传播可能需要一些时间，并且您将在很长一段时间内失去 CDN 的优势，具体取决于 DNS 设置。

既然你说你第一次让 SSL 工作，我假设 Cloudfare 信任 LetsEncrypt(否则它不会第一次工作)。但是值得一试。