Using OpalStack's OpenSSL with Cloudflare's DNS

kptac

Received this notice:

Lets Encrypt failed to generate a certificate for your site: <site_name>. The site is served by a CDN which produced a redirect at the challenge URL.

How can we resolve this?

I do have a page rule setup in cloudflare:

.<domain>/.well-known/acme-challenge/
SSL: Off, Automatic HTTPS Rewrites: Off

But that didnt help either. Please advice.

Note: After disabling DNS proxy status for the domain from "Proxied" to "DNS Only". The certificate was generated.

sean

kptac we can't issue LE certs if you're doing HTTPS redirection upstream at Cloudflare because the the verification step is done over HTTP, not HTTPS.

To work around this turn off your HTTPS redirection at Cloudflare and turn it on for your site at Opalstack.

sean

kptac .<domain>/.well-known/acme-challenge/
SSL: Off, Automatic HTTPS Rewrites: Off

Did you have this rule set up for every domain and subdomain that's attached to the site at Opalstack?

kptac

I believe the best way is what you recommended earlier and install origin certificate from cloudflare. That's what I'll be doing in my case.

kptac

sean, had a similar situation with a new domain and cloudflare. I tried setting both rules, with domain.com and *.domain.com but LE failed to generate with this msg:

Lets Encrypt failed to generate a certificate for your site: <site_name>. The site is served by a CDN which produced a redirect at the challenge URL.

kptac

Yes, I have the rule as: *.<domain>/.well-known/acme-challenge/* setup for main domain and www.domain. Ideally, that should've taken care of it. Is it because I had "Redirect to https" ticked as well in sites settings which probably led to a redirect loop or something? not sure.

sean

kptac If your rule was for *.domain.com then you'll need a second rule for domain.com since we test every domain that's attached to the site.

kptac

sean oh my bad, I didn't realize it! I have run out of the free 3 page rules, so I generated an origin certificate from CF, which works well for now.

sean

kptac that's pretty weird, we do test <domain>/.well-known/acme-challenge/ for a redirect but if you have the page rule set up then it shouldn't redirect.

If this is still failing for you then please feel free to email support with the details, ie the domain and page rules, and we'll be happy to look into it further.

zgp

Hello sean - I've transferred a site from webfaction to Opalstack (thanks v much for your tools - so helpful!). The DNS goes through Cloudflare and it all seems to be working except that when I request a Lets Encrypt cert via the Opalstack site route after a few minutes I get the message:

Lets Encrypt failed to generate a certificate for your site: pweventhire. The site is served by a CDN which produced a redirect at the challenge URL.

At cloudflare I have turned off SSL / TLS encryption mode to see if that was getting in the way but this hasn't made a difference.

If you have any ideas about how to get the cert issued I'd really appreciate it? Thanks!

sean

zgp It's not the encryption mode that is the problem. The problem is that you have a page rule or something that redirects all requests to HTTPS.

We do the verification check over HTTP (since the site won't have a certificate yet) so if everything redirects to HTTPS we can't do that.

If that doesn't seem to be the case for you then please email support with the details (domain and site) and we'll look into it further.

zgp

sean Thanks Sean - I can't see any page rules or redirects anywhere. I will contact support to see if they can help - thank you!

rcoder

How's it now? I'm considering migrating all my domains to Cloudflare, but unable to find any documentation to understand how will it work with Opalstack.

I also have some applications hosted on subdomains, so I'm a bit concerned how will this work out.

Any pointers would be helpful.

peter

rcoder Here is how you can use our free Let's Encrypt certificates (with automatic renewal) while using Cloudflare:

1) At Cloudflare:

Under "SSL/TLS > Overview", set the SSL mode to "Full (strict)".
Under "SSL/TLS > Edge Certificates", set "Always Use HTTPS" to OFF. It needs to be off in order for SSL provisioning to work on our end.
Check under "Rules > Page Rules" to ensure that you have no SSL redirection rules set up there.

2) At Opalstack, you can enable SSL for a site as follows:

Go to https://my.opalstack.com/domains/.
Click the "Edit" icon for the desired site in the lower half of the page.
Ensure that the domains/subdomains attached to the site are already pointing to your Opalstack server (this is very important because otherwise our Let's Encrypt provisioning process will not work).
Activate the "Automatic Let's Encrypt™ Certificate?" and "Encrypt all traffic" options.
Click the "Update Site" button to save your changes, then allow a few minutes for the activation of the Let's Encrypt certificate.

rcoder

peter I'm following your instructions (including turning off "Always Use HTTPS" in Cloudflare), but I get this error when I'm trying to create a site with LetsEncrypt certificates.

Lets Encrypt failed to generate a certificate for your site: zenquest. The site is served by a CDN which produced a redirect at the challenge URL.

sean

rcoder The site is served by a CDN which produced a redirect at the challenge URL.

The error message means that Cloudflare is redirecting the request to HTTPS. If Cloudflare isn't behaving as configured then try toggling the setting, then wait a few minutes before you re-enable Let's Encrypt for the site.

If you need an immediate fix:

Change your Cloudflare SSL mode to "Full" instead of "Full (Strict)"
Edit your site in the lower section of https://my.opalstack.com/domains/ to turn Let's Encrypt **off* and select "Shared Gift Certificate" as the site certificate.

In this state your traffic will still be fully-encrypted, end-to-end, with the encryption on our end done via the shared certificate for opalstacked.com. The difference in the SSL mode is that without "strict" you can use any SSL certificate even if it is not keyed for your domain.

Your site visitors won't know the difference as that certificate is used for the traffic between Cloudflare and your Opalstack server, while Cloudflare manages a separate certificate on the front-end for your site visitors.

rcoder

sean The workaround helps. Just wondering why the mentioned "Full (strict)" approach using domain-specific LetsEncrypt certificates is failing here.

sean

rcoder not sure, I can follow up here after we've sorted it out in your ticket.

sean

rcoder Here's another workaround:

In Cloudflare, go to SSL/TLS > Origin Server.
Click the button to generate a new RSA origin certificate with a 15 year expiry.
In a new browser tab go to https://my.opalstack.com/certificates/.
Add a new certificate using the key and certificate generated in step 2.
Go to https://my.opalstack.com/domains/.
Click the Edit icon for your site.
Uncheck "Automatic Let's Encrypt™ Certificate?".
Select your new certificate from step 4 from the certificate list.
Click "Update Site" to save your changes.
Back in Cloudflare, set your SSL mode to "Full (strict)".

At that point everything should work as expected and you've have Cloudflare-trusted certificates throughout.

« Previous Page