Issue Description
Web servers that are on the UC Berkeley network and are Internet-facing may not be able to request certificates using the automated certificate management envrionment (ACME) protocol. Servers using the HTTP challenge method for certificate issuance to public CAs such as Let's Encrypt require that port 80 be open to present a challenge file to the CA. Even with port 80 open you may see errors such as "Connection reset by peer".
Workaround
- Ensure that your host is accessible over the Internet on both ports 80 and 443. Port 80 is required for the HTTP challenge.
- You may need to contact the team responsible for hosting your web server if you do not manage the hardware firewall yourself.
- Add the acme-protocol application to the Palo Alto firewall policy for your host. The rule should resemble the following:
The firewall attempts to detect the type of traffic going to your server. In some cases the firewall will detect and categorize traffic from the certificate authority to your server as non-standard web-browsing traffic based on the user agent or headers. It will then apply the application type of acme-protocol to the traffic.
To recreate the problem you can attempt to access your server's acme-challenge endpoint impersonating the Let's Encrypt CA:
curl -I -A "Mozilla/5.0 (compatible; Let's Encrypt validation server; + https://letsencrypt.org)" http://your_server.berkeley.edu/.well-known/acme-challenge/testfileIf you receive a response similar to the following it may indicate the firewall is blocking based on the application profile:
curl: (56) Recv failure: Connection reset by peer