We use pfSense as a firewall on our servers facing the web. When we try to renew our Certificates with Certify The Web and Let’s Encrypt, it fails saying it couldn’t verify us. We host our DNS on Cloudfare and tried verifying the DNS as well as doing http verifications. Everything failed. We hired a guy who has hundreds of Certify The Web systems running. He couldn’t figure it out.
What we did find is that if we bypass pfSense it works so we know it’s something related to pfSense but what? Port 80 is open to those IPs. I need help.
I tried to find a list of Certify the Web IPs to help hunt down the problem but was told that there is no list and they don’t their list of IPs available.
Obviously if it would verify with Cloudflare that would be the best. It passes the test but then fails on the renewal.
Hi Jerry,
I can’t comment on how pfSense works but usually failures are straightforward connectivity problems and the log will tell you more or less where the problem is, so a log would really help diagnose.
HTTP validation requires that you allow incoming TCP port 80 requests - that sounds obvious but can often be surprisingly tricky especially when third party security products try to help. Certify will attempt to starts its own HTTP listener via http.sys that sits in front of IIS etc and for most users that will work to answer http challenges. Port 80 needs to be open on the windows firewall, any AV/Security exclusions that are applicable to your security products need to be applied to allow that listener (certify.exe) to listen.
DNS Validation is available if HTTP validation can’t work (because their is no HTTP route to the server). DNS validation works by creating an _acme-challenge TXT record in your DNS zone for each domain/subdomain so any conflicting records with that name need to be removed first.
If you have specific error messages we can help diagnose further.
What would a conflicting record in DNS look like? And if it conflicted with one domain would it just prevent the renewal on that certificate or would it abort all the renewals?
On the domain listed in the error, I don’t see any abnormal entries in DNS.
I do see a list of about 2 dozen DNS entries listed under one of my other domain names however. There are a couple dozen “_acme-challenge.mail.insertdomainhere” entries in it’s DNS. Do those all need to be deleted?
We found a work-around. We had tried doing DNS verification but it kept failing. It turns out that Certify the web had created a DNS entry but then just left it there. So when it came back to renew it was creating a new entry but reading the old one? We deleted all their DNS entries (37 of them) and it passed. So we won’t need to do the http verification which means we don’t need it to find it’s way past pfSense.
While this doesn’t solve the pfSense question, it does solve our problem so I’m going to move on.
Thanks for raising that issue, our cloudflare DNS integration is pretty mature so I’m surprised it left some records. Glad you got it sorted.