certs not being issued

1

hey :wave:

I believe I had this problem before but somehow it was working before and now it is not…

Yesterday I noticed that my certificate expired but it wasn’t automatically renewed (I could swear it would be renewed but it didn’t). I then deleted it and recreated and is now stuck in the “has not been issued yet” state

this is the output of fly certs

❯ fly certs show 'sumiu.link'
The certificate for sumiu.link has not been issued yet.

Hostname                  = sumiu.link
DNS Provider              = cloudflare
Certificate Authority     = Let's Encrypt
Issued                    =
Added to App              = 3 minutes ago
Source                    = fly
A Record (104.21.6.27) does not match app's IP (66.241.125.142)
AAAA Record (2606:4700:3030::ac43:9a99) does not match app's IP (2a09:8280:1::3:c161)
Address resolution (104.21.6.27) does not match app's IP (66.241.125.142/2a09:8280:1::3:c161)
Address resolution (172.67.154.153) does not match app's IP (66.241.125.142/2a09:8280:1::3:c161)
Address resolution (2606:4700:3030::ac43:9a99) does not match app's IP (66.241.125.142/2a09:8280:1::3:c161)
Address resolution (2606:4700:3033::6815:61b) does not match app's IP (66.241.125.142/2a09:8280:1::3:c161)
You are creating a certificate for sumiu.link
We are using lets_encrypt for this certificate.

You can direct traffic to sumiu.link by:

1: Adding an A record to your DNS service which reads

    A @ 66.241.125.142

You can validate your ownership of sumiu.link by:

2: Adding an AAAA record to your DNS service which reads:

    AAAA @ 2a09:8280:1::3:c161

but in cloudflare, everything is configured as it always was, I haven’t touched it in a long time:

image
image2798×514 52.4 KB

on top of that, I noticed a lot of instability in the API since last night, couldn’t login, use the CLI, update/delete certs, etc but the status page didn’t change.

any idea what is going on?

2

The “does not match app’s IP” errors are correct. When you have the “orange cloud” enabled, Cloudflare replaces your IP addresses with their own. You need to disable that, at least for the _acme-challenge domain.

I don’t see an increase in API errors on our end, can you share the error messages / IDs you got?

1 Like
3

That did the trick…I’ve never had to do this in the past but yeah it makes total sense. Thanks a lot!

regarding the errors, I don’t have any request id, it happened last night and I don’t see it anymore but I will keep an eye on it

Thanks again for helping me solve the mystery!

4

This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.