Getting "/.well-known/acme-challenge/*" request every 10secs

Questions / Help
1

When I add a certificate the HTTPS connection works (https://www.sharepad.de) but from now on I get the following error every 10secs:

2024-03-27T18:01:12.161 app[3d8dd1ef19e038] ams [info] INFO: 172.16.153.218:47578 - "GET /.well-known/acme-challenge/HwhCni3z3HrUQb9tPyz2jjgk-9RX7tANlwoNlq_zlQg HTTP/1.1" 404 Not Found
2024-03-27T18:01:22.244 app[3d8dd1ef19e038] ams [info] INFO: 172.16.153.218:52918 - "GET /.well-known/acme-challenge/HwhCni3z3HrUQb9tPyz2jjgk-9RX7tANlwoNlq_zlQg HTTP/1.1" 404 Not Found

When removing the certificate I also get no more requests.

When looking into the certificate via UI I see the following error message:

Error when resolving hostname _acme-challenge.www.sharepad.de with target www.sharepad.de.kyegyg.flydns.net
2

Hey @mrh1997

/.well-known/acme-challenge/<token> requests look like LetsEncrypt HTTP-01 challenge, which we don’t do.

Fly uses either TLS-ALPN-01 challenge (handled transparently by fly-proxy) or DNS-01 challenge, for which you need to setup the _acme-challenge CNAME record.

So looks like something else is trying to issue a certificate for this domain using HTTP-01 challenge.

3

I have the same problem. Every ~10 seconds waarisdekermis.nl is receiving a GET /.well-known/acme-challenge/... request.

Everythin is green in the certificates section in the dashboard. I’m running a simple Remix app with a Supabase backend. Any idea what could send these requests?

4

@pavel : I am pretty sure that this problem comes from fly.io for two reasons:

  1. When removing the certificate via “fly certs remove” the regular requests stop
  2. In the Fly Dashboard (!) I get the following error message:
    grafik
    grafik957×308 41.4 KB
5

@mrh1997

  1. When removing the certificate via “fly certs remove” the regular requests stop

That’s right. If you remove the certificate, fly-proxy no longer has a record that www.sharepad.de belongs to your app. Since you are using shared IPv4 there is no way for fly-proxy to know how to route requests for this domain name over IPv4 (since multiple apps share the same IPv4 address) so they get dropped. Dedicate IPv4/IPv6 should continue to work, though.

In the Fly Dashboard (!) I get the following error message:

Yes, this is only required for DNS-01 LetsEncrypt challenge. For example, if you want to assign a custom domain name before you even deploy your app for the first time. By creating this CNAME, you prove that you own the domain name and LetsEncrypt can issue a certificate. If the app is already deployed (like in your case), fly-proxy handles TLS-ALPN-01 LetsEncrypt challenge transparently without any additional configuration.

6

This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.