如何修复“无法到达凭据服务器”错误的LetsEncrypt更新失败？

Question

我已经使用Windows 2012上安装的胜利者成功地获得了一个证书。该软件是建立更新使用Route53插件，以自动验证所有权通过DNS。Win-acme确实运行了更新任务，但失败时出错：

An error occurred during post-validation cleanup: Unable to reach credentials server

拒绝重新运行更新的选项后，将显示以下错误：

[EROR] Create certificate failed: Authorization failed: Error preparing for challenge answer

它看起来与AWS请求相关。我将IAM角色传递到命令行以及遵循这里指令的软件中。不确定这个角色应该是名字还是整个ARN，但我已经尝试过了。本期中的示例似乎只使用名称。

解除对.Net CLR的阻塞。

我还试图在Web_Config.xml文件中盲目地添加一个AWS配置文件，试图应用这个答案。这似乎不起作用。

我查过防火墙问题了。所有出站端口都已打开。

文档是稀疏的，但是我已经多次阅读和重新阅读了我所能挖掘到的所有内容，并且无法理解为什么会发生这个错误。

还试图搜索win问题(例如)。没有成功。

搜索Route53插件代码，看看是否能找到错误。没有成功。

回顾了此页上的问题，但没有引起注意。

有人能看到我可能错过了什么吗？我是不是遗漏了一些没有在文档中的AWS配置？

以下是Win-Acme日志的一部分。

2020-05-29 02:57:47.427 +00:00 [INF] No command line arguments provided
2020-05-29 02:57:47.497 +00:00 [INF] Software version 2.1.5.742 (RELEASE, PLUGGABLE) started
2020-05-29 02:57:47.499 +00:00 [INF] ACME server "https://acme-v02.api.letsencrypt.org/"
2020-05-29 02:57:47.970 +00:00 [INF] IIS version 8.0
2020-05-29 02:57:47.974 +00:00 [INF] Running with administrator credentials
2020-05-29 02:57:48.119 +00:00 [INF] Scheduled task looks healthy
2020-05-29 02:57:48.119 +00:00 [INF] Please report issues at https://github.com/win-acme/win-acme
2020-05-29 03:21:38.280 +00:00 [INF] Arguments: --validation route53 --validationmode dns-01 --route53iamrole MyRoleName --verbose
2020-05-29 03:21:38.318 +00:00 [DBG] Renewal period: 55 days
2020-05-29 03:21:38.328 +00:00 [INF] Software version 2.1.5.742 (RELEASE, PLUGGABLE) started
2020-05-29 03:21:38.329 +00:00 [INF] ACME server "https://acme-v02.api.letsencrypt.org/"
2020-05-29 03:21:38.340 +00:00 [VRB] SecurityProtocol setting: "SystemDefault"
2020-05-29 03:21:38.736 +00:00 [DBG] Connection OK!
2020-05-29 03:21:38.739 +00:00 [INF] IIS version 8.0
2020-05-29 03:21:38.744 +00:00 [INF] Running with administrator credentials
2020-05-29 03:21:38.797 +00:00 [INF] Scheduled task looks healthy
2020-05-29 03:21:38.798 +00:00 [INF] Please report issues at https://github.com/win-acme/win-acme
2020-05-29 03:21:38.799 +00:00 [VRB] Test for international support: 語言 язык لغة
2020-05-29 03:22:11.633 +00:00 [INF] Running in mode: "Interactive, Advanced"
2020-05-29 03:22:26.213 +00:00 [INF] Target generated using plugin Manual: *.mydomain.com
2020-05-29 03:23:32.456 +00:00 [VRB] Adding 8.8.8.8 as DNS server
2020-05-29 03:23:32.457 +00:00 [VRB] Adding 1.1.1.1 as DNS server
2020-05-29 03:23:32.458 +00:00 [VRB] Adding 8.8.4.4 as DNS server
2020-05-29 03:24:16.362 +00:00 [VRB] Checking *.mydomain.com
2020-05-29 03:24:16.367 +00:00 [VRB] Creating certificate order for hosts: ["*.mydomain.com"]
2020-05-29 03:24:16.376 +00:00 [VRB] Loading ACME account signer...
2020-05-29 03:24:16.378 +00:00 [DBG] Loading signer from C:\ProgramData\win-acme\acme-v02.api.letsencrypt.org\Signer_v2
2020-05-29 03:24:16.432 +00:00 [VRB] Constructing ACME protocol client...
2020-05-29 03:24:16.439 +00:00 [DBG] Send GET request to "https://acme-v02.api.letsencrypt.org/directory"
2020-05-29 03:24:16.766 +00:00 [VRB] Request completed with status "OK"
2020-05-29 03:24:16.797 +00:00 [DBG] Send HEAD request to "https://acme-v02.api.letsencrypt.org/acme/new-nonce"
2020-05-29 03:24:16.914 +00:00 [VRB] Request completed with status "OK"
2020-05-29 03:24:16.922 +00:00 [DBG] Loading account information from C:\ProgramData\win-acme\acme-v02.api.letsencrypt.org\Registration_v2
2020-05-29 03:24:16.999 +00:00 [DBG] Send POST request to "https://acme-v02.api.letsencrypt.org/acme/new-order"
2020-05-29 03:24:17.245 +00:00 [VRB] Request completed with status "Created"
2020-05-29 03:24:17.258 +00:00 [VRB] Order https://acme-v02.api.letsencrypt.org/acme/order/816*****/354******* created
2020-05-29 03:24:17.259 +00:00 [VRB] Handle authorization 1/2
2020-05-29 03:24:17.262 +00:00 [DBG] Send POST request to "https://acme-v02.api.letsencrypt.org/acme/authz-v3/487*******"
2020-05-29 03:24:17.506 +00:00 [VRB] Request completed with status "OK"
2020-05-29 03:24:17.521 +00:00 [INF] Authorize identifier: mydomain.com
2020-05-29 03:24:17.523 +00:00 [VRB] Challenge types available: ["dns-01"]
2020-05-29 03:24:17.670 +00:00 [INF] Authorizing mydomain.com using dns-01 validation (Route53)
2020-05-29 03:24:18.030 +00:00 [ERR] Error preparing for challenge answer
Amazon.Runtime.AmazonServiceException: Unable to reach credentials server
 ---> System.Net.Http.HttpRequestException: Response status code does not indicate success: 404 (Not Found).
 ---> System.Net.Http.HttpRequestException: Response status code does not indicate success: 404 (Not Found).
   at System.Net.Http.HttpResponseMessage.EnsureSuccessStatusCode()
   at Amazon.Util.AWSSDKUtils.ExecuteHttpRequest(Uri uri, String requestType, String content, TimeSpan timeout, IWebProxy proxy, IDictionary`2 headers)
   --- End of inner exception stack trace ---
   at Amazon.Util.AWSSDKUtils.ExecuteHttpRequest(Uri uri, String requestType, String content, TimeSpan timeout, IWebProxy proxy, IDictionary`2 headers)
   at Amazon.Runtime.URIBasedRefreshingCredentialHelper.GetContents(Uri uri, IWebProxy proxy, Dictionary`2 headers)

编辑2:我最近为letsencrypt.org添加了一个带有问题标记的CAA记录到Route53中。还是同样的错误。

Answer 1

编辑:我的iam角色没有附加到我的ec2实例:)

我在使用iam角色时也遇到了同样的问题。创建用户并使用访问密钥/秘密访问密钥工作。

wacs -目标iis -siteid N -emailaddress X@X.X -validation installation iis -installationsiteid N -存储证书-验证route53 -验证模式dns-01 -route53Accesskeyid XXXX -route53actaccess dns XXXX

政策烫伤

53线: GetChange

53线: ListHostedZones

53线: ChangeResourceRecordSets

在命令行中使用这些可能不太好，但这似乎是后面的一个问题。