Issue with certificate issuance (Challenge failed) – First steps with acme2certifier and openssl

[holgi003]

I am currently taking my first steps with acme2certifier and ran into an issue during the certificate issuance process.

My Setup: I am using the following test configuration:

#!/bin/bash

# Test Umgebung
TEST_DIR=/tmp/acme_test
rm -rf $TEST_DIR
mkdir -p $TEST_DIR/tmp $TEST_DIR/log $TEST_DIR/acme_srv/ca/certs $TEST_DIR/acme_srv/ca/db $TEST_DIR/acme_srv/ca/crl $TEST_DIR/acme_srv/ca/private $TEST_DIR/acme_srv/ca/root $TEST_DIR/acme_srv/acme_data

echo '''
# OpenSSL Configuration for demo.local PKI

[ default ]
dir             = $ENV::PKI_DIR         # Top dir
base_url        = http://pki.demo.local
ca_cert         = ca-cert.pem
ca_crl          = ca.crl
aia_url         = $base_url/$ca_cert
crl_url         = $base_url/$ca_crl
name_opt        = ca_default            # Display option
cert_opt        = ca_default            # Certificate display option
default_ca      = CA_default            # The default CA section

[ CA_default ]
dir             = $ENV::PKI_DIR         # Top dir
certs           = $dir/certs            # Where the issued certs are kept
crl_dir         = $dir/crl              # Where the issued crl are kept
database        = $dir/db/index.txt     # database index file.
unique_subject  = no                    # Set to 'no' to allow creation of
                                        # several certs with same subject.
new_certs_dir   = $dir/newcerts         # default place for new certs.
certificate     = $dir/root/ca-cert.pem      # The CA certificate
serial          = $dir/db/serial        # The current serial number
crlnumber       = $dir/db/crlnumber     # the current crl number
crl             = $dir/crl/ca.crl       # The current CRL
private_key     = $dir/private/ca-key.pem       # The private key
RANDFILE        = $dir/.rand            # private random number file

x509_extensions = v3_ca                 # The extentions to add to the cert
name_opt        = ca_default            # Subject Name options
cert_opt        = ca_default            # Certificate field options

default_days    = 3650                  # how long to certify for
default_crl_days= 30                    # how long before next CRL
default_md      = sha256                # use public key default MD
preserve        = no                    # keep passed DN ordering

policy          = policy_loose

[ policy_strict ]
countryName             = match
stateOrProvinceName     = match
organizationName        = match
organizationalUnitName  = optional
commonName              = supplied
emailAddress            = optional

[ policy_loose ]
countryName             = optional
stateOrProvinceName     = optional
localityName            = optional
organizationName        = optional
organizationalUnitName  = optional
commonName              = supplied
emailAddress            = optional

[ req ]
default_bits            = 2048
default_keyfile         = privkey.pem
distinguished_name      = req_distinguished_name
attributes              = req_attributes
x509_extensions         = v3_ca # The extentions to add to the self signed cert
string_mask             = utf8only

[ req_distinguished_name ]
countryName                     = Country Name (2 letter code)
countryName_default             = DE
countryName_min                 = 2
countryName_max                 = 2

stateOrProvinceName             = State or Province Name (full name)
stateOrProvinceName_default     = Sachsen

localityName                    = Locality Name (eg, city)
localityName_default            = Nossen

0.organizationName              = Organization Name (eg, company)
0.organizationName_default      = Demo

organizationalUnitName          = Organizational Unit Name (eg, section)
organizationalUnitName_default  = IT

commonName                      = Common Name (e.g. server FQDN or YOUR name)
commonName_max                  = 64

emailAddress                    = Email Address
emailAddress_max                = 64

[ req_attributes ]
challengePassword               = A challenge password
challengePassword_min           = 4
challengePassword_max           = 20

[ v3_ca ]
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer
basicConstraints = critical, CA:true
keyUsage = critical, digitalSignature, cRLSign, keyCertSign

[ v3_req ]
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
subjectAltName = @alt_names

[ v3_intermediate_ca ]
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer
basicConstraints = critical, CA:true, pathlen:0
keyUsage = critical, digitalSignature, cRLSign, keyCertSign

[ v3_server ]
basicConstraints = CA:FALSE
nsCertType = server
nsComment = "OpenSSL Generated Server Certificate"
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid,issuer:always
keyUsage = critical, digitalSignature, keyEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names

[ v3_client ]
basicConstraints = CA:FALSE
nsCertType = client, email
nsComment = "OpenSSL Generated Client Certificate"
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid,issuer
keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment
extendedKeyUsage = clientAuth, emailProtection

[ alt_names ]
DNS.1 = demo.local

''' > $TEST_DIR/acme_srv/ca/openssl.cnf


echo '''
[DEFAULT]
debug: False

[Nonce]
# disable nonce check. THIS IS A SEVERE SECURTIY ISSUE! Please do only for testing/debugging purposes
nonce_check_disable: False

[CAhandler]
# CA specific options
handler_file: examples/ca_handler/openssl_ca_handler.py
issuing_ca_key: acme_srv/ca/private/ca-key.pem
issuing_ca_key_passphrase: lop54y
issuing_ca_cert: acme_srv/ca/root/ca-cert.pem
issuing_ca_crl: acme_srv/ca/crl/ca.crl
cert_validity_days: 30
cert_validity_adjust: True
cert_save_path: acme_srv/ca/certs
ca_cert_chain_list: []
openssl_conf: acme_srv/ca/openssl.cnf
allowed_domainlist: ["test.demo.local", "\*.demo.local"]
save_cert_as_hex: True
cn_enforce: True
[DBhandler]
#dbfile: /var/lib/acme/db.sqlite3

[Certificate]
revocation_reason_check_disable: False

[Challenge]
# when true disable challenge validation. Challenge will be set to 'valid' without further checking
# THIS IS A SEVERE SECURTIY ISSUE! Please do only for testing/debugging purposes
challenge_validation_disable: False

[Order]
tnauthlist_support: False

''' > $TEST_DIR/acme_srv/acme_data/acme_srv_test.cfg

cd $TEST_DIR/acme_srv/ca
export PKI_DIR=$TEST_DIR/acme_srv/ca
openssl genrsa -aes256 -passout pass:xyz12345 -out $PKI_DIR/private/ca-key.pem 4096
openssl req -config $PKI_DIR/openssl.cnf \
    -key $PKI_DIR/private/ca-key.pem \
    -passin pass:xyz12345 \
    -new -x509 -days 3650 -sha256 -extensions v3_ca \
    -out $PKI_DIR/root/ca-cert.pem \
    -subj "/C=DE/ST=Sachsen/L=Nossen/O=Demo/OU=IT/CN=DEMO Root CA"

chmod a+r $PKI_DIR/private/ca-key.pem $PKI_DIR/root/ca-cert.pem

echo '''
services:
    acme2certifier:
        container_name: acme_server
        restart: unless-stopped
        ports:
            - 4000:80
        environment:
            - TZ=Europe/Berlin
            - PKI_DIR=/var/www/acme2certifier/acme_srv/ca/
        volumes:
            - type: bind
              source: ./acme_data
              target: /var/www/acme2certifier/volume/
            - type: bind
              source: ./ca
              target: /var/www/acme2certifier/acme_srv/ca/
        # image: grindsa/acme2certifier:latest
        image: grindsa/acme2certifier:nginx-wsgi
''' > $TEST_DIR/acme_srv/docker-compose.yml

cd $TEST_DIR/acme_srv
docker-compose up -d

cd $TEST_DIR/acme_srv
# certbot register --agree-tos -m admin@demo.local --server http://localhost:4000/directory --config-dir ./tmp  --work-dir ./tmp --logs-dir ./log
# certbot certonly --standalone -d test.demo.local --server http://localhost:4000/directory --config-dir ./tmp  --work-dir ./tmp --logs-dir ./log

What works: The registration call is successful:

_certbot register --agree-tos -m admin@demo.local --server http://localhost:4000/directory --config-dir ./tmp  --work-dir ./tmp --logs-dir ./log
Saving debug log to /private/tmp/acme_test/acme_srv/log/letsencrypt.log

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Would you be willing, once your first certificate is successfully issued, to
share your email address with the Electronic Frontier Foundation, a founding
partner of the Let's Encrypt project and the non-profit organization that
develops Certbot? We'd like to send you email about our work encrypting the web,
EFF news, campaigns, and ways to support digital freedom.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: y
Account registered._

The Issue: When I try to request a certificate using the following command:

_certbot certonly --standalone -d test.demo.local --server http://localhost:4000/directory --config-dir ./tmp  --work-dir ./tmp --logs-dir ./log
Saving debug log to /private/tmp/acme_test/acme_srv/log/letsencrypt.log
Requesting a certificate for test.demo.local

Certbot failed to authenticate some domains (authenticator: standalone). The Certificate Authority reported these problems:
Some challenges have failed.
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /private/tmp/acme_test/acme_srv/log/letsencrypt.log or re-run Certbot with -v for more details._

I receive a "Challenges have failed" error. It seems the CA cannot validate the domain ownership.

[grindsa]

Can you please enable debugging (debug = True in acme_srv.cfg) and either post the log or send it via email to grindelsack@gmail.com?

[holgi003]

Thank you for looking into this problem.
Please find the log and my acme_srv.cfg file attached.
acme_server_debug.log
acme_srv.cfg.txt

[grindsa]

Are you running a containerized environment? If so can you pls post the docker-compose.yml or the command-line you are using to start the container?

[holgi003]

Yes, I'm using your containers. My docker-compose.yml file is attached.
services:
acme2certifier:
container_name: acme_server
restart: unless-stopped
ports:
- 4000:80
environment:
- TZ=Europe/Berlin
- PKI_DIR=/var/www/acme2certifier/acme_srv/ca/
volumes:
- type: bind
source: ./acme_data
target: /var/www/acme2certifier/volume/
- type: bind
source: ./ca
target: /var/www/acme2certifier/acme_srv/ca/
# image: grindsa/acme2certifier:latest
image: grindsa/acme2certifier:nginx-wsgi

[grindsa]

Hi, sorry for the delay in answering but i am currently travelling on business. I am able to replicate your issue. Fix is underway...

[grindsa]

Hi,

the issue is caused by the escaping sequence used in the domain-list parameter:

allowed_domainlist: ["test.demo.local", "\*.demo.local"]

Unfortunately, the documentation was not updated after I changed the implementation, and the handler also did not properly handle the resulting parsing exception. I have now updated the handler to correctly catch and manage such errors.
Additionally, I noticed that the handler was unable to process single‑level CA hierarchies where the root CA directly issues the end-entity certificates. This has also been fixed.

You can test the corrections using the updated CA. It is sufficient to place the file in your acme_data volume and update the handler_file parameter accordingly.

Further please do not escape "*.demo.local" and I also recommend to remove the ca_cert_chain_list parameter from acme_srv.cfg as it is not required for your setup.

After additionally resolving some permission issues on the CA volume (acme2certifier requires write access to ca/certs and ca/crl), I was able to get your setup working with the following CA handler configuration:

CAhandler]
handler_file: /var/www/acme2certifier/volume/openssl_ca_handler.py
issuing_ca_key: acme_srv/ca/private/ca-key.pem
issuing_ca_key_passphrase: xyz12345
issuing_ca_cert: acme_srv/ca/root/ca-cert.pem
issuing_ca_crl: acme_srv/ca/crl/ca.crl
cert_validity_days: 30
cert_validity_adjust: True
cert_save_path: acme_srv/ca/certs
openssl_conf: acme_srv/ca/openssl.cnf
allowed_domainlist: ["test.demo.local", "*.demo.local"]
save_cert_as_hex: True
cn_enforce: True

Feel free to give it a try. Looking forward for your feedback.

/G.

[holgi003]

Hi,

Thank you for your effort.
Unfortunately, it's still not working for me.

make_local_test_acme_server.sh
Attached is my shell script, which creates my test environment (configs, certificate directories, etc.) in /tmp/acme_test.
Perhaps this will help you reproduce my problem.

[grindsa]

i will try to replicate the issue later today. If you have time can you please enable debugging and share the log?

Thx
/G.

[holgi003]

I found another typo.
I forgot a bracket in the acme_srv.cfg file [CAhandler].
I can now proceed; "certbot register .." is working.
However, I'm still getting an error when issuing the certificate.

The debug log is attached.
acme_server.log

[grindsa]

Hi,

I think the issue is related to your setup. a2c fails to connect to your client to resolve the http-challenge as test.demo.local cannot get resolved via DNS.

See the below extract in the logs.

Tue Feb 10 16:29:55.575892 2026] [wsgi:error] [pid 23:tid 281473650016544] Error resolving test.demo.local with type A: DNS query timeout for test.demo.local
[Tue Feb 10 16:29:55.582584 2026] [wsgi:error] [pid 23:tid 281473650016544] Error resolving test.demo.local with type AAAA: No AAAA record found for test.demo.local
[Tue Feb 10 16:29:55.582685 2026] [wsgi:error] [pid 23:tid 281473650016544] Helper._fqdn_resolve(test.demo.local) ended with: None, True, error: A: DNS query timeout for test.demo.local; AAAA: No AAAA record found for test.demo.local
[Tue Feb 10 16:29:55.582717 2026] [wsgi:error] [pid 23:tid 281473650016544] Helper.fqdn_resolve(test.demo.local) ended with: None, True, error: A: DNS query timeout for test.demo.local; AAAA: No AAAA record found for test.demo.local
[Tue Feb 10 16:29:55.582803 2026] [wsgi:error] [pid 23:tid 281473650016544] http-01 validation completed for NiuyRTaEVmTq: success=False, invalid=True, error={"status": 400, "type": "urn:ietf:params:acme:error:dns", "detail": "DNS resolution failed: A: DNS query timeout for test.demo.local; AAAA: No AAAA record found for test.demo.local"}
[Tue Feb 10 16:29:55.582902 2026] [wsgi:error] [pid 23:tid 281473650016544] ChallengeStateManager.transition_to_invalid(NiuyRTaEVmTq)
[Tue Feb 10 16:29:55.582972 2026] [wsgi:error] [pid 23:tid 281473650016544] DatabaseChallengeRepository.update_challenge(NiuyRTaEVmTq)
[Tue Feb 10 16:29:55.583014 2026] [wsgi:error] [pid 23:tid 281473650016544] DBStore.challenge_update({'name': 'NiuyRTaEVmTq', 'status': 'invalid', 'source': '192.168.65.1', 'validation_error': '{"status": 400, "type": "urn:ietf:params:acme:error:dns", "detail": "DNS resolution failed: A: DNS query timeout for test.demo.local; AAAA: No AAAA record found for test.demo.local"}'})
[Tue Feb 10 16:29:55.583057 2026] [wsgi:error] [pid 23:tid 281473650016544] DBStore._challenge_search(name, NiuyRTaEVmTq)

You should see a similar error in the certbot-logfile.

If you cannot fix the DNS resolution you can workaround this issue buy disabling challenge validation or configure pre-validated domains but depending on your environment this might lead to security issues.

[holgi003]

I switched from demo.local to my actual domain.
It seems to be working for now.
Thanks again for your help.
How can I send you a small donation?

[grindsa]

Glad to hear that you got it working.

Donations are alway welcome. Feel free to use one of the below links:

https://www.paypal.me/Gindsa
https://github.com/sponsors/grindsa

Thanks a lot for supporting my project!

/G