Error getting directory

[Snkfear]

Hello,

I'm trying to use the vib but it always crashes and the issue is that it can't find the directory... what am I doing wrong?

[root@gestion:~] /etc/init.d/w2c-letsencrypt start

Running 'start' action
Starting certificate renewal.
Existing cert issued for localhost.home but current domain name is gestion.myweb.com. Requesting a new one!
Generating RSA private key, 4096 bit long modulus
*********************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************++++
************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************++++
e is 65537 (0x10001)
Serving HTTP on 0.0.0.0 port 8120 ...
Parsing account key...
Parsing CSR...
Found domains: gestion.myweb.com
Getting directory...
Traceback (most recent call last):
File "./acme_tiny.py", line 199, in
main(sys.argv[1:])
File "./acme_tiny.py", line 195, in main
signed_crt = get_crt(args.account_key, args.csr, args.acme_dir, log=LOGGER, CA=args.ca, disable_check=args.disable_check, directory_url=args.directory_url, contact=args.contact, check_port=args.check_port)
File "./acme_tiny.py", line 105, in get_crt
directory, _, _ = _do_request(directory_url, err_msg="Error getting directory")
File "./acme_tiny.py", line 46, in _do_request
raise ValueError("{0}:\nUrl: {1}\nData: {2}\nResponse Code: {3}\nResponse: {4}".format(err_msg, url, data, code, resp_data))
ValueError: Error getting directory:
Url: https://acme-v02.api.letsencrypt.org/directory
Data: None
Response Code: None
Response: <urlopen error [Errno -3] Temporary failure in name resolution>
Warning: No cert obtained from Let's Encrypt. Keeping the existing one as it is still valid.
watchdog-esxapiadapter: PID file /var/run/vmware/watchdog-esxapiadapter.PID does not exist
watchdog-esxapiadapter: Unable to terminate watchdog: No running watchdog process for esxapiadapter
sh: you need to specify whom to kill
esxapiadapter: EsxApiAdapter feature switch not enabled
logger: invalid option -- 'n'
BusyBox v1.29.3 (2019-08-06 16:32:32 PDT) multi-call binary.

Usage: logger [OPTIONS] [MESSAGE]

Write MESSAGE (or stdin) to syslog

    -s      Log to stderr as well as the system log
    -t TAG  Log using the specified tag (defaults to user name)
    -p PRIO Priority (numeric or facility.level pair)

logger: invalid option -- 'n'
BusyBox v1.29.3 (2019-08-06 16:32:32 PDT) multi-call binary.

Usage: logger [OPTIONS] [MESSAGE]

Write MESSAGE (or stdin) to syslog

    -s      Log to stderr as well as the system log
    -t TAG  Log using the specified tag (defaults to user name)
    -p PRIO Priority (numeric or facility.level pair)

gstored is not running.
hostd signalled.
watchdog-lsud: Terminating watchdog process with PID 276641
lsud stopped
lsud started
VMware HTTP reverse proxy signalled.
sfcbd-init: Getting Exclusive access, please wait...
sfcbd-init: Exclusive access granted.
sfcbd-init: sfcbd is not running.
logger: invalid option -- 'n'
BusyBox v1.29.3 (2019-08-06 16:32:32 PDT) multi-call binary.

Usage: logger [OPTIONS] [MESSAGE]

Write MESSAGE (or stdin) to syslog

    -s      Log to stderr as well as the system log
    -t TAG  Log using the specified tag (defaults to user name)
    -p PRIO Priority (numeric or facility.level pair)

logger: invalid option -- 'n'
BusyBox v1.29.3 (2019-08-06 16:32:32 PDT) multi-call binary.

Usage: logger [OPTIONS] [MESSAGE]

Write MESSAGE (or stdin) to syslog

    -s      Log to stderr as well as the system log
    -t TAG  Log using the specified tag (defaults to user name)
    -p PRIO Priority (numeric or facility.level pair)

vpxa signalled.
vsanperfsvc is not running.
/etc/init.d/vvold ssl_reset, PID 277162
vvold is not running.

[Churro]

You are attempting to issue a certificate for gestion.myweb.com, which does not resolve to an Internet-reachable IP address - in fact, it resolves to no IP address at all.

[Snkfear]

You are attempting to issue a certificate for gestion.myweb.com, which does not resolve to an Internet-reachable IP address - in fact, it resolves to no IP address at all.

I've modified the web in the paste, the real one is reachable and resolves to an ip address without issue.

[Churro]

Response: <urlopen error [Errno -3] Temporary failure in name resolution> hints about a DNS resolution error. You could try to ping acme-v02.api.letsencrypt.org and see if it resolves. If not, I'd suggest checking the DNS settings in ESXi.

[Snkfear]

You were right! My DNS server was offline 🤦‍♂️

I changed the DNS servers and it worked but gave me another error:

127.0.0.1 - - [14/Feb/2025 12:50:52] "GET /.well-known/acme-challenge/qNNm-bGQ5q70HBvBNELffRskI8hSCtqBNdKsPAU07Ag HTTP/1.1" 200 -
Traceback (most recent call last):
File "./acme_tiny.py", line 199, in
main(sys.argv[1:])
File "./acme_tiny.py", line 195, in main
signed_crt = get_crt(args.account_key, args.csr, args.acme_dir, log=LOGGER, CA=args.ca, disable_check=args.disable_check, directory_url=args.directory_url, contact=args.contact, check_port=args.check_port)
File "./acme_tiny.py", line 153, in get_crt
raise ValueError("Challenge did not pass for {0}: {1}".format(domain, authorization))
ValueError: Challenge did not pass for gestion.mydomain.com: {'identifier': {'type': 'dns', 'value': 'gestion.mydomain.com'}, 'expires': '2025-02-21T12:57:06Z', 'challenges': [{'type': 'http-01', 'url': 'https://acme-v02.api.letsencrypt.org/acme/chall/2228621045/475865333065/-vf7NQ', 'error': {'detail': '188.26.202.113: Fetching https://gestion.mydomain.com/.well-known/acme-challenge/qNNm-bGQ5q70HBvBNELffRskI8hSCtqBNdKsPAU07Ag: Timeout during connect (likely firewall problem)', 'type': 'urn:ietf:params:acme:error:connection', 'status': 400}, 'validationRecord': [{'addressesResolved': ['188.26.202.113'], 'url': 'http://gestion.mydomain.com/.well-known/acme-challenge/qNNm-bGQ5q70HBvBNELffRskI8hSCtqBNdKsPAU07Ag', 'port': '80', 'addressUsed': '188.26.202.113', 'hostname': 'gestion.mydomain.com'}, {'addressesResolved': ['188.26.202.113'], 'url': 'https://gestion.mydomain.com/.well-known/acme-challenge/qNNm-bGQ5q70HBvBNELffRskI8hSCtqBNdKsPAU07Ag', 'port': '443', 'addressUsed': '188.26.202.113', 'hostname': 'gestion.mydomain.com'}], 'token': 'qNNm-bGQ5q70HBvBNELffRskI8hSCtqBNdKsPAU07Ag', 'status': 'invalid', 'validated': '2025-02-14T12:57:08Z'}], 'status': 'invalid'}
Warning: No cert obtained from Let's Encrypt. Keeping the existing one as it is still valid.

So I opened ports 80 and 443 and it just worked fine... I thought only port 8120 was needed.

[Churro]

So I opened ports 80 and 443 and it just worked fine... I thought only port 8120 was needed.

Port 8120 doesn't need to be exposed to the Internet, it's only used locally on the host as a target route for requests to /.well-known/acme-challenge.