Régénération automatique certificats Let’s Encrypt DynDNS

Support
,
1

What type of hardware are you using: Old laptop or computer
What YunoHost version are you running: 12.1.20
How are you able to access your server: SSH
Are you in a special context or did you perform specific tweaking on your YunoHost instance ?: Sosh DynDNS, not compatible with IPV6

Describe your issue

Bonjour l’équipe,
Toujours très content de mon serveur yunohost que j’ai depuis près de 10 ans maintenant ! Merci pour tout le travail accmplis.
J’ai un point mineur qui est apparu il y a quelques année :
Le renouvellement des certificats lets encrypt ne se faitt plus automatiquement.
Et même à la main, je dois cliquer sur l’option “Ignore diagnosis checks” pour que le bouton devienne actif. Le renouvellement se passse ensuite très bien.
Bon c’est simplement un truc à faire à la main tous les 3mois, c’est pas la mort, mais ça m’est arrivé plusieurs fois à des moments gênant, donc j’aimerais autant que possible régler le problème.

Je joins le diag de mon serveur, je pense que ça à avoir avec le fait que l’ipv6 ne fonctionne pas très bien (pas supporté par le dyndns avec Orange/OVH) et donc pointe vers la mauvaise IP maintenant, où quelque-chose du genre.

Y-a-t-il y moyen de régler ça ?

  • enlever la config ipv6 ?
  • ajouter une config qui ignore les warning lors du renouvellement automatique ?

Share relevant logs or error messages

=================================
Base system (basesystem)

[INFO] Server hardware architecture is bare-metal amd64

  • Server model is Dell Inc. Inspiron 7348

[INFO] Server is running Linux kernel 5.10.0-33-amd64

[INFO] Server is running Debian 12.12

[INFO] Server is running YunoHost 12.1.20 (stable)

  • yunohost version: 12.1.20 (stable)
  • yunohost-admin version: 12.1.11 (stable)
  • yunohost-portal version: 12.1.2 (stable)
  • moulinette version: 12.1.3 (stable)
  • ssowat version: 12.1.1 (stable)

=================================
Internet connectivity (ip)

[SUCCESS] Domain name resolution is working!

[SUCCESS] The server is connected to the Internet through IPv4!

  • Global IP: xx.xx.xx.xx
  • Local IP: 192.168.1.130

[SUCCESS] The server is connected to the Internet through IPv6!

  • Global IP: xx:xx:xx:xx:xx:xx
  • Local IP: fe80::8eae:4bff:fe00:2d0d

=================================
DNS records (dnsrecords)

[WARNING] Some DNS records are missing or incorrect for domain maindomain.tld (category basic)

  • Please check the documentation at https://yunohost.org/dns_config if you need help configuring DNS records.
  • According to the recommended DNS configuration, you should add a DNS record with the following info.
    Type: AAAA
    Name: @
    Value: xx:xx:xx:xx:xx:xx
  • According to the recommended DNS configuration, you should add a DNS record with the following info.
    Type: AAAA
    Name: cloud
    Value: xx:xx:xx:xx:xx:xx
  • The following DNS record does not seem to follow the recommended configuration:
    Type: A
    Name: idb
    Current value: 86.204.177.50
    Expected value: xx.xx.xx.xx
  • According to the recommended DNS configuration, you should add a DNS record with the following info.
    Type: AAAA
    Name: idb
    Value: xx:xx:xx:xx:xx:xx
  • The following DNS record does not seem to follow the recommended configuration:
    Type: A
    Name: sign
    Current value: 86.204.156.43
    Expected value: xx.xx.xx.xx
  • According to the recommended DNS configuration, you should add a DNS record with the following info.
    Type: AAAA
    Name: sign
    Value: xx:xx:xx:xx:xx:xx
  • According to the recommended DNS configuration, you should add a DNS record with the following info.
    Type: A
    Name: test
    Value: xx.xx.xx.xx
  • According to the recommended DNS configuration, you should add a DNS record with the following info.
    Type: AAAA
    Name: test
    Value: xx:xx:xx:xx:xx:xx

[SUCCESS] DNS records are correctly configured for domain maindomain.tld (category mail)

[WARNING] Some DNS records are missing or incorrect for domain maindomain.tld (category extra)

  • Please check the documentation at https://yunohost.org/dns_config if you need help configuring DNS records.
  • According to the recommended DNS configuration, you should add a DNS record with the following info.
    Type: A
    Name: *
    Value: xx.xx.xx.xx
  • According to the recommended DNS configuration, you should add a DNS record with the following info.
    Type: AAAA
    Name: *
    Value: xx:xx:xx:xx:xx:xx

[SUCCESS] Your domains are registered and not going to expire anytime soon.

  • maindomain.tld expires in 293 days.

=================================
Ports exposure (ports)

[SUCCESS] Port 22 is reachable from the outside.

  • Exposing this port is needed for admin features (service ssh)

[INFO] Port 22 is not reachable from the outside in IPv6.

  • Exposing this port is needed for admin features (service ssh)
  • To fix this issue, you most probably need to configure port forwarding on your internet router as described in https://yunohost.org/isp_box_config

[SUCCESS] Port 25 is reachable from the outside.

  • Exposing this port is needed for email features (service postfix)

[INFO] Port 25 is not reachable from the outside in IPv6.

  • Exposing this port is needed for email features (service postfix)
  • To fix this issue, you most probably need to configure port forwarding on your internet router as described in https://yunohost.org/isp_box_config

[SUCCESS] Port 80 is reachable from the outside.

  • Exposing this port is needed for web features (service nginx)

[INFO] Port 80 is not reachable from the outside in IPv6.

  • Exposing this port is needed for web features (service nginx)
  • To fix this issue, you most probably need to configure port forwarding on your internet router as described in https://yunohost.org/isp_box_config

[SUCCESS] Port 443 is reachable from the outside.

  • Exposing this port is needed for web features (service nginx)

[INFO] Port 443 is not reachable from the outside in IPv6.

  • Exposing this port is needed for web features (service nginx)
  • To fix this issue, you most probably need to configure port forwarding on your internet router as described in https://yunohost.org/isp_box_config

[SUCCESS] Port 587 is reachable from the outside.

  • Exposing this port is needed for email features (service postfix)

[INFO] Port 587 is not reachable from the outside in IPv6.

  • Exposing this port is needed for email features (service postfix)
  • To fix this issue, you most probably need to configure port forwarding on your internet router as described in https://yunohost.org/isp_box_config

[SUCCESS] Port 993 is reachable from the outside.

  • Exposing this port is needed for email features (service dovecot)

[INFO] Port 993 is not reachable from the outside in IPv6.

  • Exposing this port is needed for email features (service dovecot)
  • To fix this issue, you most probably need to configure port forwarding on your internet router as described in https://yunohost.org/isp_box_config

=================================
Web (web)

[ERROR] Domain maindomain.tld appears unreachable through HTTP from outside the local network in IPv6, though it works in IPv4.

  • Timed-out while trying to contact your server from the outside. It appears to be unreachable.
    1. The most common cause for this issue is that port 80 (and 443) are not correctly forwarded to your server.
    2. You should also make sure that the service nginx is running
    3. On more complex setups: make sure that no firewall or reverse-proxy is interfering.

[ERROR] Domain cloud.maindomain.tld appears unreachable through HTTP from outside the local network in IPv6, though it works in IPv4.

  • Timed-out while trying to contact your server from the outside. It appears to be unreachable.
    1. The most common cause for this issue is that port 80 (and 443) are not correctly forwarded to your server.
    2. You should also make sure that the service nginx is running
    3. On more complex setups: make sure that no firewall or reverse-proxy is interfering.

[ERROR] Domain idb.maindomain.tld appears unreachable through HTTP from outside the local network in IPv6, though it works in IPv4.

  • Timed-out while trying to contact your server from the outside. It appears to be unreachable.
    1. The most common cause for this issue is that port 80 (and 443) are not correctly forwarded to your server.
    2. You should also make sure that the service nginx is running
    3. On more complex setups: make sure that no firewall or reverse-proxy is interfering.

[ERROR] Domain sign.maindomain.tld appears unreachable through HTTP from outside the local network in IPv6, though it works in IPv4.

  • Timed-out while trying to contact your server from the outside. It appears to be unreachable.
    1. The most common cause for this issue is that port 80 (and 443) are not correctly forwarded to your server.
    2. You should also make sure that the service nginx is running
    3. On more complex setups: make sure that no firewall or reverse-proxy is interfering.

[ERROR] Domain test.maindomain.tld appears unreachable through HTTP from outside the local network in IPv6, though it works in IPv4.

  • Timed-out while trying to contact your server from the outside. It appears to be unreachable.
    1. The most common cause for this issue is that port 80 (and 443) are not correctly forwarded to your server.
    2. You should also make sure that the service nginx is running
    3. On more complex setups: make sure that no firewall or reverse-proxy is interfering.

=================================
Email (mail)

[ERROR] The SMTP mail server cannot send emails to other servers because outgoing port 25 is blocked in IPv4.

  • You should first try to unblock outgoing port 25 in your internet router interface or your hosting provider interface. (Some hosting providers may require you to send them a support ticket for this).
  • Some providers won’t let you unblock outgoing port 25 because they don’t care about Net Neutrality.
    • Some of them provide the alternative of using a mail server relay though it implies that the relay will be able to spy on your email traffic.
    • A privacy-friendly alternative is to use a VPN with a dedicated public IP to bypass these kinds of limits. See https://yunohost.org/vpn_advantage
    • You can also consider switching to a more net neutrality-friendly provider

[ERROR] The SMTP mail server is unreachable from the outside on IPv6. It won’t be able to receive emails.

  • Could not open a connection on port 25 to your server in IPv6. It appears to be unreachable.
    1. The most common cause for this issue is that port 25 is not correctly forwarded to your server.
    2. You should also make sure that service postfix is running.
    3. On more complex setups: make sure that no firewall or reverse-proxy is interfering.

[ERROR] Reverse DNS is not correctly configured for IPv4. Some emails may fail to get delivered or be flagged as spam.

  • Current reverse DNS: lfbn-bor-1-333-161.w109-215.abo.wanadoo.fr
    Expected value: maindomain.tld
  • You should first try to configure reverse DNS with maindomain.tld in your internet router interface or your hosting provider interface. (Some hosting providers may require you to send them a support ticket for this).
  • Some providers won’t let you configure your reverse DNS (or their feature might be broken…). If you are experiencing issues because of this, consider the following solutions:
    • Some ISP provide the alternative of using a mail server relay though it implies that the relay will be able to spy on your email traffic.
    • A privacy-friendly alternative is to use a VPN with a dedicated public IP to bypass this kind of limits. See https://yunohost.org/vpn_advantage
    • Or it’s possible to switch to a different provider

[ERROR] No reverse DNS is defined in IPv6. Some emails may fail to get delivered or be flagged as spam.

  • You should first try to configure reverse DNS with maindomain.tld in your internet router interface or your hosting provider interface. (Some hosting providers may require you to send them a support ticket for this).
  • Some providers won’t let you configure your reverse DNS (or their feature might be broken…). If your reverse DNS is correctly configured for IPv4, you can try disabling the use of IPv6 when sending emails by running ‘yunohost settings set email.smtp.smtp_allow_ipv6 -v off’. Note: this last solution means that you won’t be able to send or receive emails from the few IPv6-only servers out there.

[ERROR] Your IP or domain xx.xx.xx.xx is blacklisted on Spamhaus ZEN

[ERROR] Your IP or domain xx:xx:xx:xx:xx:xx is blacklisted on Spamhaus ZEN

[SUCCESS] 0 pending emails in the mail queues

=================================
Services status check (services)

[SUCCESS] Service calibreweb is running!

[SUCCESS] Service dnsmasq is running!

[SUCCESS] Service dovecot is running!

[SUCCESS] Service fail2ban is running!

[SUCCESS] Service grafana-server is running!

[SUCCESS] Service influxdb is running!

[SUCCESS] Service influxdb_v2 is running!

[SUCCESS] Service mysql is running!

[SUCCESS] Service nftables is running!

[SUCCESS] Service nginx is running!

[SUCCESS] Service opendkim is running!

[SUCCESS] Service php8.2-fpm is running!

[SUCCESS] Service php8.3-fpm is running!

[SUCCESS] Service postfix is running!

[SUCCESS] Service redis-server is running!

[SUCCESS] Service slapd is running!

[SUCCESS] Service ssh is running!

[SUCCESS] Service yunohost-api is running!

[SUCCESS] Service yunohost-portal-api is running!

[SUCCESS] Service yunomdns is running!

=================================
System resources (systemresources)

[SUCCESS] The system still has 6.3 GiB (82%) RAM available out of 7.7 GiB.

[SUCCESS] The system has 977 MiB of swap!

  • Please be careful and aware that if the server is hosting swap on an SD card or SSD storage, it may drastically reduce the life expectancy of the device.

[SUCCESS] Storage / (on device /dev/sda2) still has 253 GiB (29%) space left (out of 868 GiB)!

[SUCCESS] Storage /boot/efi (on device /dev/sda1) still has 505 MiB (98.9%) space left (out of 511 MiB)!

=================================
System configurations (regenconf)

[WARNING] Configuration file /etc/apt/sources.list.d/extra_php_version.list appears to have been manually modified.

  • This is probably OK if you know what you’re doing! YunoHost will stop updating this file automatically… But beware that YunoHost upgrades could contain important recommended changes. If you want to, you can inspect the differences with ‘yunohost tools regen-conf apt --dry-run --with-diff’ and force the reset to the recommended configuration with ‘yunohost tools regen-conf apt --force’

=================================
Applications (apps)

[SUCCESS] All installed apps respect basic packaging practices

2

Bonjour,

Je n’ai pas trouvé de solution de mon côté, quelqu’un aurait une idée ?

3

Salut @Ced-C

Combien de domaines as-tu ?

4

Quand tu fais yunohost dyndns update, ça raconte quoi ?

5

Bonjour,

Merci pour vos réponses !

@otm33 : J’ai un domaine principal, et 4 sous-domaine, dont un seul est vraiment utilisé.

@Aleksei ça donne une erreur !

> sudo  yunohost dyndns update
[sudo] password for cedc:
Error: No domain registered with DynDNS

Pourtant, j’avais configuré le dynDNS chez OVH, c’est peut-être cassé ? Ça se mettait bien à jour avant, et je n’ai pas eu de coupure (mais mon ip n’a peut-être pas changée ?).

Ça expliquerait le warning et mes soucis ?

6

Yup … Tu peux tenter yunohost dyndns subscribe -d tondomain.nohost.me -p en remplacant tondomain.nohost.me. Ça te demandera le “recovery password” de ton domaine que tu as dû choisir la première fois que tu l’a enregistré

7

Avant de faire une bêtise, je précise que mon domaine est pas nohost.org C’est genre ced-c.ovh

Je vais regarder la Doc pour voir s’il faut s’inscrire, mais ça me semble étrange :

J’avais configuré le DNS chez OVH dans l’interface dovh et de ma box, ça devrait être transparent pour yunohost non?

8

Donc en lisant la doc, je crois que c’est bien ce que je pensais : `yunohost dyndns subscribe -d tondomain.nohost.me -p` C’est à priori pour les dommaines *nohost*, or j’ai mon propre demaine chez Ovh (type ced-c.ovh).

Le problème et la solutions sont surement ailleurs ?

Je fais peut–être fausse piste, mais je crois que c’est le fait que de dynDNS d’OVH ne fonctionne pas pour l’IPv6 et que donc mon IP n’est pas « à jour » de ce côté là qui fait que ça trigger un warning qui empêche le renouvellement automatique :

  1. C’est possible que ça soit bien ça ? comment le tester ? En mettant manuellement ma zonne DNS pour IPv6 à jour chez OVH ?
  2. Si ça se confirme, comment faire pour résoudre le soucis ?
9

Mouerf ok bah j’étais effectivement complètement à côté de la plaque, j’avais pas capté que par “dyndns” il s’agissait pas d’un domaine géré par YunoHost (nohost.me / noho.st etc)

Du coup je suis un peu paumé, d’autant plus que tu sembles dire que le renouvellement du certif fonctionne même quand tu cliques sur “Ignorer les checks” … Pourtant si l’IPv6 du DNS ne pointe pas sur ta machine, c’est juste censé ne pas marcher …

Mais bref, perso je ne sais pas comment fonctionne le DynDNS d’OVH donc je ne saurais pas t’aider là dessus

10

Je ne pense pas qu’il y ait un soucis particulier avec le dynDNS utilisé (sauf peut-être en ipv6, mais tout fonctionne en ipv4)

Aurais-tu une idée des cause possible (checklist ?) grisant l’option “renew lets encrypt certificates” ? ça me semble être la solution la plus seine pour régler le problème.

Alternativement, j’ai tenté un sudo yunohost domain cert renew xxx.ovh --force --no-checks en ligne de commande et ça fonctionne bien. Donc je suppose que mettre ça dans dans un cron ou un service systemD tous les 80 jours, c’est une alternative acceptable ? Un conseil pour ne rien casser si je pars dans cette direction ?

Merci <3