download does not work

[mariowitdoek]

hi

I've implemented this script like https://xdeb.org/post/2016/02/09/lets-encrypt-my-servers-with-acme-tiny/ with a dedicated challenges folder for all sites and a link folder on OS-level (in stead of website configuration).
for 2 of my 3 sites the update of the cert works but for 1 I get the error:

Order created!
Verifying www.curio.com...
Traceback (most recent call last):
File "/root/acme-tiny/acme_tiny.py", line 198, in
main(sys.argv[1:])
File "/root/acme-tiny/acme_tiny.py", line 194, in main
signed_crt = get_crt(args.account_key, args.csr, args.acme_dir, log=LOGGER, CA=args.ca, disable_check=args.disable_check, directory_url=args.directory_url, contact=args.contact)
File "/root/acme-tiny/acme_tiny.py", line 143, in get_crt
raise ValueError("Wrote file to {0}, but couldn't download {1}: {2}".format(wellknown_path, wellknown_url, e))
ValueError: Wrote file to /var/www/challenges/skvf_47ZYztCItApe5M1Pul_b4cH8Skk9NDuCxBlfXQ, but couldn't download http://www.curio.com/.well-known/acme-challenge/skvf_47ZYztCItApe5M1Pul_b4cH8Skk9NDuCxBlfXQ: Error:
Url: http://www.curio.com/.well-known/acme-challenge/skvf_47ZYztCItApe5M1Pul_b4cH8Skk9NDuCxBlfXQ
Data: None
Response Code: None
Response: <urlopen error [Errno 111] Connection refused>

when I check with ssh, I see the file and I can download it with firefox (content = the name of the file + '.' and suffix).
it is on debian 9 and Apache/2.4.25 (Debian)

any ideas?

Mario

[ssuchanowski]

It just happen to me as well - I identified the issue and made a fix that seems to be working just fine ;)

I hope it helps

[movitto]

We just encountered the same issue which was due to our nodejs/expressjs webserver taking a moment to reload and pickup the challenge after it was written to the disk. In that time the request from acme_tiny was attempted and resulted in a failure.

Adding a small delay on line 138, inbetween writing the challenge and attempting to retrieve it fixed the issue:

        wellknown_path = os.path.join(acme_dir, token)
        with open(wellknown_path, "w") as wellknown_file:
            wellknown_file.write(keyauthorization)

        time.sleep(3)  # <=== NEW ADDITION

        # check that the file is in place
        try:
            wellknown_url = "http://{0}/.well-known/acme-challenge/{1}".format(domain, token)
            assert (disable_check or _do_request(wellknown_url)[0] == keyauthorization)
        except (AssertionError, ValueError) as e:
            raise ValueError("Wrote file to {0}, but couldn't download {1}: {2}".format(wellknown_path, wellknown_url, e))

3 seconds may be excessive but better safe than sorry (and perhaps for larger webapps with alot of initialization logic this wouldn't be enough).

Thoughts on adding something like this to the codebase (perhaps with a configurable delay)? I can send a PR if it is acceptable