Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Revserse Proxy Error - Auto-Encrypt - AcmeRequest Fails

See original GitHub issue

First, been using kill-the-newsletter for over a year now, and I love it; thanks for the great work!

Unable to Get Cert Today I was attempting to spin up a new instance of kill-the-newsletter, and it appears Auto-Encrypt included in the compiled version for 1.0.1 is using an outdated algorithm for CSR signing and, as a result, fails to get a CERT.

Below is the error I receive. Note, I removed my domain from the output below and replaced it with [kill-the-newsletter-server] so that is why it may look odd.

Email server started
   📕    ❨auto-encrypt❩ Directory is using endpoint
   👤    ❨auto-encrypt❩ Creating identity (/home/[kill-the-newsletter-server]/kill-the-newsletter/data/keys/tls/production/account-identity.pem)
   🤖    ❨auto-encrypt❩ Provisioning Let’s Encrypt certificates for [kill-the-newsletter-server]
   📈    ❨auto-encrypt❩ Number of authorisations to validate: 1
   💗    ❨auto-encrypt❩ Authorisation was previously validated and is still valid.
   📝    ❨auto-encrypt❩ An authorisation was validated for the order! (1/1)
   🎊    ❨auto-encrypt❩ All authorisations validated.
   🔒    ❨auto-encrypt❩ HTTP server is now forwarding HTTP requests to HTTPS (302).
   💃    ❨auto-encrypt❩ Finalising order…
   👤    ❨auto-encrypt❩ Creating identity (/home/[kill-the-newsletter-server]/kill-the-newsletter/data/keys/tls/production/[kill-the-newsletter-server].com/certificate-identity.pem)
        throw new Error(error)

Error: AcmeRequest.requestError: (400 urn:ietf:params:acme:error:badCSR Error finalizing order :: signature algorithm not supported)
    at Order.init (/tmp/caxa/kill-the-newsletter/dxvoiiwdvh/node_modules/@small-tech/auto-encrypt/lib/Order.js:178:15)
    at processTicksAndRejections (node:internal/process/task_queues:94:5)
    at async Function.getInstanceAsync (/tmp/caxa/kill-the-newsletter/dxvoiiwdvh/node_modules/@small-tech/auto-encrypt/lib/Order.js:47:5)
    at async Certificate.provisionCertificate (/tmp/caxa/kill-the-newsletter/dxvoiiwdvh/node_modules/@small-tech/auto-encrypt/lib/Certificate.js:248:19)
    at async Certificate.createSecureContext (/tmp/caxa/kill-the-newsletter/dxvoiiwdvh/node_modules/@small-tech/auto-encrypt/lib/Certificate.js:220:7)
    at async Certificate.getSecureContext (/tmp/caxa/kill-the-newsletter/dxvoiiwdvh/node_modules/@small-tech/auto-encrypt/lib/Certificate.js:47:7)
    at async TLSSocket.options.SNICallback [as _SNICallback] (/tmp/caxa/kill-the-newsletter/dxvoiiwdvh/node_modules/@small-tech/auto-encrypt/index.js:162:31)

I can run the kill-the-newsletter service without the proxy, so it looks like it’s an issue with the reverse proxy.

Issue Analytics

  • State:open
  • Created a year ago
  • Comments:6 (3 by maintainers)

github_iconTop GitHub Comments

leafaccommented, Nov 30, 2022

The solution I’m using for the time being a hack that I explain in the beginning of this coding session:

I’m working on the the proper solution and it will come out soon…

leafaccommented, Nov 8, 2022

Thanks @zhaonc for the information.

As a quick fix, I updated @small-tech/auto-encrypt as you mentioned.

But a more proper solution is on the way. You may follow along in my livecoding sessions at

Read more comments on GitHub >

github_iconTop Results From Across the Web

Renew fails with error 403 on nginx reverse proxy - Help
My domain is: I ran this command: ~/certbot/.certbot-auto renew. It produced this output:.
Read more >
Common Certbot Errors & Solutions -
Let's Encrypt Certbot sometimes kicks up a fuss. In this article we document the most commonly encountered errors and how to solve them....
Read more >
Solved: Lets Encrypt Fails on Reverse Proxies - Help
Error messages and/or full log output: I am not see any logs get generated. Tried adding these values but didn't generate anything. yourdomain....
Read more >
Let's Encrypt HTTP challenge renewal fails with timeout #1549
Failed to renew certificate npm-5 with error: Some challenges have failed ... GET request to
Read more >
LetsEncrypt certificates fail in domain validation - GitLab Forum
When you get a certificate from Let's Encrypt, our servers validate that you control the domain names in that certificate using “challenges,” as ......
Read more >

github_iconTop Related Medium Post

No results found

github_iconTop Related StackOverflow Question

No results found

github_iconTroubleshoot Live Code

Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free

github_iconTop Related Reddit Thread

No results found

github_iconTop Related Hackernoon Post

No results found

github_iconTop Related Tweet

No results found

github_iconTop Related Post

No results found

github_iconTop Related Hashnode Post

No results found