Acme server clashes with redirect server on port 80

[komuw]

I think it is because letsencrypt does not issue wildcards using http-01 challenge

ong/server/tls_conf.go

Lines 185 to 187 in a8fba42

	// However, the certificate issued will NOT be wildcard certs; since letsencrypt only issues wildcard certs via DNS-01 challenge
	// Instead, we'll get a certifiate per subdomain.
	// see; https://letsencrypt.org/docs/faq/#does-let-s-encrypt-issue-wildcard-certificates

[komuw]

Actually, this seems to work on acme staging, but for some reason fails on acme prod.

[komuw]

Actually, this seems to work on acme staging, but for some reason fails on acme prod.

Actually, I think the issue is that we are starting two servers at port 80

• ong/server/tls_conf.go

  Lines 94 to 107 in a8fba42

  	autocertServer := &http.Server{
  	// serve HTTP, which will redirect automatically to HTTPS
  	Addr: ":80",
  	Handler: autocertHandler,
  	ReadHeaderTimeout: 20 * time.Second,
  	ReadTimeout: 40 * time.Second,
  	WriteTimeout: 40 * time.Second,
  	IdleTimeout: 120 * time.Second,
  	ErrorLog: slog.NewLogLogger(l.Handler(), slog.LevelDebug),
  	BaseContext: func(net.Listener) context.Context { return ctx },
  	}
  	cfg := listenerConfig()
  	lstr, err := cfg.Listen(ctx, "tcp", autocertServer.Addr)

• ong/server/server.go

  Lines 362 to 377 in a8fba42

  	// HTTP(non-tls) LISTERNER:
  	redirectSrv := &http.Server{
  	Addr: fmt.Sprintf("%s%s", o.host, o.httpPort),
  	Handler: srv.Handler,
  	ReadHeaderTimeout: o.readHeaderTimeout,
  	ReadTimeout: o.readTimeout,
  	WriteTimeout: o.writeTimeout,
  	IdleTimeout: o.idleTimeout,
  	ErrorLog: slog.NewLogLogger(logger.Handler(), slog.LevelDebug),
  	BaseContext: func(net.Listener) context.Context { return ctx },
  	}
  	go func() {
  	redirectSrvCfg := listenerConfig()
  	redirectSrvListener, errL := redirectSrvCfg.Listen(ctx, "tcp", redirectSrv.Addr)
  	if errL != nil {
  	logger.Error("redirect server, unable to create listener", "error", errL)

So, the acme CA is only able to access the acme server once in a while. And the other time it gets access to the redirect server.