Letsencrypt can't find .well-known route because port 80 redirect to 443 after SSL is expired

[gjae]

What happened?

When traefik tries renew the ssl certificate, letsencrypt should send request to domain.com/.well-known/.... but currently the certificated is expired therefore the request to /.../.well-known can't responses with status 200.

[luzfcb]

@gjae Thank you for opening an issue, however you did not respect our issue template, and did not provide any useful information (such as anonymized error logs) to help us help you.

[browniebroke]

You should renew your certificate before it expires, this is not specific to this project, it's the official recommendation from Let's Encrypt (they recommend to renew after 60 days): https://letsencrypt.org/docs/faq/#what-is-the-lifetime-for-let-s-encrypt-certificates-for-how-long-are-they-valid

What is the lifetime for Let’s Encrypt certificates? For how long are they valid?

Our certificates are valid for 90 days. You can read about why here.
There is no way to adjust this, there are no exceptions. We recommend automatically renewing your certificates every 60 days.

They recommend leaving port 80 open on the webserver and redirect to 443, which is what we do with Traefik.

[gjae]

so, cookiecutter isn't pre-setting for renewing automatically?. Do you have any suggestion for?..
What I should make for?

[browniebroke]

Traefik is supposed to do it automatically: https://doc.traefik.io/traefik/https/acme/#automatic-renewals

[gjae]

Yes but, coockiecutter isn't pre-settings for it.
Now I should renew manually the current certificate and then setup traefik for that. So, I need allow /.well-know request in the port 80, this request is send for django's container or trafik's container?

[gjae]

Btw sir. I can see thtat nginx and traefik start up before django's container ends of start therefore when LE tries make request to /.well-known url, nginx says:

[error] 8#8: *1 connect() failed (111: Connection refused) while connecting to upstream, client: 23.178.112.100, server: , request: "GET /.well-known/acme-challenge/_HMJ_hyN5TfH4smB0rBQ5tZjHWSXbT4e5nvCPDi6PY0 HTTP/1.1", upstream: "http://CONTAINERIP:5000/.well-known/acme-challenge/_HMJ_hyN5TfH4smB0rBQ5tZjHWSXbT4e5nvCPDi6PY0", host: "host.app"

So I believe that port 80 is already openned but , django´s doesn´t end of start at moment before LE tries renew the certificate

Could you give me any idea?

[gjae]

Finally! I got solution!

For everybody who have this problem

in your production.yml file just remove the nginx's setting section, and add "0.0.0.0:80:80" as port of your traefik settings, make build, up services, then you only need revert this two changes and that's all