System.Net.Http.WinHttpException (80072F8F, 12175): Error 12175 calling WINHTTP_CALLBACK_STATUS_REQUEST_ERROR

[TorpedoCXC]

Hi there.

I receive the above error when trying to obtain a certificate with the win-acme client. The details are as followed:

[DBUG] [*.my-domain.de] Attempting to create DNS record under abcdefgh-1234-1234-1234-abcdefgh1234.auth.acme-dns.io...
[DBUG] Using C:\ProgramData\win-acme\acme-dns\auth.acme-dns.ioregister for acme-dns configuration
[DBUG] Configuration will now be checked at name servers: 217.160.81.47, 217.160.83.47, 217.160.80.47, 217.160.82.47
[VERB] Verification of CNAME record successful at server 217.160.81.47
[VERB] Verification of CNAME record successful at server 217.160.83.47
[VERB] Verification of CNAME record successful at server 217.160.80.47
[VERB] Verification of CNAME record successful at server 217.160.82.47
[INFO] Verification of acme-dns configuration succesful.
[DBUG] Sending update request to acme-dns server at https://auth.acme-dns.io/register for domain my-domain.de
[DBUG] [HTTP] Send POST to https://auth.acme-dns.io/update
[VERB] [HTTP] Request content: {"subdomain":"abcdefgh-1234-1234-1234-abcdefgh1234","txt":"XXX"}
**[EROR] Error sending update request to acme-dns server at https://auth.acme-dns.io/register for domain my-domain.de
System.Net.Http.HttpRequestException: An error occurred while sending the request.
---> System.Net.Http.WinHttpException (80072F8F, 12175): Error 12175 calling WINHTTP_CALLBACK_STATUS_REQUEST_ERROR, 'Es
ist ein Sicherheitsfehler aufgetreten.'.
at System.Threading.Tasks.RendezvousAwaitable1.GetResult() at System.Net.Http.WinHttpHandler.StartRequestAsync(WinHttpRequestState state) --- End of inner exception stack trace --- at PKISharp.WACS.Services.ProxyService.LoggingHttpClientHandler.SendAsync(HttpRequestMessage request, CancellationTok en cancellationToken) at System.Net.Http.HttpClient.<SendAsync>g__Core|83_0(HttpRequestMessage request, HttpCompletionOption completionOpti on, CancellationTokenSource cts, Boolean disposeCts, CancellationTokenSource pendingRequestsCts, CancellationToken origi nalCancellationToken) at PKISharp.WACS.Clients.AcmeDnsClient.Update(String domain, String token)** [DBUG] [\*.my-domain.de] Failed to create record under abcdefgh-1234-1234-1234-abcdefgh1234.auth.acme-dns.io [DBUG] [\*.my-domain.de] Attempting to create DNS record under _acme-challenge.my-domain.de... [DBUG] Using C:\ProgramData\win-acme\acme-dns\auth.acme-dns.ioregister for acme-dns configuration [DBUG] Configuration will now be checked at name servers: 217.160.81.47, 217.160.83.47, 217.160.80.47, 217.160.82.47 [VERB] Verification of CNAME record successful at server 217.160.81.47 [VERB] Verification of CNAME record successful at server 217.160.83.47 [VERB] Verification of CNAME record successful at server 217.160.80.47 [VERB] Verification of CNAME record successful at server 217.160.82.47 [INFO] Verification of acme-dns configuration succesful. [DBUG] Sending update request to acme-dns server at https://auth.acme-dns.io/register for domain my-domain.de [DBUG] [HTTP] Send POST to https://auth.acme-dns.io/update [VERB] [HTTP] Request content: {"subdomain":"abcdefgh-1234-1234-1234-abcdefgh1234","txt":"XXX"} [EROR] Error sending update request to acme-dns server at https://auth.acme-dns.io/register for domain my-domain.de System.Net.Http.HttpRequestException: An error occurred while sending the request. ---> System.Net.Http.WinHttpException (80072F8F, 12175): Error 12175 calling WINHTTP_CALLBACK_STATUS_REQUEST_ERROR, 'Es ist ein Sicherheitsfehler aufgetreten.'. at System.Threading.Tasks.RendezvousAwaitable1.GetResult()
at System.Net.Http.WinHttpHandler.StartRequestAsync(WinHttpRequestState state)
--- End of inner exception stack trace ---
at PKISharp.WACS.Services.ProxyService.LoggingHttpClientHandler.SendAsync(HttpRequestMessage request, CancellationTok
en cancellationToken)
at System.Net.Http.HttpClient.g__Core|83_0(HttpRequestMessage request, HttpCompletionOption completionOpti
on, CancellationTokenSource cts, Boolean disposeCts, CancellationTokenSource pendingRequestsCts, CancellationToken origi
nalCancellationToken)
at PKISharp.WACS.Clients.AcmeDnsClient.Update(String domain, String token)
[DBUG] [*.my-domain.de] Failed to create record under _acme-challenge.my-domain.de
[EROR] [*.my-domain.de] Error preparing for challenge answer
System.Exception: [*.my-domain.de] Unable to prepare for challenge answer
at PKISharp.WACS.Plugins.ValidationPlugins.DnsValidation1.PrepareChallenge(ValidationContext context, Dns01Challenge ValidationDetails challenge) at PKISharp.WACS.Plugins.ValidationPlugins.Validation1.PrepareChallenge(ValidationContext context)
at PKISharp.WACS.RenewalValidator.Prepare(ValidationContext context, RunLevel runLevel)
[VERB] Starting post-validation cleanup
[DBUG] DNS record cleanup finalized
[VERB] Post-validation cleanup was succesful
[INFO] [*.my-domain.de] Deactivating pending authorization
[DBUG] [HTTP] Send POST to https://acme-v02.api.letsencrypt.org/acme/authz-v3/314689269797
[VERB] [HTTP] Request content: {"protected":"XXX","payload":"YYY","signature":"ZZZ"}
[INFO] [my-domain.de] Deactivating pending authorization
[VERB] [HTTP] Request completed with status OK
[VERB] [HTTP] Response content: {
"identifier": {
"type": "dns",
"value": "my-domain.de"
},
"status": "deactivated",
"expires": "2024-02-20T06:48:05Z",
"challenges": [
{
"type": "dns-01",
"status": "pending",
"url": "https://acme-v02.api.letsencrypt.org/acme/chall-v3/314689269797/xXNuCg",
"token": "XXX"
}
],
"wildcard": true
}
[DBUG] [HTTP] Send POST to https://acme-v02.api.letsencrypt.org/acme/authz-v3/314689269807
[VERB] [HTTP] Request content: {"protected":"XXX","payload":"YYY","signature":"ZZZ"}
[VERB] [HTTP] Request completed with status OK
[VERB] [HTTP] Response content: {
"identifier": {
"type": "dns",
"value": "my-domain.de"
},
"status": "deactivated",
"expires": "2024-02-20T06:48:05Z",
"challenges": [
{
"type": "http-01",
"status": "pending",
"url": "https://acme-v02.api.letsencrypt.org/acme/chall-v3/314689269807/acnTNw",
"token": "XXX"
},
{
"type": "dns-01",
"status": "pending",
"url": "https://acme-v02.api.letsencrypt.org/acme/chall-v3/314689269807/BHh7oQ",
"token": "XXX"
},
{
"type": "tls-alpn-01",
"status": "pending",
"url": "https://acme-v02.api.letsencrypt.org/acme/chall-v3/314689269807/HlQ5yA",
"token": "XXX"
}
]
}
[VERB] Order 1/1 (Main): error Error preparing for challenge answer
[VERB] Processing order 1/1: Main
[EROR] Renewal for MyDomain LE failed, will retry on next run
[EROR] Error preparing for challenge answer
[EROR] No certificate generated
[VERB] Exiting with status code -1

I suspect something wrong in the certificate chain of the trusted certificates as I also cannot open the site https://auth.acme-dns.io/register with the preinstalled IE11. It immediately shows a "page cannot be displayed" message. Opening the site with for example Firefox works, returning the expected "method not allowed" message. From what I read so far, others solved the problem by importing the ISRG root certificate to the trusted root certifcate storage. I already did so and restarted the server, but it did not solve the problem.

OS: Windows Server 2012R2, running IIS and Exchange 2013

It works on another machine with Windows Server 2016 from the same network. But I want to make it work on the Exchange server, so I can easily update the certificates there.

Any help or ideas would be appreciated.

[webprofusion-chrisc]

It might be that the trust chain is ok but it's failing to negotiate a common TLS level and cipher suite, if you use IIS Crypto to check your enabled cipher suites and compare the working machine to the non-working machine you may find you need to enable some of the more modern suites like ECDSA ones.

If you don't share a matching set of ciphers between your machine and the acme-dns server then you can't connect. In particular if your 2012 server was an upgrade from Server 2008 a bunch of stuff doesn't work by default, 2012 is also past it's supported end of life but I'm sure you know that.

[TorpedoCXC]

Thanks for the nudge regarding activated cipher suites. With the help of sslyze I found out in the meantime that the certificate of auth.acme-dns.io is indeed being trusted by my server. Also, I found out that the only supported cipher suites of that site are (of course) TLS1.2 and TLS1.3. TLS1.3 doesn't work on Windows Server 2012R2 and TLS1.2 was already activated.

The supported TLS1.2 cipher suites of that site are:

• TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
• TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
• TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256

With the help of IIS Crypto I found out that the last two ones are supported in general with Server 2012R2, but both were deactivated by default. I will try activating these suites and give it another try. But this will have to wait some hours when the server can be rebooted. I will report back with the results here.

The customer I support in that case was made aware by me that they need to upgrade their Exchange server. But as you may have guessed, this "takes some more time".

[TorpedoCXC]

After activating the cipher suites and rebooting the server, I was able to open the site https://auth.acme-dns.io/register in IE 11. The renewal also worked and I was able to obtain a new certificate. 👍