kentonv changed the topic of #sandstorm to: Welcome to #sandstorm: home of all things sandstorm.io. Say hi! | Have a question but no one is here? Try asking in the discussion group: https://groups.google.com/group/sandstorm-dev
frigginglorious has quit [Ping timeout: 246 seconds]
TimMc has quit [Ping timeout: 258 seconds]
TimMc has joined #sandstorm
frigginglorious has joined #sandstorm
frigginglorious has quit [Ping timeout: 246 seconds]
wings has quit [Ping timeout: 260 seconds]
larjona has quit [Quit: No Ping reply in 180 seconds.]
larjona has joined #sandstorm
frigginglorious has joined #sandstorm
CcxWrk has joined #sandstorm
CcxWrk has quit [Read error: Connection reset by peer]
ecloud has quit [Ping timeout: 254 seconds]
ecloud has joined #sandstorm
sknebel has quit [Ping timeout: 264 seconds]
sknebel has joined #sandstorm
_whitelogger has joined #sandstorm
xet7 has quit [Quit: Leaving]
larjona has quit [Quit: http://quassel-irc.org - Chatee cómodamente donde sea.]
larjona has joined #sandstorm
frigginglorious has quit [Ping timeout: 260 seconds]
frigginglorious has joined #sandstorm
xet7 has joined #sandstorm
frigginglorious has quit [Ping timeout: 244 seconds]
frigginglorious1 has joined #sandstorm
frigginglorious1 is now known as frigginglorious
frigginglorious has quit [Read error: Connection reset by peer]
<drkokandy> Is anyone around able to help me diagnose sandcats.io SSL issues? My certificate has expired & renewing has been failing. I created a gist with an excerpt of the log, but can provide additional details if needed. It seems the DNS challenge is failing. https://gist.github.com/drkokandy/e18916d9735e8be9616661fd40726f3b
<abliss> Hi! Yes we can take a look
<JacobWeisz[m]> Also yes :)
<kentonv> hello
<abliss> `routines:OPENSSL_internal:SSLV3_ALERT_CERTIFICATE_EXPIRED`
<kentonv> Error: queryTxt ENODATA _acme-challenge.trdaisuke.sandcats.io
<kentonv> drkokandy, what does this server use for outgoing DNS?
<kentonv> it looks like it requested that sandcats.io set the TXT record on _acme-challenge.trdaisuke.sandcats.io, but then when it tried to read back the DNS record, it couldn't find it
<drkokandy> should be the cloudflare DNS for outgoing
<drkokandy> oh hmmm but i have a local DNS resolver in pfsense to make sure it works internally due to DNS pinching or whatever the term is
<drkokandy> that is probably the issue
<kentonv> cool yeah... could be that the resolver doesn't like TXT records, or that it doesn't like underscores, or something.
<kentonv> in other news it looks like there are ~57 sandcats.io servers that don't have auto-updates enabled so are still requesting globalsign certs, ugh. I guess they're going to break after the next update.
<kentonv> errr
<drkokandy> I removed the rules for it and sure enough: Certificate was successfully renewed!
<kentonv> not break from the update, obviously, since the whole point is they aren't getting updates, but break when I shut down globalsign
<kentonv> drkokandy, sweet!
<drkokandy> thank you for your help!
<kentonv> np