gandiv5: context deadline exceeded (Client.Timeout exceeded while awaiting headers)

[ook]

Hello.
Since Gandiv5 PAT, I can’t get lego working (embed in Traefik 2.11.8).
Gandi PAT has rights:

  "scope": [
    "organization:view",
    "domain:view",
    "domain:tech"
  ],

The PAT is recognized (if I add a char in the token, I get an auth error).
Lego log from Traefik:

time="2024-09-03T19:25:41Z" level=debug msg="Adding route for mysub.mydomain.tld with TLS options default" entryPointName=websecure
time="2024-09-03T19:25:41Z" level=debug msg="Trying to challenge certificate for domain [mysub.mydomain.tld] found in HostSNI rule" routerName=default-zerobin-6ed46bcdee1a52127ed8@kubernetescrd rule="Host(`mysub.mydomain.tld`)" ACME CA="https://acme-v02.api.letsencrypt.org/directory" providerName=default.acme
time="2024-09-03T19:25:41Z" level=debug msg="Looking for provided certificate(s) to validate [\"mysub.mydomain.tld\"]..." rule="Host(`mysub.mydomain.tld`)" ACME CA="https://acme-v02.api.letsencrypt.org/directory" providerName=default.acme routerName=default-zerobin-6ed46bcdee1a52127ed8@kubernetescrd
time="2024-09-03T19:25:41Z" level=debug msg="Domains [\"mysub.mydomain.tld\"] need ACME certificates generation for domains \"mysub.mydomain.tld\"." ACME CA="https://acme-v02.api.letsencrypt.org/directory" providerName=default.acme routerName=default-zerobin-6ed46bcdee1a52127ed8@kubernetescrd rule="Host(`mysub.mydomain.tld`)"
time="2024-09-03T19:25:41Z" level=debug msg="Loading ACME certificates [mysub.mydomain.tld]..." ACME CA="https://acme-v02.api.letsencrypt.org/directory" providerName=default.acme routerName=default-zerobin-6ed46bcdee1a52127ed8@kubernetescrd rule="Host(`mysub.mydomain.tld`)"
time="2024-09-03T19:25:53Z" level=debug msg="legolog: [INFO] [mysub.mydomain.tld] acme: Obtaining bundled SAN certificate"
time="2024-09-03T19:25:56Z" level=debug msg="legolog: [INFO] [mysub.mydomain.tld] AuthURL: https://acme-v02.api.letsencrypt.org/acme/authz-v3/39892662SNIP"
time="2024-09-03T19:25:56Z" level=debug msg="legolog: [INFO] [mysub.mydomain.tld] acme: Could not find solver for: tls-alpn-01"
time="2024-09-03T19:25:56Z" level=debug msg="legolog: [INFO] [mysub.mydomain.tld] acme: Could not find solver for: http-01"
time="2024-09-03T19:25:56Z" level=debug msg="legolog: [INFO] [mysub.mydomain.tld] acme: use dns-01 solver"
time="2024-09-03T19:25:56Z" level=debug msg="legolog: [INFO] [mysub.mydomain.tld] acme: Preparing to solve DNS-01"
time="2024-09-03T19:26:35Z" level=debug msg="legolog: [INFO] [mysub.mydomain.tld] acme: Cleaning DNS-01 challenge"
time="2024-09-03T19:26:46Z" level=debug msg="Serving default certificate for request: \"mysub.mydomain.tld\""
time="2024-09-03T19:26:56Z" level=error msg="Unable to obtain ACME certificate for domains \"mysub.mydomain.tld\": unable to generate a certificate for the domains [mysub.mydomain.tld]: error: one or more domains had a problem:\n[mysub.mydomain.tld] [mysub.mydomain.tld] acme: error presenting token: unable to get TXT records for domain mydomain.tld and name _acme-challenge.mysub: unable to communicate with the API server: error: Get \"https://dns.api.gandi.net/api/v5/domains/mydomain.tld/records/_acme-challenge.mysub/TXT\": context deadline exceeded (Client.Timeout exceeded while awaiting headers)\n" providerName=default.acme routerName=default-zerobin-6ed46bcdee1a52127ed8@kubernetescrd rule="Host(`mysub.mydomain.tld`)" ACME CA="https://acme-v02.api.letsencrypt.org/directory"

I tried by extending check delay and I see the TXT record is created correctly.

What can cause this timeout?

Thank you.

[ldez]

Hello,

acme: error presenting token: unable to get TXT records for domain mydomain.tld and name _acme-challenge.mysub:
unable to communicate with the API server: error: Get "https://dns.api.gandi.net/api/v5/domains/mydomain.tld/records/_acme-challenge.mysub/TXT\":
context deadline exceeded (Client.Timeout exceeded while awaiting headers)

This timeout is related to the HTTP client used inside the API Client for Gandi.
It's because the Gandi API is slow to answer.

You should increase this timeout by setting the env var GANDIV5_HTTP_TIMEOUT (by default it's 10 seconds) to something like 30 seconds: GANDIV5_HTTP_TIMEOUT=30

[ook]

Hello @ldez , thank you for your quick answer.

I give GANDIV5_HTTP_TIMEOUT=60 and respawn traefik, it seems indeed better! The error disappear, but I certainly hit another issue. Does it ring some bell?

time="2024-09-03T22:11:44Z" level=debug msg="Trying to challenge certificate for domain [mysub.mydomain.tld] found in HostSNI rule" providerName=default.acme routerName=default-zerobin-6ed46bcdee1a52127ed8@kubernetescrd rule="Host(`mysub.mydomain.tld`)" ACME CA="https://acme-v02.api.letsencrypt.org/directory"
time="2024-09-03T22:11:44Z" level=debug msg="Looking for provided certificate(s) to validate [\"mysub.mydomain.tld\"]..." providerName=default.acme routerName=default-zerobin-6ed46bcdee1a52127ed8@kubernetescrd rule="Host(`mysub.mydomain.tld`)" ACME CA="https://acme-v02.api.letsencrypt.org/directory"
time="2024-09-03T22:11:44Z" level=debug msg="No ACME certificate generation required for domains [\"mysub.mydomain.tld\"]." providerName=default.acme routerName=default-zerobin-6ed46bcdee1a52127ed8@kubernetescrd rule="Host(`mysub.mydomain.tld`)" ACME CA="https://acme-v02.api.letsencrypt.org/directory"
time="2024-09-03T22:11:44Z" level=debug msg="legolog: [INFO] [mysub.mydomain.tld] acme: Waiting for DNS record propagation."

Checking the produced acme.json, I see no mysub.mydomain.tld entry.
And if I try to "force" the pass I get the default certificate configured on my instance (static TLS, not handle by letsencrypt)

curl -v --resolve mysub.mydomain.tld:443:<realIpv4> https://mysub.mydomain.tld

time="2024-09-03T22:18:42Z" level=debug msg="Serving default certificate for request: \"mysub.mydomain.tld\""

There’s a smell, isn’t it?

[ldez]

acme: Waiting for DNS record propagation.

You should wait: if the certificates are generated you will see a message, same if it fails.

[ook]

Thank you again @ldez , I saw you selected the answer, and I endorse it. Let’s another subject for the next step… ^^