Certificate verification failed

[sao-coding]

Does anyone know where the problem is?
please tell me
i use synology docker
My port forwarding settings
有人知道問題出在哪裡？
請告訴我
我使用 Synology docker
我的連接埠轉送設定
loaclhost:12345 -> hysteria.sao-x.com:443

version: "3.9"
services:
  hysteria:
    image: tobyxdd/hysteria
    container_name: hysteria
    # restart: always
    network_mode: "host"
    volumes:
      - acme:/acme
      - ./hysteria.yaml:/etc/hysteria.yaml
    command: ["server", "-c", "/etc/hysteria.yaml"]
volumes:
  acme:

listen: :12345

acme:
  domains:
    - hysteria.sao-x.com
  email: only@sao-x.com
  ca: letsencrypt
  dir: acme_dir
  type: http
  http:
    altPort: 12345

auth:
  type: password
  password: User.-.0987

masquerade: 
  type: proxy
  proxy:
    url: https://www.google.com/
    rewriteHost: true

2024/07/12 18:23:22	stdout	2024-07-12T10:23:22Z �[31mFATAL�[0m failed to load server config {"error": "invalid config: acme.domains: hysteria.sao-x.com: obtaining certificate: [hysteria.sao-x.com] Obtain: [hysteria.sao-x.com] solving challenge: hysteria.sao-x.com: [hysteria.sao-x.com] authorization failed: HTTP 400 urn:ietf:params:acme:error:connection - xxx.xxx.xxx.xxx: Fetching http://hysteria.sao-x.com/.well-known/acme-challenge/Oi1l9L0n2v3ZX4KfYJXHuFFjhhZ53xUPdZwd2DfJqJ4: Timeout during connect (likely firewall problem) (ca=https://acme-v02.api.letsencrypt.org/directory)"}
2024/07/12 18:23:22	stdout	2024-07-12T10:23:22Z �[34mINFO�[0m obtain releasing lock {"identifier": "hysteria.sao-x.com"}
2024/07/12 18:23:22	stdout	2024-07-12T10:23:22Z �[31mERROR�[0m obtain could not get certificate from issuer {"identifier": "hysteria.sao-x.com", "issuer": "acme-v02.api.letsencrypt.org-directory", "error": "HTTP 400 urn:ietf:params:acme:error:connection - xxx.xxx.xxx.xxx: Fetching http://hysteria.sao-x.com/.well-known/acme-challenge/Oi1l9L0n2v3ZX4KfYJXHuFFjhhZ53xUPdZwd2DfJqJ4: Timeout during connect (likely firewall problem)"}
2024/07/12 18:23:22	stdout	2024-07-12T10:23:22Z �[31mERROR�[0m acme_client validating authorization {"identifier": "hysteria.sao-x.com", "problem": {"type": "urn:ietf:params:acme:error:connection", "title": "", "detail": "xxx.xxx.xxx.xxx: Fetching http://hysteria.sao-x.com/.well-known/acme-challenge/Oi1l9L0n2v3ZX4KfYJXHuFFjhhZ53xUPdZwd2DfJqJ4: Timeout during connect (likely firewall problem)", "instance": "", "subproblems": []}, "order": "https://acme-v02.api.letsencrypt.org/acme/order/1833006017/286593539667", "attempt": 1, "max_attempts": 3}
2024/07/12 18:23:22	stdout	2024-07-12T10:23:22Z �[31mERROR�[0m acme_client challenge failed {"identifier": "hysteria.sao-x.com", "challenge_type": "http-01", "problem": {"type": "urn:ietf:params:acme:error:connection", "title": "", "detail": "xxx.xxx.xxx.xxx: Fetching http://hysteria.sao-x.com/.well-known/acme-challenge/Oi1l9L0n2v3ZX4KfYJXHuFFjhhZ53xUPdZwd2DfJqJ4: Timeout during connect (likely firewall problem)", "instance": "", "subproblems": []}}

[haruue]

您好。

在设置了 acme.http.altPort 的情况下， 需要配置 TCP 80 端口到该端口的端口转发/反向代理， 才能正确签发证书

我们的文档中有关于此的介绍， 可以点这个 「+」 来查看。
https://hysteria.network/zh/docs/advanced/Full-Server-Config/#tls

考虑到您在 Synology 上运行， 针对 80 端口配置反向代理可能并不容易， 建议考虑通过 DNS 签发 ACME 证书。
https://hysteria.network/zh/docs/advanced/ACME-DNS-Config/

此外， 如果您是台湾用户， 只是为了用 Hysteria 来加速网络下载， 自签名证书通常也是不错的选择。

[sao-coding]

不好意思
loaclhost:12345 -> hysteria.sao-x.com:443
這是反向代理 我打錯了 抱歉
因為 80 443 都被佔用了

altPort 我不確定要不要配置，看不太懂
用 Hysteria 是想公司電腦突破防火牆

[haruue]

我没有 Synology。 您可以试试在这个页面这样设定：

来源
通訊協定： HTTP （不是 HTTPS）
主機名稱： hysteria.sao-x.com
連接埠： 80

Hysteria 服务端配置就是你上面写的（需要 acme.http 下面有 altPort: 12345 ）

此外， 如果您之前重试失败次数较多， 可能会命中 Let‘s Encrypt 的 ratelimit 策略。 您可能需要更换一个子域名（比如 hysteria1.sao-x.com 才能成功签发证书。

此外， 公司防火墙不一定允许通过 UDP， Hysteria 不一定在您的需求下可用。 建议您先使用自签名证书测试。

[sao-coding]

他報錯了

2024/07/12 23:18:25	stdout	2024-07-12T15:18:25Z �[31mFATAL�[0m failed to load server config {"error": "invalid config: acme.domains: hysteria.sao-x.com: obtaining certificate: [hysteria.sao-x.com] Obtain: [hysteria.sao-x.com] solving challenge: hysteria.sao-x.com: [hysteria.sao-x.com] authorization failed: HTTP 403 urn:ietf:params:acme:error:unauthorized - 49.159.84.117: Invalid response from http://hysteria.sao-x.com/.well-known/acme-challenge/1UyDtl2Uv0sTGcDNgvB_ygekYj2-NjaPt3L08xcnrk8: 404 (ca=https://acme-v02.api.letsencrypt.org/directory)"}
2024/07/12 23:18:25	stdout	2024-07-12T15:18:25Z �[34mINFO�[0m obtain releasing lock {"identifier": "hysteria.sao-x.com"}
2024/07/12 23:18:25	stdout	2024-07-12T15:18:25Z �[31mERROR�[0m obtain could not get certificate from issuer {"identifier": "hysteria.sao-x.com", "issuer": "acme-v02.api.letsencrypt.org-directory", "error": "HTTP 403 urn:ietf:params:acme:error:unauthorized - 49.159.84.117: Invalid response from http://hysteria.sao-x.com/.well-known/acme-challenge/1UyDtl2Uv0sTGcDNgvB_ygekYj2-NjaPt3L08xcnrk8: 404"}
2024/07/12 23:18:25	stdout	2024-07-12T15:18:25Z �[31mERROR�[0m acme_client validating authorization {"identifier": "hysteria.sao-x.com", "problem": {"type": "urn:ietf:params:acme:error:unauthorized", "title": "", "detail": "49.159.84.117: Invalid response from http://hysteria.sao-x.com/.well-known/acme-challenge/1UyDtl2Uv0sTGcDNgvB_ygekYj2-NjaPt3L08xcnrk8: 404", "instance": "", "subproblems": []}, "order": "https://acme-v02.api.letsencrypt.org/acme/order/1833496367/286651277117", "attempt": 1, "max_attempts": 3}
2024/07/12 23:18:25	stdout	2024-07-12T15:18:25Z �[31mERROR�[0m acme_client challenge failed {"identifier": "hysteria.sao-x.com", "challenge_type": "http-01", "problem": {"type": "urn:ietf:params:acme:error:unauthorized", "title": "", "detail": "49.159.84.117: Invalid response from http://hysteria.sao-x.com/.well-known/acme-challenge/1UyDtl2Uv0sTGcDNgvB_ygekYj2-NjaPt3L08xcnrk8: 404", "instance": "", "subproblems": []}}
2024/07/12 23:18:24	stdout	2024-07-12T15:18:24Z �[34mINFO�[0m acme_client trying to solve challenge {"identifier": "hysteria.sao-x.com", "challenge_type": "http-01", "ca": "https://acme-v02.api.letsencrypt.org/directory"}
2024/07/12 23:18:24	stdout	2024-07-12T15:18:24Z �[34mINFO�[0m done waiting on internal rate limiter {"identifiers": ["hysteria.sao-x.com"], "ca": "https://acme-v02.api.letsencrypt.org/directory", "account": "only@sao-x.com"}
2024/07/12 23:18:24	stdout	2024-07-12T15:18:24Z �[34mINFO�[0m waiting on internal rate limiter {"identifiers": ["hysteria.sao-x.com"], "ca": "https://acme-v02.api.letsencrypt.org/directory", "account": "only@sao-x.com"}
2024/07/12 23:18:23	stdout	2024-07-12T15:18:23Z �[34mINFO�[0m obtain obtaining certificate {"identifier": "hysteria.sao-x.com"}
2024/07/12 23:18:23	stdout	2024-07-12T15:18:23Z �[34mINFO�[0m obtain lock acquired {"identifier": "hysteria.sao-x.com"}
2024/07/12 23:18:23	stdout	2024-07-12T15:18:23Z �[34mINFO�[0m maintenance started background certificate maintenance {"cache": "0xc0001a2070"}
2024/07/12 23:18:23	stdout	2024-07-12T15:18:23Z �[34mINFO�[0m obtain acquiring lock {"identifier": "hysteria.sao-x.com"}

[sao-coding]

如果我用另外的方式取的Let‘s Encrypt發的證書可行嗎?

[haruue]

可以的， 您需要将证书私钥存放路径映射进 docker 容器中， 然后用这里的 tls 设置即可： https://hysteria.network/zh/docs/advanced/Full-Server-Config/#tls