Let's Encrypt certificates generation error

Hi just upgraded my local blynk server to 0.35.1 (previous 0.34.2)
I followed upgrade procedure as outlined on https://github.com/blynkkk/blynk-server#update-instruction-for-unix-like-systems

Here is the error message I get:
pi@raspberrypi:~ $ java -jar server-0.35.1-java8.jar -dataFolder /home/pi/Blynk

Blynk Server 0.35.2-SNAPSHOT successfully started.
All server output is stored in folder '/home/pi/logs' file.
Generating own initial certificates...
Error during certificate generation.
Network error

Here is logfile:

20:40:46.499 INFO - Using data dir '/home/pi/Blynk'
            20:40:48.675 INFO - Region : local. Host : xxx.xxx.me.
            20:40:49.950 INFO - Initializing gmail smtp mail transport. Username : xxxxl@gmail.com. SMTP host : smtp.gmail.com:587
            20:40:50.027 INFO - Didn't find custom user certificates.
            20:40:50.032 INFO - Didn't find Let's Encrypt certificates.
            20:40:50.033 INFO - Automatic certificate generation is turned ON.
            20:40:50.033 WARN - ATTENTION. Server certificate paths (cert : '/home/pi', key : '/home/pi') not valid. Using embedded server certs and one way ssl. This is not secure. Please replace it with your own certs.
            20:40:52.023 INFO - Hardware SSL server listening at 8441 port.
            20:40:52.026 INFO - HTTP API and WebSockets server listening at 8080 port.
            20:40:52.029 INFO - HTTPS API, WebSockets and Admin page server listening at 9443 port.
            20:40:52.032 INFO - Mqtt hardware server listening at 8440 port.
            20:40:52.060 INFO - Starting up certificate retrieval process for host xxx.xxx.me and email xxx@gmail.com

Please help me troubleshoot:

Things I tried:

I made sure i had

sudo iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 8080
sudo iptables -t nat -A PREROUTING -p tcp --dport 443 -j REDIRECT --to-port 9443

On my router, I am port forwarding port 9443 to pi’s ip address

Some hardware info: Raspberry Pi 3 B
server.property file:

    #hardware mqtt port
    hardware.mqtt.port=8440

    #hardware ssl port
    hardware.ssl.port=8441

    #http, plain web sockets and plain hardware port
    http.port=8080

    #if this property is true csv download url will use port 80 and will ignore http.port
    force.port.80.for.csv=false

    #if this property is true redirect_command will use 80 port and will ignore http.port
    force.port.80.for.redirect=true

    #secured https, web sockets and app port
    https.port=9443

    #address to bind to. by default bounded to all interfaces
    listen.address=

    #by default server uses embedded in jar cert to simplify local server installation.
    #WARNNING DO NOT USE THIS CERTIFICATES ON PRODUCTION OR IN WHERE ENVIRNOMENTS REAL SECURITY REQUIRED.
    #provide either full path to files either use '.' for specifying current directory. For instance "./myfile.crt"
    server.ssl.cert=
    server.ssl.key=
    server.ssl.key.pass=

    #by default System.getProperty("java.io.tmpdir")/blynk used
    data.folder=

    #folder for logs.
    logs.folder=./logs

    #log debug level. trace|debug|info|error. Defines how precise logging will be.
    log.level=info

    #maximum number of devices allowed per account
    user.devices.limit=25

    #maximum number of tags allowed per account
    user.tags.limit=100

    #defines maximum allowed number of user dashboards. Needed to limit possible number of tokens.
    user.dashboard.max.limit=100

    #defines maximum allowed widget size in KBs as json string.
    user.widget.max.size.limit=20

    #user is limited with 100 messages per second.
    user.message.quota.limit=100

    #maximum allowed number of notification queue. Queue responsible for processing email, pushes, twits sending.
    #Because of performance issue - those queue is processed in separate thread, this is required due
    #to blocking nature of all above operations. Usually limit shouldn't be reached.
    notifications.queue.limit=2000

    #Number of threads for performing blocking operations - push, twits, emails, db queries.
    #Recommended to hold this value low unless you have to perform a lot of blocking operations.
    blocking.processor.thread.pool.limit=6

    #this setting defines how often we can send mail/tweet/push or any other notification. Specified in seconds
    notifications.frequency.user.quota.limit=15

    #this setting defines how often we can send webhooks. Specified in miliseconds
    webhooks.frequency.user.quota.limit=1000

    #this setting defines how big could be response for webhook GET request. Specified in kbs
    webhooks.response.size.limit=72

    #maximum size of user profile in kb's
    user.profile.max.size=128

    #number of strings to store in terminal widget
    terminal.strings.pool.size=25

    #number of strings to store in map widget
    map.strings.pool.size=25

    #number of strings to store in lcd widget
    lcd.strings.pool.size=6

    #maximum number of rows allowed
    table.rows.pool.size=100

    #period in millis for saving all user DB to disk.
    profile.save.worker.period=60000

    #period in millis for saving stats to disk.
    stats.print.worker.period=60000

    #max size of web request in bytes, 256 kb (256x1024) is default
    web.request.max.size=524288

    #maximum number of points that are fetched during CSV export
    #43200 == 60 * 24 * 30 - minutes points for 1 month
    csv.export.data.points.max=43200

    #specifies maximum period of time when hardware socket could be idle. After which
    #socket will be closed due to non activity. In seconds. Default value 15 if not provided.
    #leave it empty for infinity timeout
    hard.socket.idle.timeout=15

    #enable DB
    enable.db=false

    #enable raw data storage to DB
    enable.raw.db.data.store=false

    #size of async logger ring buffer. should be increased for loads >2-3k req/sec
    async.logger.ring.buffer.size=2048

    #when true - allows reading worker to trigger hardware even app is offline
    allow.reading.widget.without.active.app=false

    #initial amount of energy
    initial.energy=100000

    #ADMINISTRATION SECTION

    admin.rootPath=/admin

    #used for reset password page and certificate generation.
    #by default current server IP is taken. could be replaced with more friendly hostname.
    #it is recommended to override this property with your server IP to avoid possible problems of host resolving
    #server.host=test.blynk.cc

    product.name=Blynk

    #email used for certificate registration, could be omitted in case you already specified it in mail.properties
    #contact.email=

    #network interface to determine server's current IP.
    #only the first characters of the interface's name are needed.
    #the default setting eth will use the first ethX interface found (i.e. eth0)
    net.interface=eth

    #comma separated list of administrator IPs. allow access to admin UI only for those IPs.
    #you may set it for 0.0.0.0/0 to allow access for all.
    #you may use CIDR notation. For instance, 192.168.0.53/24
    allowed.administrator.ips=0.0.0.0/0,::/0

    # default admin name and password. that will be created on initial server start
    admin.email=admin@blynk.cc
    admin.pass=admin

    #comma separated list of users allowed to create accounts. leave it empty if no restriction required.
    allowed.users.list=

    server.host=xxxx.xxxx.me
    contact.email=xxxx@gmail.com

I appreciate any guidance you can provide.

Does your rasp has internet connection? Did you have certificates before? Look like it has nothing to do with update - you just try to generate certificates. Am I wrong?

Do you have a copy of your last (and valid) certificate? I had a similar issue and it was a simple as rename the old and invalid one and paste the copied one.

Yes the Pi has internet connection. Now that I think of it, I am not sure if certificate generation was working before. I have update title for this thread to reflect this.

Bump.

Please let me know if information I provided is not adequate to help me troubleshoot.

Is your host valid? Can you ping it from outside your network?

Yes. I can ping it from outside.

Average time over 10 pings: 38.91 ms

I wonder if my router’s port forwarding is correct

currently I am port forwarding 9443, 80 and 443 to RPI’s 9443, 80 and 443.

443 > 9443
80 > 8080
9443 > 9443

That was it. Its working now.

Thank you, Dmitriy

1 Like

I spoke too soon. It was still giving error.

I came across another discussion here and that helped solve the issue for me.
I am posting it here so that it might help someone else.

https://community.blynk.cc/t/raspberry-pi-3-server-ssl-certificates/9318

I modified the server.properties (As per @Costas)

client.ssl.cert=server.crt
client.ssl.key=server.pem

Now everything is working well.