vercel: Creating Lets Encrypt certificates fails when using CloudFlare

$ node --version
v6.9.1

$ now --version
𝚫 now 0.37.1

$ now alias # note: this is run inside the root dir of https://github.com/jsperf/jsperf.com
> jsperf.com is a custom domain.
> Verifying the DNS settings for jsperf.com (see https://zeit.world for help)
> Verification OK!
> Provisioning certificate for jsperf.com
> Error! Unknown error: Error: Unhandled error
    at Alias._callee17$ (/Users/mathias/.nvm/versions/node/v6.9.1/lib/node_modules/now/build/lib/index.js:1236:25)
    at tryCatch (/Users/mathias/.nvm/versions/node/v6.9.1/lib/node_modules/now/node_modules/regenerator-runtime/runtime.js:64:40)
    at GeneratorFunctionPrototype.invoke [as _invoke] (/Users/mathias/.nvm/versions/node/v6.9.1/lib/node_modules/now/node_modules/regenerator-runtime/runtime.js:355:22)
    at GeneratorFunctionPrototype.prototype.(anonymous function) [as next] (/Users/mathias/.nvm/versions/node/v6.9.1/lib/node_modules/now/node_modules/regenerator-runtime/runtime.js:116:21)
    at step (/Users/mathias/.nvm/versions/node/v6.9.1/lib/node_modules/now/node_modules/babel-runtime/helpers/asyncToGenerator.js:17:30)
    at /Users/mathias/.nvm/versions/node/v6.9.1/lib/node_modules/now/node_modules/babel-runtime/helpers/asyncToGenerator.js:28:13
    at process._tickCallback (internal/process/next_tick.js:103:7)

About this issue

Original URL
State: closed
Created 8 years ago
Reactions: 3
Comments: 28 (11 by maintainers)

Most upvoted comments

@OlliV suggested adding the following Page Rule to the Cloudflare config:

I’ve confirmed that this avoids the issue. 👍

+15

mathiasbynens on Jan 3, 2017

This is my Cloudflare DNS config:

Grey-locking these records temporarily allowed now cert create to work.

mathiasbynens on Dec 29, 2016

That’s unfortunate 😞

Hmm it seems LE is receiving an error page saying:

525: SSL handshake failed
CloudFlare is unable to establish an SSL connection to the origin server.

As far as I understand the signed nonce is shared over HTTP, so trying to use TLS is actually wrong in this case 🤔

OlliV on Jan 1, 2017

Great.

OlliV on Sep 4, 2017

This is my issue, to be clear:

morgs32 on Sep 4, 2017

Thanks, this will be documented properly soon. And we are also going to improve the error message.

OlliV on Jan 3, 2017