Did Not Connect: Potential Security Issue (Error code: SEC_ERROR_UNKNOWN_ISSUER) with Let's encrypt cert

[Suncatcher]

Hi everybody,
my config with built-in ertificate that worked like a charm for a while suddenly stopped working. I see this error and it doesn't allow me to pass thru

From my perspective nothing has changed since the last issue was created, so the configuration is following:

{
  "$schema": "https://raw.githubusercontent.com/Ylianst/MeshCentral/master/meshcentral-config-schema.json",
  "__comment1__": "This is a simple configuration file, all values and sections that start with underscore (_) are ignored. Edit a section and remove the _ in front of the name. Refer to the user's guide for details.",
  "__comment2__": "See node_modules/meshcentral/sample-config-advanced.json for a more advanced example.",
  "settings": {
    "cert": "XXXXXXXXXXXXX",
    "WANonly": true,
    "_LANonly": true,
    "_sessionKey": "MyReallySecretPassword1",
    "_port": 443,
    "_aliasPort": 443,
    "_redirPort": 80,
    "_redirAliasPort": 80,
    "mpsport": 0
  },
  "domains": {
    "": {
      "_title": "MyServer",
      "_title2": "Servername",
      "_minify": true,
      "_newAccounts": true,
      "_userNameIsEmail": true
    }
  },
  "letsencrypt": {
    "__comment__": "Requires NodeJS 8.x or better, Go to https://letsdebug.net/ first before trying Let's Encrypt.",
    "email": "XXXXXXXXXXX",
    "names": "XXXXXXXXXXX",
    "skipChallengeVerification": true,
    "production": true
  }
}

I checked just now and even the IPv6 of my EC2 instance didn't change, it is effectively the same as month before /below is dummy/:
https://[23c0:90c3:7b9b:3033:24b0:781a:b252:ccf6]/
and I can successfully open the Mesh by IP address like this, though only after the following warning

Any suggestion why it was broken?

[si458]

If u click view certificate what does the dn/cn say?
It should be the dns name u set in cert?
Also check who issued the certificate
Share pic if u can

[si458]

i have a feeling its because you are using IPv6 ONLY in the dns as you have no ipv4 address.
i will look into it as i now have ipv6 in our rack so i can do more testing!
try my suggestion above adding the nochecks: true to letsencrypt #5988 (reply in thread)
remember to restart meshcentral after you set it systemctl restart meshcentral.service

[Suncatcher]

i have a feeling its because you are using IPv6 ONLY in the dns as you have no ipv4 address

correct, that is my setup. Is that a problem that was never tested by MeshCentral or is it just my wrong setup?

[si458]

yes it will be a problem that was never tested,
you have to remember @Ylianst did all this on his own along with @krayon007
so its hard to test every single environment!
but give the nochecks: true a try as that will completely bypass the checks for letsencrypt

[Suncatcher]

try my suggestion above adding the nochecks: true to letsencrypt

that solved the problem, thanks. But I'm concerned about the longstanding consequences you mentioned: I don't want my domain to be banned by Let's Encrypt for multiple wrong attempts

[si458]

dont worry, if you can open a bug report with all the details (follow template 🙏),
ill put it on my to-do list and have a look during the week!

[si458]

yeh its because your dns name only have an AAAA record, so the dns fails, as it currently only looks for an A record!

> dns.resolve('meshcentral.mydomain.com', function(err,records){ console.log(err,records); });
QueryReqWrap {
  bindingName: 'queryA',
  callback: [Function (anonymous)],
  hostname: 'meshcentral.mydomain.com',
  oncomplete: [Function: onresolve],
  ttl: false
}
> null [ '1.2.3.4' ]

[si458]

actually just fixed it! very simple! 1 line! dont worry about a bug report! 31ebb21

[Suncatcher]

you are just awesome, bro! so this means that I can remove that nocheck option after I upgrade the mesh to the latest version from Git source? BTW, what is the update policy of MeshCentral? This fix will be included in the next major version?