Operator · Troubleshooting Your Environment

ACME Failures

Frame 104 of 107

ACME failures at the head have four classic shapes.

Clients report wrong URLs or a JWS url mismatchGOCA_ACME_BASE_URL must be the exact external origin clients reach, scheme and all. The protocol signs the URL into every request, so a proxy rewrite the head does not know about breaks every client at once.

A burst of badNonce right after a deploy — the head restart reset the nonce counter. One retry per in-flight client, by design; conformant clients absorb it silently. If your monitoring pages on it, teach the monitoring, not the CA.

http-01 fails against an internal name — the validator refuses loopback and RFC 1918 targets by default, as anti-SSRF. Issuing for internal names means enabling the private-network override deliberately, as a decision — not discovering the refusal in production.

Finalize stays processing — follow the order's request id: approval, quota, signer or publication status names the blocking stage. Do not submit a second order; finalize is idempotent, and the duplicate only muddies the trail you are trying to read.

An unhealthy head while everything else is green usually means its path to the core: wrong upstream URL, or a dev token meeting a real master secret.

Now I can debug ACME from the head's own refusals.