Can't generate a certificate for Haproxy with Let's Encrypt with acme.sh

Help!
1

Hello,
I am implementing an audio server at home (Navidrome).
In order to use it remotely, I created my domain name at DuckDNS (savoye.duckdns.org), then I installed Haproxy as a reverse proxy.
I also installed an acme client (acme.sh from Github) to get a certificate from Let’s Encrypt to communicate in https.
To complete these tasks, I have followed line by line the tutorial Automate HAProxy Let’s Encrypt certificates with acme.sh

Everything was fine until i attempted to generate the certificate with acme.sh from Let’s Encrypt
After several tries where i discovered I need to open the port 80 in my internet router (Let’s Encrypt recommendation), I am reaching a blocking point with an error message inside the (see below)

savoye.duckdns.org: Invalid status. Verification error details: 176.147.60.50: Error reading HTTP response body: reader size limit exceeded

I ask a question at Let’s Encrypt forum.
After several exchanges, my contact at this forum thought it was rather a haproxy configuration problem and recommends me to post a message at Haproxy forum.
Thank in advance for your help
Regards

2

The HAProxy guide contains the following statement inside the frontend section:

http-request return status 200 content-type text/plain lf-string "%[path,field(-1,/)].${ACCOUNT_THUMBPRINT}\n" if { path_beg '/.well-known/acme-challenge/' }

That should make it so that a request like curl -iL http://savoye.duckdns.org/.well-known/acme-challenge/test returns 200 OK with a response body like: test.YOUR_ACCOUNT_THUMBPRINT.

That’s not what’s happening. Instead it redirects to https, which redirects to /app/, which then returns HTML.

You included the HAProxy config in the LE forum comment here: Can't generate a certificate when using acme.sh - OpenSSL error - #3 by yannick.savoye - Aide (en français) - Let's Encrypt Community Support

I would recommend changing the navidrom_http section as follows:

frontend navidrome_http
    bind *:80
    mode http
    http-request return status 200 content-type text/plain lf-string "%[path,field(-1,/)].${ACCOUNT_THUMBPRINT}\n" if { path_beg '/.well-known/acme-challenge/' }
    redirect scheme https code 301

The navidrome_https section doesn’t need any acme-challenge configuration, since LE connects over HTTP/80 when doing the domain verification.