{"action":"created","issue":{"url":"https://api.github.com/repos/mholt/caddy/issues/1157","repository_url":"https://api.github.com/repos/mholt/caddy","labels_url":"https://api.github.com/repos/mholt/caddy/issues/1157/labels{/name}","comments_url":"https://api.github.com/repos/mholt/caddy/issues/1157/comments","events_url":"https://api.github.com/repos/mholt/caddy/issues/1157/events","html_url":"https://github.com/mholt/caddy/issues/1157","id":180479681,"number":1157,"title":"ssl certs failure","user":{"login":"miekg","id":353371,"avatar_url":"https://avatars.githubusercontent.com/u/353371?v=3","gravatar_id":"","url":"https://api.github.com/users/miekg","html_url":"https://github.com/miekg","followers_url":"https://api.github.com/users/miekg/followers","following_url":"https://api.github.com/users/miekg/following{/other_user}","gists_url":"https://api.github.com/users/miekg/gists{/gist_id}","starred_url":"https://api.github.com/users/miekg/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/miekg/subscriptions","organizations_url":"https://api.github.com/users/miekg/orgs","repos_url":"https://api.github.com/users/miekg/repos","events_url":"https://api.github.com/users/miekg/events{/privacy}","received_events_url":"https://api.github.com/users/miekg/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":44,"created_at":"2016-10-01T20:54:26Z","updated_at":"2016-12-01T07:59:19Z","closed_at":"2016-11-03T04:07:03Z","body":"### 1. What version of Caddy are you running (`caddy -version`)?\n\nCaddy (untracked dev build)\n(last commit hash bbf954c)\n### 2. What are you trying to do?\n\nRebooted my machine and let caddy run agin\n### 3. What is your entire Caddyfile?\n\n``` text\nprolly not relevant (yet)\n```\n### 4. How did you run Caddy (give the full command and describe the execution environment)?\n\n```\nExecStart=/opt/bin/caddy -pidfile /var/www/caddy.pid -agree=true -email \\\n    miek@miek.nl -conf=/etc/caddy/Caddyfile -log stdout\n```\n### 5. What did you expect to see?\n\nNot the following\n### 6. What did you see instead (give full error messages and/or log)?\n\n```\n-- Logs begin at Fri 2016-09-30 19:54:00 UTC. --\nOct 01 20:23:39 deb caddy[5591]: 2016/10/01 20:23:39 http: TLS handshake error from 85.25.210.234:21233: tls: client offered an unsupported, maximum protocol version of 301\nOct 01 20:23:40 deb caddy[5591]: 2016/10/01 20:23:40 http: TLS handshake error from 85.25.210.234:13864: tls: client offered an unsupported, maximum protocol version of 301\nOct 01 20:23:40 deb caddy[5591]: 2016/10/01 20:23:40 http: TLS handshake error from 85.25.210.234:17874: tls: client offered an unsupported, maximum protocol version of 301\nOct 01 20:24:36 deb caddy[5591]: 2016/10/01 20:24:36 http: TLS handshake error from 106.120.173.99:46438: tls: first record does not look like a TLS handshake\nOct 01 20:25:36 deb caddy[5591]: 2016/10/01 20:25:36 http: TLS handshake error from [2a02:908:b40:a0:5c79:4d07:c5a9:3d83]:61116: tls: client offered an unsupported, maximum protocol version of 301\nOct 01 20:31:03 deb caddy[5591]: 2016/10/01 20:31:03 http: TLS handshake error from [2001:1a50:11:0:5f:8f:ac0c:1]:41341: tls: client offered an unsupported, maximum protocol version of 301\nOct 01 20:34:11 deb caddy[5591]: 2016/10/01 20:34:11 http: TLS handshake error from 54.221.81.125:40546: tls: client offered an unsupported, maximum protocol version of 301\nOct 01 20:34:11 deb caddy[5591]: 2016/10/01 20:34:11 http: TLS handshake error from 54.221.81.125:40625: tls: client offered an unsupported, maximum protocol version of 301\nOct 01 20:42:15 deb caddy[5591]: 2016/10/01 20:42:15 http: TLS handshake error from 173.48.168.206:51582: EOF\nOct 01 20:43:51 deb caddy[5591]: 2016/10/01 20:43:51 http: TLS handshake error from 180.153.73.63:45483: tls: unsupported SSLv2 handshake received\nOct 01 20:44:25 deb caddy[5591]: 2016/10/01 20:44:25 http: TLS handshake error from 113.160.154.138:44733: tls: unsupported SSLv2 handshake received\n```\n\nAfter which I restarted Caddy, resulting in the following:\n\n```\n-- Logs begin at Fri 2016-09-30 19:54:00 UTC, end at Sat 2016-10-01 20:45:48 UTC. --\nSep 30 19:54:04 deb systemd[1]: Starting Caddy HTTP/2 web server...\nSep 30 19:54:04 deb systemd[1]: Started Caddy HTTP/2 web server.\nSep 30 19:54:05 deb caddy[5591]: 2016/09/30 19:54:04 [INFO] NLgids localhost: nlgids@deb.atoom.net\nSep 30 19:54:08 deb caddy[5591]: Activating privacy features... done.\nSep 30 19:54:08 deb caddy[5591]: https://miek.nl\nSep 30 19:54:08 deb caddy[5591]: https://www.miek.nl\nSep 30 19:54:08 deb caddy[5591]: https://archive.miek.nl\nSep 30 19:54:08 deb caddy[5591]: https://nlgids.london\nSep 30 19:54:08 deb caddy[5591]: https://www.nlgids.london\nSep 30 19:54:08 deb caddy[5591]: https://coredns.io\nSep 30 19:54:08 deb caddy[5591]: https://www.coredns.io\nSep 30 19:54:08 deb caddy[5591]: https://blog.coredns.io\nSep 30 19:54:08 deb caddy[5591]: https://dnssex.nl\nSep 30 19:54:08 deb caddy[5591]: https://www.dnssex.nl\nSep 30 19:54:08 deb caddy[5591]: https://www.berkestoffering.nl\nSep 30 19:54:08 deb caddy[5591]: https://berkestoffering.nl\nSep 30 19:54:08 deb caddy[5591]: https://atoom.net\nSep 30 19:54:08 deb caddy[5591]: https://www.atoom.net\nSep 30 19:54:08 deb caddy[5591]: https://isitinfra.net\nSep 30 19:54:08 deb caddy[5591]: https://www.isitinfra.net\nSep 30 19:54:08 deb caddy[5591]: http://wereldstadsgidsen.com\nSep 30 19:54:08 deb caddy[5591]: http://www.wereldstadsgiden.com\nSep 30 19:54:08 deb caddy[5591]: http://wereldstadgidsen.nl\nSep 30 19:54:08 deb caddy[5591]: http://www.wereldstadgidsen.nl\nSep 30 19:54:08 deb caddy[5591]: http://wereldstadgidsen.be\nSep 30 19:54:08 deb caddy[5591]: http://www.wereldstadgidsen.be\nSep 30 19:54:08 deb caddy[5591]: http://miek.nl\nSep 30 19:54:08 deb caddy[5591]: http://www.miek.nl\nSep 30 19:54:08 deb caddy[5591]: http://archive.miek.nl\nSep 30 19:54:08 deb caddy[5591]: http://nlgids.london\nSep 30 19:54:08 deb caddy[5591]: http://www.nlgids.london\nSep 30 19:54:08 deb caddy[5591]: http://coredns.io\nSep 30 19:54:08 deb caddy[5591]: http://www.coredns.io\nSep 30 19:54:08 deb caddy[5591]: http://blog.coredns.io\nSep 30 19:54:08 deb caddy[5591]: http://dnssex.nl\nSep 30 19:54:08 deb caddy[5591]: http://www.dnssex.nl\nSep 30 19:54:08 deb caddy[5591]: http://www.berkestoffering.nl\nSep 30 19:54:08 deb caddy[5591]: http://berkestoffering.nl\nSep 30 19:54:08 deb caddy[5591]: http://atoom.net\nSep 30 19:54:08 deb caddy[5591]: http://www.atoom.net\nSep 30 19:54:08 deb caddy[5591]: http://isitinfra.net\nSep 30 19:54:08 deb caddy[5591]: http://www.isitinfra.net\nSep 30 19:55:03 deb caddy[5591]: 92.12.221.148 - miek.nl GET /rss.xml HTTP/1.1 404 1252 -\nSep 30 19:55:30 deb caddy[5591]: 50.90.21.165 - miek.nl GET /images/apple.jpg HTTP/2.0 200 298876 https://www.google.com/\nSep 30 19:55:35 deb caddy[5591]: 2016/09/30 19:55:35 http: TLS handshake error from 65.19.138.35:27189: tls: client offered an unsupported, maximum protocol version of 30\nSep 30 19:55:36 deb caddy[5591]: 2016/09/30 19:55:36 http: TLS handshake error from 8.29.198.27:42107: tls: client offered an unsupported, maximum protocol version of 301\nSep 30 19:55:36 deb caddy[5591]: 2016/09/30 19:55:36 http: TLS handshake error from 8.29.198.27:14930: tls: client offered an unsupported, maximum protocol version of 300\nSep 30 19:56:07 deb caddy[5591]: 2001:8b0:bf59:4c3f:a796:8189:437c:4729 - miek.nl GET / HTTP/2.0 200 1609 -\nSep 30 19:56:07 deb caddy[5591]: 2001:8b0:bf59:4c3f:a796:8189:437c:4729 - miek.nl GET /css/style.css HTTP/2.0 200 3557 https://miek.nl/\nSep 30 19:56:07 deb caddy[5591]: 2001:8b0:bf59:4c3f:a796:8189:437c:4729 - miek.nl GET /css/monosocialiconsfont.css HTTP/2.0 200 368 https://miek.nl/\nSep 30 19:56:07 deb caddy[5591]: 2001:8b0:bf59:4c3f:a796:8189:437c:4729 - miek.nl GET /css/highlight.css HTTP/2.0 200 629 https://miek.nl/\nSep 30 19:56:07 deb caddy[5591]: 2001:8b0:bf59:4c3f:a796:8189:437c:4729 - miek.nl GET /images/avatar.jpg HTTP/2.0 200 35651 https://miek.nl/\nSep 30 19:56:07 deb caddy[5591]: 2001:8b0:bf59:4c3f:a796:8189:437c:4729 - miek.nl GET /js/main.js HTTP/2.0 200 406 https://miek.nl/\nSep 30 19:56:07 deb caddy[5591]: 2001:8b0:bf59:4c3f:a796:8189:437c:4729 - miek.nl GET /fonts/MonoSocialIconsFont-1.10.ttf HTTP/2.0 200 146660 https://miek.nl/css/monosoci\nSep 30 19:56:07 deb caddy[5591]: 2001:8b0:bf59:4c3f:a796:8189:437c:4729 - miek.nl GET /js/highlight.js HTTP/2.0 200 23415 https://miek.nl/\nSep 30 19:56:07 deb caddy[5591]: 2001:8b0:bf59:4c3f:a796:8189:437c:4729 - miek.nl GET /images/favicon.ico HTTP/2.0 200 5182 https://miek.nl/\nSep 30 19:56:10 deb caddy[5591]: 2001:8b0:bf59:4c3f:a796:8189:437c:4729 - coredns.io GET / HTTP/2.0 200 2660 -\nSep 30 19:56:10 deb caddy[5591]: 2001:8b0:bf59:4c3f:a796:8189:437c:4729 - coredns.io GET /img/coredns-logo.png HTTP/2.0 200 1347 https://coredns.io/\nSep 30 19:56:10 deb caddy[5591]: 2001:8b0:bf59:4c3f:a796:8189:437c:4729 - coredns.io GET /css/landing-page.css HTTP/2.0 200 987 https://coredns.io/\nSep 30 19:56:10 deb caddy[5591]: 2001:8b0:bf59:4c3f:a796:8189:437c:4729 - coredns.io GET /js/jquery.easing.min.js HTTP/2.0 200 1857 https://coredns.io/\nSep 30 19:56:10 deb caddy[5591]: 2001:8b0:bf59:4c3f:a796:8189:437c:4729 - coredns.io GET /js/landing-page.js HTTP/2.0 200 471 https://coredns.io/\nSep 30 19:56:10 deb caddy[5591]: 2001:8b0:bf59:4c3f:a796:8189:437c:4729 - coredns.io GET /font-awesome-4.1.0/css/font-awesome.min.css HTTP/2.0 200 4684 https://coredns.io\nSep 30 19:56:10 deb caddy[5591]: 2001:8b0:bf59:4c3f:a796:8189:437c:4729 - coredns.io GET /js/bootstrap.min.js HTTP/2.0 200 8544 https://coredns.io/\nSep 30 19:56:10 deb caddy[5591]: 2001:8b0:bf59:4c3f:a796:8189:437c:4729 - coredns.io GET /css/bootstrap.min.css HTTP/2.0 200 18109 https://coredns.io/\nSep 30 19:56:10 deb caddy[5591]: 2001:8b0:bf59:4c3f:a796:8189:437c:4729 - coredns.io GET /js/jquery-1.11.0.js HTTP/2.0 200 33391 https://coredns.io/\nSep 30 19:56:10 deb caddy[5591]: 2001:8b0:bf59:4c3f:a796:8189:437c:4729 - coredns.io GET /img/lava.jpg HTTP/2.0 200 198893 https://coredns.io/\nSep 30 19:56:11 deb caddy[5591]: 2001:8b0:bf59:4c3f:a796:8189:437c:4729 - coredns.io GET /font-awesome-4.1.0/fonts/fontawesome-webfont.woff HTTP/2.0 200 83760 https://cor\nSep 30 19:56:11 deb caddy[5591]: 2001:8b0:bf59:4c3f:a796:8189:437c:4729 - coredns.io GET /img/html-code.jpg HTTP/2.0 200 119296 https://coredns.io/\nSep 30 19:56:11 deb caddy[5591]: 2001:8b0:bf59:4c3f:a796:8189:437c:4729 - coredns.io GET /img/cloud.jpg HTTP/2.0 200 435545 https://coredns.io/\nSep 30 19:56:11 deb caddy[5591]: 2001:8b0:bf59:4c3f:a796:8189:437c:4729 - coredns.io GET /img/disk.jpg HTTP/2.0 200 757713 https://coredns.io/\nSep 30 19:56:11 deb caddy[5591]: 2001:8b0:bf59:4c3f:a796:8189:437c:4729 - coredns.io GET /img/intro-bg.jpg HTTP/2.0 200 435545 https://coredns.io/css/landing-page.css\nSep 30 19:56:11 deb caddy[5591]: 2001:8b0:bf59:4c3f:a796:8189:437c:4729 - coredns.io GET /img/contact-bg.jpg HTTP/2.0 200 544154 https://coredns.io/css/landing-page.css\nSep 30 19:56:12 deb caddy[5591]: 2001:8b0:bf59:4c3f:a796:8189:437c:4729 - coredns.io GET /img/mountain.jpg HTTP/2.0 200 1332881 https://coredns.io/\nSep 30 19:56:12 deb caddy[5591]: 2001:8b0:bf59:4c3f:a796:8189:437c:4729 - coredns.io GET /favicon.ico HTTP/2.0 404 0 https://coredns.io/\nSep 30 19:56:56 deb caddy[5591]: 49.128.61.142 - miek.nl GET /favicon.ico HTTP/2.0 404 3919 https://miek.nl/downloads/2015/go.pdf\nSep 30 19:56:56 deb caddy[5591]: 80.100.158.12 - miek.nl GET /feeds/all.atom.xml HTTP/2.0 404 1252 -\nSep 30 19:56:57 deb caddy[5591]: 49.128.61.142 - miek.nl GET /downloads/2015/go.pdf HTTP/2.0 200 994890 http://dave.cheney.net/resources-for-new-go-programmers\nSep 30 19:56:57 deb caddy[5591]: 49.128.61.142 - miek.nl GET /downloads/2015/go.pdf HTTP/2.0 206 634442 https://miek.nl/downloads/2015/go.pdf\nSep 30 19:57:02 deb caddy[5591]: 2607:8400:2010:2:c90a:ae38:f60a:3756 - www.miek.nl GET /rss.xml HTTP/1.1 404 1252 -\nSep 30 19:57:05 deb caddy[5591]: 2016/09/30 19:57:05 http2: server: error reading preface from client 49.128.61.142:53745: timeout waiting for client preface\nSep 30 19:57:06 deb caddy[5591]: 2016/09/30 19:57:06 http: TLS handshake error from 49.128.61.142:53747: EOF\nSep 30 19:57:38 deb caddy[5591]: 86.105.55.25 - miek.nl GET /feeds/all.atom.xml HTTP/1.1 404 1252 -\nSep 30 19:58:14 deb caddy[5591]: 66.249.76.120 - www.nlgids.london GET /specials.html HTTP/1.1 200 4797 -\nSep 30 19:58:18 deb caddy[5591]: 180.76.15.7 - archive.miek.nl GET /downloads/pubs/secreg-report.pdf HTTP/1.1 200 94343 -\nSep 30 19:58:29 deb caddy[5591]: 49.128.61.142 - miek.nl GET / HTTP/2.0 200 1609 -\nSep 30 19:58:29 deb caddy[5591]: 49.128.61.142 - miek.nl GET /css/highlight.css HTTP/2.0 200 629 https://miek.nl/\nSep 30 19:58:29 deb caddy[5591]: 49.128.61.142 - miek.nl GET /css/style.css HTTP/2.0 200 3557 https://miek.nl/\n...skipping...\nOct 01 20:23:36 deb caddy[5591]: 2016/10/01 20:23:36 http: TLS handshake error from 85.25.210.234:42145: tls: client offered an unsupported, maximum protocol version of 3\nOct 01 20:23:36 deb caddy[5591]: 2016/10/01 20:23:36 http: TLS handshake error from 85.25.210.234:34234: tls: client offered an unsupported, maximum protocol version of 3\nOct 01 20:23:37 deb caddy[5591]: 2016/10/01 20:23:37 http: TLS handshake error from 85.25.210.234:40256: tls: client offered an unsupported, maximum protocol version of 3\nOct 01 20:23:38 deb caddy[5591]: 2016/10/01 20:23:38 http: TLS handshake error from 85.25.210.234:62341: tls: client offered an unsupported, maximum protocol version of 3\nOct 01 20:23:38 deb caddy[5591]: 2016/10/01 20:23:38 http: TLS handshake error from 85.25.210.234:34146: tls: client offered an unsupported, maximum protocol version of 3\nOct 01 20:23:38 deb caddy[5591]: 2016/10/01 20:23:38 http: TLS handshake error from 85.25.210.234:58432: tls: client offered an unsupported, maximum protocol version of 3\nOct 01 20:23:39 deb caddy[5591]: 2016/10/01 20:23:39 http: TLS handshake error from 85.25.210.234:41085: tls: client offered an unsupported, maximum protocol version of 3\nOct 01 20:23:39 deb caddy[5591]: 2016/10/01 20:23:39 http: TLS handshake error from 85.25.210.234:21233: tls: client offered an unsupported, maximum protocol version of 3\nOct 01 20:23:40 deb caddy[5591]: 2016/10/01 20:23:40 http: TLS handshake error from 85.25.210.234:13864: tls: client offered an unsupported, maximum protocol version of 3\nOct 01 20:23:40 deb caddy[5591]: 2016/10/01 20:23:40 http: TLS handshake error from 85.25.210.234:17874: tls: client offered an unsupported, maximum protocol version of 3\nOct 01 20:24:36 deb caddy[5591]: 2016/10/01 20:24:36 http: TLS handshake error from 106.120.173.99:46438: tls: first record does not look like a TLS handshake\nOct 01 20:25:36 deb caddy[5591]: 2016/10/01 20:25:36 http: TLS handshake error from [2a02:908:b40:a0:5c79:4d07:c5a9:3d83]:61116: tls: client offered an unsupported, maxim\nOct 01 20:31:03 deb caddy[5591]: 2016/10/01 20:31:03 http: TLS handshake error from [2001:1a50:11:0:5f:8f:ac0c:1]:41341: tls: client offered an unsupported, maximum proto\nOct 01 20:34:11 deb caddy[5591]: 2016/10/01 20:34:11 http: TLS handshake error from 54.221.81.125:40546: tls: client offered an unsupported, maximum protocol version of 3\nOct 01 20:34:11 deb caddy[5591]: 2016/10/01 20:34:11 http: TLS handshake error from 54.221.81.125:40625: tls: client offered an unsupported, maximum protocol version of 3\nOct 01 20:42:15 deb caddy[5591]: 2016/10/01 20:42:15 http: TLS handshake error from 173.48.168.206:51582: EOF\nOct 01 20:43:51 deb caddy[5591]: 2016/10/01 20:43:51 http: TLS handshake error from 180.153.73.63:45483: tls: unsupported SSLv2 handshake received\nOct 01 20:44:25 deb caddy[5591]: 2016/10/01 20:44:25 http: TLS handshake error from 113.160.154.138:44733: tls: unsupported SSLv2 handshake received\nOct 01 20:45:39 deb systemd[1]: Stopping Caddy HTTP/2 web server...\nOct 01 20:45:39 deb systemd[1]: Stopped Caddy HTTP/2 web server.\nOct 01 20:45:39 deb systemd[1]: Starting Caddy HTTP/2 web server...\nOct 01 20:45:39 deb systemd[1]: Started Caddy HTTP/2 web server.\nOct 01 20:45:39 deb caddy[26635]: 2016/10/01 20:45:39 [INFO] NLgids localhost: nlgids@deb.atoom.net\nOct 01 20:45:42 deb caddy[26635]: Activating privacy features...2016/10/01 20:45:42 [INFO] Certificate for [www.dnssex.nl] expires in 699h15m17.206609051s; attempting ren\nOct 01 20:45:43 deb caddy[26635]: 2016/10/01 20:45:43 [INFO][www.dnssex.nl] acme: Trying renewal with 699 hours remaining\nOct 01 20:45:43 deb caddy[26635]: 2016/10/01 20:45:43 [INFO][www.dnssex.nl] acme: Obtaining bundled SAN certificate\nOct 01 20:45:43 deb caddy[26635]: 2016/10/01 20:45:43 [INFO][www.dnssex.nl] acme: Trying to solve TLS-SNI-01\nOct 01 20:45:45 deb caddy[26635]: 2016/10/01 20:45:45 [INFO][www.dnssex.nl] The server validated our request\nOct 01 20:45:45 deb caddy[26635]: 2016/10/01 20:45:45 [INFO][www.dnssex.nl] acme: Validations succeeded; requesting certificates\nOct 01 20:45:45 deb caddy[26635]: 2016/10/01 20:45:45 [INFO] acme: Requesting issuer cert from https://acme-v01.api.letsencrypt.org/acme/issuer-cert\nOct 01 20:45:46 deb caddy[26635]: 2016/10/01 20:45:46 [INFO][www.dnssex.nl] Server responded with a certificate.\nOct 01 20:45:46 deb caddy[26635]: 2016/10/01 20:45:46 [INFO] Certificate for [www.isitinfra.net] expires in 699h21m13.896591197s; attempting renewal\nOct 01 20:45:46 deb caddy[26635]: 2016/10/01 20:45:46 [INFO][www.isitinfra.net] acme: Trying renewal with 699 hours remaining\nOct 01 20:45:46 deb caddy[26635]: 2016/10/01 20:45:46 [INFO][www.isitinfra.net] acme: Obtaining bundled SAN certificate\nOct 01 20:45:46 deb caddy[26635]: 2016/10/01 20:45:46 [INFO][www.isitinfra.net] acme: Trying to solve HTTP-01\nOct 01 20:45:47 deb caddy[26635]: 2016/10/01 20:45:47 [INFO][www.isitinfra.net] Served key authentication\nOct 01 20:45:48 deb caddy[26635]: 2016/10/01 20:45:48 [INFO][www.isitinfra.net] The server validated our request\nOct 01 20:45:48 deb caddy[26635]: 2016/10/01 20:45:48 [INFO][www.isitinfra.net] acme: Validations succeeded; requesting certificates\nOct 01 20:45:48 deb caddy[26635]: 2016/10/01 20:45:48 [INFO] acme: Requesting issuer cert from https://acme-v01.api.letsencrypt.org/acme/issuer-cert\nOct 01 20:45:48 deb caddy[26635]: 2016/10/01 20:45:48 [INFO][www.isitinfra.net] Server responded with a certificate.\nOct 01 20:45:48 deb caddy[26635]: 2016/10/01 20:45:48 [INFO] Certificate for [miek.nl ] expires in 699h14m11.202888651s; attempting renewal\nOct 01 20:45:48 deb caddy[26635]: 2016/10/01 20:45:48 [INFO][miek.nl] acme: Trying renewal with 699 hours remaining\nOct 01 20:45:49 deb caddy[26635]: 2016/10/01 20:45:49 [INFO][miek.nl] acme: Obtaining bundled SAN certificate\nOct 01 20:45:49 deb caddy[26635]: 2016/10/01 20:45:49 [INFO][miek.nl] acme: Trying to solve TLS-SNI-01\ndeb# journalctl -fu caddy\n-- Logs begin at Fri 2016-09-30 19:54:00 UTC. --\nOct 01 20:46:00 deb caddy[26635]: 2016/10/01 20:46:00 [INFO][www.berkestoffering.nl] acme: Obtaining bundled SAN certificate\nOct 01 20:46:01 deb caddy[26635]: 2016/10/01 20:46:01 [INFO][www.berkestoffering.nl] acme: Trying to solve HTTP-01\nOct 01 20:46:01 deb caddy[26635]: 2016/10/01 20:46:01 [INFO][www.berkestoffering.nl] Served key authentication\nOct 01 20:46:02 deb caddy[26635]: 2016/10/01 20:46:02 [INFO][www.berkestoffering.nl] The server validated our request\nOct 01 20:46:02 deb caddy[26635]: 2016/10/01 20:46:02 [INFO][www.berkestoffering.nl] acme: Validations succeeded; requesting certificates\nOct 01 20:46:03 deb caddy[26635]: 2016/10/01 20:46:03 [INFO] acme: Requesting issuer cert from https://acme-v01.api.letsencrypt.org/acme/issuer-cert\nOct 01 20:46:03 deb caddy[26635]: 2016/10/01 20:46:03 [INFO][www.berkestoffering.nl] Server responded with a certificate.\nOct 01 20:46:03 deb caddy[26635]: 2016/10/01 20:46:03 [INFO] Certificate for [www.atoom.net] expires in 699h18m56.277058473s; attempting renewal\nOct 01 20:46:03 deb caddy[26635]: 2016/10/01 20:46:03 [INFO][www.atoom.net] acme: Trying renewal with 699 hours remaining\nOct 01 20:46:04 deb caddy[26635]: 2016/10/01 20:46:04 [INFO][www.atoom.net] acme: Obtaining bundled SAN certificate\nOct 01 20:46:04 deb caddy[26635]: 2016/10/01 20:46:04 [INFO][www.atoom.net] acme: Trying to solve HTTP-01\nOct 01 20:46:05 deb caddy[26635]: 2016/10/01 20:46:05 [INFO][www.atoom.net] Served key authentication\nOct 01 20:46:06 deb caddy[26635]: 2016/10/01 20:46:06 [INFO][www.atoom.net] The server validated our request\nOct 01 20:46:06 deb caddy[26635]: 2016/10/01 20:46:06 [INFO][www.atoom.net] acme: Validations succeeded; requesting certificates\nOct 01 20:46:06 deb caddy[26635]: 2016/10/01 20:46:06 [INFO] acme: Requesting issuer cert from https://acme-v01.api.letsencrypt.org/acme/issuer-cert\nOct 01 20:46:06 deb caddy[26635]: 2016/10/01 20:46:06 [INFO][www.atoom.net] Server responded with a certificate.\nOct 01 20:46:06 deb caddy[26635]: 2016/10/01 20:46:06 [INFO] Certificate for [isitinfra.net] expires in 699h18m53.361987199s; attempting renewal\nOct 01 20:46:06 deb caddy[26635]: 2016/10/01 20:46:06 [INFO][isitinfra.net] acme: Trying renewal with 699 hours remaining\nOct 01 20:46:07 deb caddy[26635]: 2016/10/01 20:46:07 [INFO][isitinfra.net] acme: Obtaining bundled SAN certificate\nOct 01 20:46:07 deb caddy[26635]: 2016/10/01 20:46:07 [INFO][isitinfra.net] acme: Trying to solve HTTP-01\nOct 01 20:46:07 deb caddy[26635]: 2016/10/01 20:46:07 [INFO][isitinfra.net] Served key authentication\nOct 01 20:46:08 deb caddy[26635]: 2016/10/01 20:46:08 [INFO][isitinfra.net] The server validated our request\nOct 01 20:46:08 deb caddy[26635]: 2016/10/01 20:46:08 [INFO][isitinfra.net] acme: Validations succeeded; requesting certificates\nOct 01 20:46:09 deb caddy[26635]: 2016/10/01 20:46:09 [INFO] acme: Requesting issuer cert from https://acme-v01.api.letsencrypt.org/acme/issuer-cert\nOct 01 20:46:09 deb caddy[26635]: 2016/10/01 20:46:09 [INFO][isitinfra.net] Server responded with a certificate.\nOct 01 20:46:09 deb caddy[26635]: 2016/10/01 20:46:09 [INFO] Certificate for [archive.miek.nl] expires in 699h14m50.622164874s; attempting renewal\nOct 01 20:46:09 deb caddy[26635]: 2016/10/01 20:46:09 [INFO][archive.miek.nl] acme: Trying renewal with 699 hours remaining\nOct 01 20:46:09 deb caddy[26635]: 2016/10/01 20:46:09 [INFO][archive.miek.nl] acme: Obtaining bundled SAN certificate\nOct 01 20:46:10 deb caddy[26635]: 2016/10/01 20:46:10 [INFO][archive.miek.nl] acme: Could not find solver for: dns-01\nOct 01 20:46:10 deb caddy[26635]: 2016/10/01 20:46:10 [INFO][archive.miek.nl] acme: Trying to solve TLS-SNI-01\nOct 01 20:46:11 deb caddy[26635]: 2016/10/01 20:46:11 [INFO][archive.miek.nl] The server validated our request\nOct 01 20:46:11 deb caddy[26635]: 2016/10/01 20:46:11 [INFO][archive.miek.nl] acme: Validations succeeded; requesting certificates\nOct 01 20:46:12 deb caddy[26635]: 2016/10/01 20:46:12 [INFO] acme: Requesting issuer cert from https://acme-v01.api.letsencrypt.org/acme/issuer-cert\nOct 01 20:46:12 deb caddy[26635]: 2016/10/01 20:46:12 [INFO][archive.miek.nl] Server responded with a certificate.\nOct 01 20:46:12 deb caddy[26635]: 2016/10/01 20:46:12 [INFO] Certificate for [nlgids.london] expires in 699h14m47.650614623s; attempting renewal\nOct 01 20:46:12 deb caddy[26635]: 2016/10/01 20:46:12 [INFO][nlgids.london] acme: Trying renewal with 699 hours remaining\nOct 01 20:46:12 deb caddy[26635]: 2016/10/01 20:46:12 [INFO][nlgids.london] acme: Obtaining bundled SAN certificate\nOct 01 20:46:13 deb caddy[26635]: 2016/10/01 20:46:13 [INFO][nlgids.london] acme: Trying to solve TLS-SNI-01\nOct 01 20:46:15 deb caddy[26635]: 2016/10/01 20:46:15 [INFO][nlgids.london] The server validated our request\nOct 01 20:46:15 deb caddy[26635]: 2016/10/01 20:46:15 [INFO][nlgids.london] acme: Validations succeeded; requesting certificates\nOct 01 20:46:15 deb caddy[26635]: 2016/10/01 20:46:15 [INFO] acme: Requesting issuer cert from https://acme-v01.api.letsencrypt.org/acme/issuer-cert\nOct 01 20:46:15 deb caddy[26635]: 2016/10/01 20:46:15 [INFO][nlgids.london] Server responded with a certificate.\nOct 01 20:46:15 deb caddy[26635]: 2016/10/01 20:46:15 [INFO] Certificate for [berkestoffering.nl] expires in 699h14m44.235123573s; attempting renewal\nOct 01 20:46:15 deb caddy[26635]: 2016/10/01 20:46:15 [INFO][berkestoffering.nl] acme: Trying renewal with 699 hours remaining\nOct 01 20:46:16 deb caddy[26635]: 2016/10/01 20:46:16 [INFO][berkestoffering.nl] acme: Obtaining bundled SAN certificate\nOct 01 20:46:16 deb caddy[26635]: 2016/10/01 20:46:16 [INFO][berkestoffering.nl] acme: Trying to solve HTTP-01\nOct 01 20:46:17 deb caddy[26635]: 2016/10/01 20:46:17 [INFO][berkestoffering.nl] Served key authentication\nOct 01 20:46:18 deb caddy[26635]: 2016/10/01 20:46:18 [INFO][berkestoffering.nl] The server validated our request\nOct 01 20:46:18 deb caddy[26635]: 2016/10/01 20:46:18 [INFO][berkestoffering.nl] acme: Validations succeeded; requesting certificates\nOct 01 20:46:20 deb caddy[26635]: 2016/10/01 20:46:20 [INFO] acme: Requesting issuer cert from https://acme-v01.api.letsencrypt.org/acme/issuer-cert\nOct 01 20:46:20 deb caddy[26635]: 2016/10/01 20:46:20 [INFO][berkestoffering.nl] Server responded with a certificate.\nOct 01 20:46:20 deb caddy[26635]: 2016/10/01 20:46:20 [INFO] Certificate for [atoom.net] expires in 699h18m39.180178862s; attempting renewal\nOct 01 20:46:21 deb caddy[26635]: 2016/10/01 20:46:21 [INFO][atoom.net] acme: Trying renewal with 699 hours remaining\nOct 01 20:46:21 deb caddy[26635]: 2016/10/01 20:46:21 [INFO][atoom.net] acme: Obtaining bundled SAN certificate\nOct 01 20:46:21 deb caddy[26635]: 2016/10/01 20:46:21 [INFO][atoom.net] acme: Trying to solve HTTP-01\nOct 01 20:46:22 deb caddy[26635]: 2016/10/01 20:46:22 [INFO][atoom.net] Served key authentication\nOct 01 20:46:23 deb caddy[26635]: 2016/10/01 20:46:23 [INFO][atoom.net] The server validated our request\nOct 01 20:46:23 deb caddy[26635]: 2016/10/01 20:46:23 [INFO][atoom.net] acme: Validations succeeded; requesting certificates\nOct 01 20:46:23 deb caddy[26635]: 2016/10/01 20:46:23 [INFO] acme: Requesting issuer cert from https://acme-v01.api.letsencrypt.org/acme/issuer-cert\nOct 01 20:46:23 deb caddy[26635]: 2016/10/01 20:46:23 [INFO][atoom.net] Server responded with a certificate.\nOct 01 20:46:26 deb caddy[26635]:  done.\nOct 01 20:46:26 deb caddy[26635]: https://miek.nl\nOct 01 20:46:26 deb caddy[26635]: https://www.miek.nl\nOct 01 20:46:26 deb caddy[26635]: https://archive.miek.nl\nOct 01 20:46:26 deb caddy[26635]: https://nlgids.london\nOct 01 20:46:26 deb caddy[26635]: https://www.nlgids.london\nOct 01 20:46:26 deb caddy[26635]: https://coredns.io\nOct 01 20:46:26 deb caddy[26635]: https://www.coredns.io\nOct 01 20:46:26 deb caddy[26635]: https://blog.coredns.io\nOct 01 20:46:26 deb caddy[26635]: https://dnssex.nl\nOct 01 20:46:26 deb caddy[26635]: https://www.dnssex.nl\nOct 01 20:46:26 deb caddy[26635]: https://www.berkestoffering.nl\nOct 01 20:46:26 deb caddy[26635]: https://berkestoffering.nl\nOct 01 20:46:26 deb caddy[26635]: https://atoom.net\nOct 01 20:46:26 deb caddy[26635]: https://www.atoom.net\nOct 01 20:46:26 deb caddy[26635]: https://isitinfra.net\nOct 01 20:46:26 deb caddy[26635]: https://www.isitinfra.net\nOct 01 20:46:26 deb caddy[26635]: http://wereldstadsgidsen.com\nOct 01 20:46:26 deb caddy[26635]: http://www.wereldstadsgiden.com\nOct 01 20:46:26 deb caddy[26635]: http://wereldstadgidsen.nl\nOct 01 20:46:26 deb caddy[26635]: http://www.wereldstadgidsen.nl\nOct 01 20:46:26 deb caddy[26635]: http://wereldstadgidsen.be\nOct 01 20:46:26 deb caddy[26635]: http://www.wereldstadgidsen.be\nOct 01 20:46:26 deb caddy[26635]: http://miek.nl\nOct 01 20:46:26 deb caddy[26635]: http://www.miek.nl\nOct 01 20:46:26 deb caddy[26635]: http://archive.miek.nl\nOct 01 20:46:26 deb caddy[26635]: http://nlgids.london\nOct 01 20:46:26 deb caddy[26635]: http://www.nlgids.london\nOct 01 20:46:26 deb caddy[26635]: http://coredns.io\nOct 01 20:46:26 deb caddy[26635]: http://www.coredns.io\nOct 01 20:46:26 deb caddy[26635]: http://blog.coredns.io\nOct 01 20:46:26 deb caddy[26635]: http://dnssex.nl\nOct 01 20:46:26 deb caddy[26635]: http://www.dnssex.nl\nOct 01 20:46:26 deb caddy[26635]: http://www.berkestoffering.nl\nOct 01 20:46:26 deb caddy[26635]: http://berkestoffering.nl\nOct 01 20:46:26 deb caddy[26635]: http://atoom.net\nOct 01 20:46:26 deb caddy[26635]: http://www.atoom.net\nOct 01 20:46:26 deb caddy[26635]: http://isitinfra.net\nOct 01 20:46:26 deb caddy[26635]: http://www.isitinfra.net\n```\n### 7. How can someone who is starting from scratch reproduce this behavior as minimally as possible?\n\nGood question.\n"},"comment":{"url":"https://api.github.com/repos/mholt/caddy/issues/comments/264103545","html_url":"https://github.com/mholt/caddy/issues/1157#issuecomment-264103545","issue_url":"https://api.github.com/repos/mholt/caddy/issues/1157","id":264103545,"user":{"login":"miekg","id":353371,"avatar_url":"https://avatars.githubusercontent.com/u/353371?v=3","gravatar_id":"","url":"https://api.github.com/users/miekg","html_url":"https://github.com/miekg","followers_url":"https://api.github.com/users/miekg/followers","following_url":"https://api.github.com/users/miekg/following{/other_user}","gists_url":"https://api.github.com/users/miekg/gists{/gist_id}","starred_url":"https://api.github.com/users/miekg/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/miekg/subscriptions","organizations_url":"https://api.github.com/users/miekg/orgs","repos_url":"https://api.github.com/users/miekg/repos","events_url":"https://api.github.com/users/miekg/events{/privacy}","received_events_url":"https://api.github.com/users/miekg/received_events","type":"User","site_admin":false},"created_at":"2016-12-01T07:59:19Z","updated_at":"2016-12-01T07:59:19Z","body":"Damn....\r\nThis worked:\r\n~~~\r\nNov 29 22:49:28 deb caddy[17021]: 2016/11/29 22:49:28 [INFO] Scanning for expiring certificates\r\nNov 29 22:49:28 deb caddy[17021]: 2016/11/29 22:49:28 [INFO] Done checking certificates\r\nNov 29 22:49:28 deb caddy[17021]: 2016/11/29 22:49:28 [INFO] Scanning for stale OCSP staples\r\nNov 29 22:49:28 deb caddy[17021]: 2016/11/29 22:49:28 [INFO] Advancing OCSP staple for [blog.coredns.io] from 2016-12-02 20:00:00 +0000 UTC to 2016-12-06 21:00:00 +0000 UTC\r\nNov 29 22:49:28 deb caddy[17021]: 2016/11/29 22:49:28 [INFO] Done checking OCSP staples\r\n~~~\r\nThen later an actual renewal\r\n~~~\r\nNov 30 22:49:28 deb caddy[17021]: 2016/11/30 22:49:28 [INFO] Scanning for expiring certificates\r\nNov 30 22:49:28 deb caddy[17021]: 2016/11/30 22:49:28 [INFO] Certificate for [www.dnssex.nl] expires in 716h56m31.550378096s; attempting renewal\r\n~~~\r\nFor `nlgids.london` I never see the new certs in the logs:\r\n~~~\r\nNov 30 22:49:39 deb caddy[17021]: 2016/11/30 22:49:39 [INFO][archive.miek.nl] The server validated our request\r\nNov 30 22:49:39 deb caddy[17021]: 2016/11/30 22:49:39 [INFO][archive.miek.nl] acme: Validations succeeded; requesting certificates\r\nNov 30 22:49:39 deb caddy[17021]: 2016/11/30 22:49:39 [INFO] acme: Requesting issuer cert from https://acme-v01.api.letsencrypt.org/acme/issuer-cert\r\nNov 30 22:49:39 deb caddy[17021]: 2016/11/30 22:49:39 [INFO][archive.miek.nl] Server responded with a certificate.\r\nNov 30 22:49:39 deb caddy[17021]: 2016/11/30 22:49:39 [INFO] Certificate for [nlgids.london] expires in 716h56m20.429025513s; attempting renewal\r\nNov 30 22:49:39 deb caddy[17021]: 2016/11/30 22:49:39 [INFO][nlgids.london] acme: Trying renewal with 716 hours remaining\r\nNov 30 22:49:39 deb caddy[17021]: 2016/11/30 22:49:39 [INFO][nlgids.london] acme: Obtaining bundled SAN certificate\r\nNov 30 22:49:40 deb caddy[17021]: 2016/11/30 22:49:40 [INFO][nlgids.london] acme: Could not find solver for: dns-01\r\nNov 30 22:49:40 deb caddy[17021]: 2016/11/30 22:49:40 [INFO][nlgids.london] acme: Trying to solve TLS-SNI-01\r\n~~~\r\nthere is no `Server responded with a certificate.`\r\nAfter that I did a request that worked:\r\n~~~\r\nNov 30 22:56:37 deb caddy[17021]: 2001:8b0:bf59:4c3f:a796:8189:437c:4729 - miek.nl GET /css/highlight.css HTTP/2.0 304 0 https://miek.nl/\r\n~~~\r\nThen a bunch of \r\n~~~\r\nDec 01 03:26:37 deb caddy[17021]: 2016/12/01 03:26:37 http: TLS handshake error from 95.28.1.83:51489: tls: client offered an unsupported, maximum protocol version of 301\r\nDec 01 03:26:37 deb caddy[17021]: 2016/12/01 03:26:37 http: TLS handshake error from 95.28.1.83:49455: tls: client offered an unsupported, maximum protocol version of 300\r\n~~~\r\nAnd *then* \r\n~~~\r\nDec 01 04:27:19 deb caddy[17021]: 2016/12/01 04:27:19 [INFO] 176.58.119.54 - No such site at :80 (Remote: 170.0.236.103, Referer: )\r\nDec 01 04:31:03 deb caddy[17021]: 2016/12/01 04:31:03 http: TLS handshake error from [2001:1a50:11:0:5f:8f:ac0c:1]:37502: tls: client offered an unsupported, maximum protocol version of 301\r\nDec 01 04:31:48 deb caddy[17021]: 2016/12/01 04:31:48 http: Accept error: accept tcp [::]:443: accept4: too many open files; retrying in 5ms\r\nDec 01 04:31:48 deb caddy[17021]: 2016/12/01 04:31:48 http: Accept error: accept tcp [::]:443: accept4: too many open files; retrying in 10ms\r\nDec 01 04:31:48 deb caddy[17021]: 2016/12/01 04:31:48 http: Accept error: accept tcp [::]:443: accept4: too many open files; retrying in 20ms\r\nDec 01 04:31:48 deb caddy[17021]: 2016/12/01 04:31:48 http: Accept error: accept tcp [::]:443: accept4: too many open files; retrying in 40ms\r\nDec 01 04:31:48 deb caddy[17021]: 2016/12/01 04:31:48 http: Accept error: accept tcp [::]:443: accept4: too many open files; retrying in 80ms\r\nDec 01 04:31:48 deb caddy[17021]: 2016/12/01 04:31:48 http: Accept error: accept tcp [::]:443: accept4: too many open files; retrying in 160ms\r\nDec 01 04:31:48 deb caddy[17021]: 2016/12/01 04:31:48 http: Accept error: accept tcp [::]:443: accept4: too many open files; retrying in 320ms\r\nDec 01 04:31:49 deb caddy[17021]: 2016/12/01 04:31:49 http: Accept error: accept tcp [::]:443: accept4: too many open files; retrying in 640ms\r\nDec 01 04:31:49 deb caddy[17021]: 2016/12/01 04:31:49 http: Accept error: accept tcp [::]:443: accept4: too many open files; retrying in 1s\r\n~~~\r\nUntil I restarted caddy.\r\n\r\n@mholt : what is the correct/best/fastest way to debug this? Write a test program that tries to mimic this, add more logging (where?)."}}
{"actor":{"display_login":"miekg"}}