Self-hosting and IPv6

[chrswk]

Hi

I'm trying to get a cert on a Ubuntu 24.04 server using only IPv6 and cannot get it to work. I can ping the machine on its public IPv6 address and it works fine if I also create an A record for the same machine.

  2025-09-20 19:45:24.391 [INFO] Software version 2.3.4.2067 (release, trimmed, standalone, 64-bit) started
  2025-09-20 19:45:24.393 [DBUG] Running on Unix 6.8.0.79
  ...
  2025-09-20 19:45:42.557 [VERB] [HTTP] Response content: {
  "identifier": {
    "type": "dns",
    "value": "example.org"
  },
  "status": "deactivated",
  "expires": "2025-09-27T19:45:27Z",
  "challenges": [
    {
      "type": "http-01",
      "url": "https://acme-staging-v02.api.letsencrypt.org/acme/chall/229504874/19411614684/VxK5wQ",
      "status": "invalid",
      "validated": "2025-09-20T19:45:37Z",
      "error": {
        "type": "urn:ietf:params:acme:error:connection",
        "detail": "0000:1111:2222:3333:4444:5555:6666:7777: Fetching http://example.org/.well-known/acme-challenge/XXX: Connection refused",
        "status": 400
      },
      "token": "XXX",
      "validationRecord": [
        {
          "url": "http://example.org/.well-known/acme-challenge/XXX",
          "hostname": "example.org",
          "port": "80",
          "addressesResolved": [
            "0000:1111:2222:3333:4444:5555:6666:7777"
          ],
          "addressUsed": "0000:1111:2222:3333:4444:5555:6666:7777"
        }
      ]
    }
  ]
}

I've tried debugging with --test, but I can't seem to get any response from the HTTP server after wacs prints Answer should now be browsable at http://..., even when it's running on the IPv4 address and the validation later works. But maybe I'm holding it wrong...

Let me know if I can provide or test anything else. Would really like to figure this one out 🙈

Thanks
Chris

[WouterTinus]

ChatGPT is convinced - though it cannot provide any real source - that it could help to register separate prefixes for IPv4 and IPv6 with the HttpListener on Linux (whereas on Windows the wildcard works fine, and it also worked fine in Ubuntu virtualized by WSL2).

But because I don't have a better idea what to try, I've tried follow the advice in this build: https://ci.appveyor.com/project/WouterTinus/simple-acme/builds/52778911/artifacts.

Please let me know if that changes things in any way.

[WouterTinus]

Seems Microsoft is not very keen on supporting HttpListener on non-Windows platforms given the age of some of these issues.

Another solution suggested here and there is to spin up an instance of Kestrel, but that would bring a lot of asp.net dependencies. Another solution could be to use a third party lightweight http server on Linux. I'll have to look into the options a bit more.

[WouterTinus]

Could you give this build a go? This is the Kestrel based solution: https://ci.appveyor.com/project/WouterTinus/simple-acme/builds/52781717/artifacts

[WouterTinus]

@chrswk ?

[WouterTinus]

If anyone has a Linux box with IPv6 only, please test this build :)

[WouterTinus]

Hi @chrswk - I made the effort to try and resolve your issue, please take some time to test the possible solution.