[SOLVED] Lets Encrypt Fails On .Onion Address

Support
1

Hi
I receive the following error when attempting to run the lets encrypt app on an onion address. Its all foreign to me! Can anyone help troubleshoot this gobbledegook?

Error:
Failed to obtain certificate for domain xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxonion Details

Error running action: letsencrypt..obtain(“xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxonion”): CalledProcessError(1, [“certbot”, “certonly”, “–non-interactive”, “–text”, “–agree-tos”, “–register-unsafely-without-email”, “–domain”, “xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxonion”, “–authenticator”, “webroot”, “–webroot-path”, “/var/www/html”, “–renew-by-default”])
Stdout:
│ Requesting a certificate for xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxonion
Stderr:
║ Saving debug log to /var/log/letsencrypt/letsencrypt.log
║ An unexpected error occurred:
║ Error creating new order :: Cannot issue for “xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxonion”: The ACME server refuses to issue a certificate for this domain name, because it is forbidden by policy
║ Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.
Action traceback:
╞ File “/usr/lib/python3/dist-packages/plinth/actions.py”, line 496, in _privileged_call
╞ return_values = func(*arguments[‘args’], **arguments[‘kwargs’])
╞ File “/usr/lib/python3/dist-packages/plinth/modules/letsencrypt/privileged.py”, line 136, in obtain
╞ action_utils.run(command, check=True)
╞ ~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^
╞ File “/usr/lib/python3/dist-packages/plinth/action_utils.py”, line 838, in run
╞ raise exception
╞ File “/usr/lib/python3/dist-packages/plinth/action_utils.py”, line 825, in run
╞ process = subprocess.run(command, **kwargs)
╞ File “/usr/lib/python3.13/subprocess.py”, line 577, in run
╞ raise CalledProcessError(retcode, process.args,
╞ output=stdout, stderr=stderr)

2

Let’s Encrypt project does not yet issue certificates for .onion addresses. Communicating to a .onion domain is already peer-to-peer encrypted and does not need a TLS certificate and HTTP is safe. It should be safe to use a self-signed certificate (ignoring the browser warning) for HTTPS communication.

3

Thank you for explaining that a TLS cert isn’t required when communicating with onion addresses. However, I believe I may have a case which challenges that assumption.
I have an Miniflux Client on Android named “Flux News”, which refuses to communicate with Miniflux over onion addresses because it requires an https connection.
I’m aware of many onion sites that are https enabled - hence I know its possible to obtain a Cert for these onion sites.
Does anyone have a possible solution to my conundrum?