Poll the challenge endpoint to make sure it's ready before requesting ACME challenge

Author: FluxCapacitor2

backend/src/handlers/acmeChallenge.ts

@@ -10,6 +10,10 @@ export const handleAcmeChallengeHandler: HandlerMap["acmeChallenge"] = async (
   req,
   res,
 ) => {
+  if (ctx.request.query.probe) {
+    // This request is coming from AnvilOps in backend/src/service/verifyDomain.ts to make sure the challenge is ready before telling Let's Encrypt to complete it.
+    return unsafeGenericResponse(res.send("200 OK").end());
+  }
   try {
     const keyAuthorization = await certGenerationService.handleAcmeChallenge(
       ctx.request.params.token,

backend/src/service/certGeneration.ts

@@ -141,20 +141,42 @@ export class CertGenerationService {
       );
     }
     const challenge = http01Challenges[0];
+    const keyAuth = await challenge.keyAuthorization();
 
     await this.domainRepo.updateCertOrderDetails(
       domainId,
       challenge.token,
-      await challenge.keyAuthorization(),
+      keyAuth,
       order.url,
     );
 
+    // Wait for the challenge to be ready (sometimes, the ingress controller needs time to update its routes)
+    await this.pollChallengeEndpoint(domain.name, challenge.token);
+
     // Tell the CA that we're ready to run our HTTP challenge
     await challenge.submit();
 
     // The rest of the process continues in handleAcmeChallenge, then in finalizeCertOrder
   }
 
+  private async pollChallengeEndpoint(domain: string, token: string) {
+    const deadline = new Date().getTime() + 60 * 1000; // 1 minute from now
+    while (new Date().getTime() < deadline) {
+      // eslint-disable-next-line no-await-in-loop
+      const response = await fetch(
+        `http://${domain}/.well-known/acme-challenge/${token}?probe=true`,
+      );
+      if (response.ok) {
+        return;
+      }
+    }
+
+    logger.warn(
+      { domain },
+      "Timed out waiting for domain's ACME challenge endpoint to become ready",
+    );
+  }
+
   async handleAcmeChallenge(token: string) {
     const domain = await this.domainRepo.getByToken(token);
     if (!domain) {

openapi/openapi.yaml

@@ -24,6 +24,12 @@ paths:
           description: A random string that uniquely identifies the challenge
           schema:
             type: string
+        - name: probe
+          in: query
+          required: false
+          description: If this parameter is set, then the request is coming from AnvilOps while it's waiting for the Ingress configuration to update. These "probe" requests shouldn't trigger the next step of the certificate generation flow.
+          schema:
+            type: boolean
       responses:
         "200":
           description: Success