RavenDB 5.3.102 Issue Errors with installation and Lets Encrypt bug

user_1452007 0
Viewed 69

I have, unsuccessfully, been trying to install RavenDB 5 on a Win 2012R2 server in secure mode, however, getting error messages that are not in Raven's documentation under troubleshooting. I have seen similar errors and applied all their suggestions - they blame port numbers being blocked on firewalls (disabled firewall completely - so no luck there) or IP address binding (when I set it up in unsecure mode, it worked fine - so no luck there). I am using the downloaded version Free Community version. I think maybe that Windows Server 2012R2 does not support TLS1.2 or there's a configuration issue

Here's the message

    Setting up RavenDB in Let's Encrypt security mode failed.
System.InvalidOperationException: Setting up RavenDB in Let's Encrypt security mode failed.

 ---> System.InvalidOperationException: Validation failed.

 ---> System.InvalidOperationException: Failed to simulate running the server with the supplied settings using: https://a.******.ravendb.community:60443

 ---> System.Net.Http.HttpRequestException: The SSL connection could not be established, see inner exception.

 ---> System.Security.Authentication.AuthenticationException: Authentication failed because the remote party sent a TLS alert: 'HandshakeFailure'.

 ---> System.ComponentModel.Win32Exception (0x80090326): The message received was unexpected or badly formatted.

   --- End of inner exception stack trace ---

Besides disabling the firewall in WinServer completely (tried opening every port that may be a problem including 60443, 38888, 8080 (I know, it's not there, but), 80, 443, but that did nothing, so I disabled the firewall (bad form - yes, I know).
Since I use Let's Encrypt on IIS for a couple of other sites with other port #s and have not had any problem with auto-renewals, I figure that maybe it's a Kestrel configuration issue (so looking into this). The ambiguity of this error: HandshakeFailure could mean hundreds of different things, so it's hard to determine what.
It looks like RavenDB is running a simulation "Failed to simulate running the server" and, perhaps it's a bug on their end (perhaps LetsEncrypt does not recognize the simulation?). Anywho, before saying to heck with this DB (which has raving reviews) and moving on to another NoSQL database like FoundationDB or CouchDB, I'd love to figure out how to secure it. It DOES WORK in nonsecure mode fine!! Any ideas?

windows-server-2012-r2 lets-encrypt ravendb
2 Answers

The issue is that Windows Server 2012R2 lacks the ciphers that are required by RavenDB.

To fix that, please make sure you enabled TLS 1.2 and add the following ciphers: required ciphers

You can use IIS Crypto to add the ciphers, please see:
https://stackoverflow.com/a/63274439/11341261

user_113412610

Turns out, Windows Server 2012R2 does not come with the following cipher suites:

TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

Because of this, it's not possible to use Let's Encrypt (as configured for RavenDB) on a Windows 2012R2 Server.

user_14520070
Related