Forums Archived

This forum has been archived. No new posts can be made and no new users can sign up. It remains here for reference only.

Find the new forums here

Download / Update error when setting up Minecraft Forge server

  • 625 Views
  • Last Post 04 January 2022
  • Topic Is Solved
Arotahi posted this 28 December 2021

OS Name/Version: Debian GNU/Linux 11 (bullseye)

Product Name/Version: AMP v2.3.0.8

Problem Description: Unable to set up Minecraft Forge server. Selecting "Forge" server type and clicking "Download / Update" results in the following error: "Download / Update failed : Couldn't determine the URL to fetch an update from. You may need to install this server type manually."

The error does not occur with other Minecraft server types (e.g. Official, Tekkit, Spigot).

Steps to reproduce:

  • Create a fresh Minecraft server instance in AMP.
  • Manage the Minecraft instance.
  • Under Configuration > Server Settings > Server type, select "Forge".
  • Click "Download / Update". The above error message results.

Actions taken to resolve so far:

  • Created a fresh instance.
  • Upgraded instance to latest version (v2.3.0.8).
  • Pinging files.minecraftforge.net - works normally.
  • Checked firewall config. Outbound connections are allowed by default. Disabling firewall makes no difference. Firewall log shows no connection activity when attempting to download/update Forge server - more details in comments below.
  • Enabled debug logging on the instance. Log shows an HttpRequestException error when connecting to minecraftforge.net - more details in comments below.
  • Uninstalled (purged) and reinstalled AMP.

amp forge server minecraft
Order By: Standard | Newest | Votes
AbhorrentJoel posted this 28 December 2021

Appears to work on Ubuntu with AMP v2.3.0.8. I would suggest that there is a potential network issue preventing you from downloading it.

To my knowledge, AMP downloads Forge from files.minecraftforge.net (at least what I can see from netstat). First step would be to try to access/ping this address from the system you are running AMP on. For me, it returns 51.79.83.165 for IPv4 and 2607:5300:203:65a5:: for IPv6.

If you do not get a reply when pinging the hostname, then there is likely a problem with your network setup. If it resolves the correct IP address, then you can rule out a DNS issue. But then it is likely to be a firewall issue.

Please let me know how this goes.

Arotahi posted this 28 December 2021

Thanks for the suggestion, but I'm not so sure it's a firewall issue.

Pinging files.minecraftforge.net works as expected. I get the same IP addresses you do, 0% packet loss, and ~200ms latency (normal - I'm in NZ).

I've tried disabling UFW, but no difference. The firewall is to allow outbound connections by default. Also the log shows no attempted connection when I download/update for a Forge server. By comparison, when I do the same for other server types (which work normally), I see expected activity like the following.

Spigot server (spigotmc.org)

Dec 29 03:32:18 Acedia kernel: [31534.437889] [UFW ALLOW] IN= OUT=eth0 SRC=192.168.0.2 DST=104.27.195.95 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=52385 DF PROTO=TCP SPT=47898 DPT=443 WINDOW=64240 RES=0x00 SYN URGP=0

Paper server: (papermc.io)

Dec 29 03:37:29 Acedia kernel: [31845.120729] [UFW ALLOW] IN= OUT=eth0 SRC=192.168.0.2 DST=104.26.12.138 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=9995 PROTO=TCP SPT=60536 DPT=443 WINDOW=64240 RES=0x00 SYN URGP=0

But for a Forge server, the log shows no attempted outbound connections at all. Certainly there's no indication of a connection (allowed or denied) to minecraftforge.net.

AbhorrentJoel posted this 28 December 2021

At least that rules out a firewall issue on the machine itself.

One thing you could do next is stop the instance, set the Monitoring.LogLevel to 0 in the AMPConfig.conf for the instance, and then start the instance again. Once that is done, try to update it again and see what the debugging says in the log.

Arotahi posted this 29 December 2021

Ok, done that. Here are some potentially relevant lines from the log.

Looks like this occurs during instance startup:

[13:49:45] [Core Info]            : Checking for AMP updates...
[13:49:46] [Minecraft Debug]      : Got info for Spigot OK (took 918ms)
[13:49:46] [Core Debug]           : Successfully got update data.
[13:49:46] [Core Info]            : AMP is up-to-date.
[13:49:47] [Minecraft Warning]    : Failed to get latest forge version data from http://files.minecraftforge.net/maven/net/minecraftforge/forge/maven-metadata.xml
[13:49:47] [Core Error]           : HttpRequestException
[13:49:47] [Core Error]           : [0] (HttpRequestException) : The SSL connection could not be established, see inner exception.
[13:49:47] [Core Error]           :   at MinecraftModule.UpdateManager.GetForgeUpdateData () 
[13:49:47] [Core Error]           : AuthenticationException
[13:49:47] [Core Error]           : [1] (AuthenticationException) : Authentication failed, see inner exception.
[13:49:47] [Core Error]           : MonoBtlsException
[13:49:47] [Core Error]           : [2] (MonoBtlsException) : Ssl error:1000007d:SSL routines:OPENSSL_internal:CERTIFICATE_VERIFY_FAILED
  at /usr/src/mono/external/boringssl/ssl/handshake_client.c:1132
[13:49:47] [Core Error]           :   at Framework.Btls.FrameworkBtlsContext.ProcessHandshake () at Framework.Net.Security.MobileAuthenticatedStream.ProcessHandshake (Framework.Net.Security.AsyncOperationStatus status, Boolean renegotiate) 
  at (wrapper remoting-invoke-with-check) Framework.Net.Security.MobileAuthenticatedStream.ProcessHandshake(Framework.Net.Security.AsyncOperationStatus,bool)
  at Framework.Net.Security.AsyncHandshakeRequest.Run (Framework.Net.Security.AsyncOperationStatus status) 
[13:49:47] [Minecraft Debug]      : Got info for Forge OK (took 907ms)
[13:49:47] [Minecraft Debug]      : Exception Fetching info for Feed The Beast (Old Source)
[13:49:47] [Minecraft Debug]      : The SSL connection could not be established, see inner exception.
[13:49:49] [Minecraft Debug]      : Got info for Sponge OK (took 1387ms)
[13:49:50] [Minecraft Debug]      : Got info for Paper OK (took 1329ms)

Then these lines appear when I attempt to download/update Forge versions (repeating for each attempt):

[13:50:26] [API:amp-admin Activity] : Updating the application.
[13:50:26] [Minecraft:amp-admin Warning] : Couldn't determine URL to fetch update from.

So, SSL certificate issue? I'm afraid that's a bit over my head. I can access the XML file on minecraftforge.net just fine from a web browser on the same machine, running under the same user, so the issue seems to be more specific to AMP.

Arotahi posted this 31 December 2021

I've tried doing an uninstall (purge) of AMP and a fresh install using the quick install script. This has not resolved the problem.

AbhorrentJoel posted this 31 December 2021

I do not have a solution as of yet, since this is not a problem I have encountered before. I want to take a guess that the problem is not related with AMP but rather something else installed on your system - perhaps Mono certs are not up to date? I think something like the cert-sync command may resolve - for example: cert-sync /etc/ssl/certs/ca-certificates.crt.

You may need to tweak the parameters, but let me know how it goes.

  • Liked by
  • Arotahi
Arotahi posted this 03 January 2022

Ok, cert-sync in itself didn't solve it, but that gave me a useful lead. As best I can tell, the issue related to the expiry of the root certificate DST Root CA X3 in September 2021.

After poking around for a bit I got it working. Posted here in case this is useful for anyone else with a similar issue.

  1. Disabled the now-obsolete DST_Root_CA_X3.crt in /etc/ca-certificates.conf
  2. Trusted the certs used for minecraftforge.net via certmgr -ssl http://files.minecraftforge.net/maven/net/minecraftforge/forge/maven-metadata.xml (ignored warnings about it being invalid).
  3. Synced certs via cert-sync /etc/ssl/certs/ca-certificates.crt
  4. Restarted the AMP instance.

Not sure I entirely resolved the underlying issue, but at least it's got AMP working as expected.

Thanks for the help!

P.S. useful references:

AbhorrentJoel posted this 03 January 2022

Interesting results. I'm surprised that Debian 11, which shipped within the last year, has an expired certificate already. Though after reviewing your links - and doing my own digging - I can see it is due to ISRG Root X1 replacing DST Root CA X3, and it only impacts websites using Let's Encrypt certificates. I was not even aware of this until today. I think I may have read about it back in September 2021, but I have not been impacted at all that I remember.

  • Liked by
  • Arotahi
Arotahi posted this 04 January 2022

Judging by various comments online, I'd say I'm not the only person to issues with Debian 11 & DST Root CA X3.

Mike posted this 04 January 2022

Looks like you're on an old version of ampinstmgr because newer versions fix this all automatically. Check ampinstmgr version.

Live Chat Register to post
Categories
Search
Popular Tags
This Weeks High Earners
Hot Topics
Close