Acme Challenge Failed to Download Challenge Files

Help
1

My domain is: cleo4.ddns.net

I ran this command: Renewal script for cerbot.

It produced this output:

Certbot failed to authenticate some domains (authenticator: webroot). The Certificate Authority reported these problems:
Identifier: cleo4.ddns.net
Type: connection
Detail: xxx.xxx.xxx.x: Fetching http://cleo4.ddns.net/.well-known/acme-challenge/WHVNGCMuBBYGX7weHkWkvTdyicQVza9KQzTxLYzomgA: Timeout during connect (likely firewall problem)

Hint: The Certificate Authority failed to download the temporary challenge files created by Certbot. Ensure that the listed identifiers serve their content from the provided --webroot-path/-w and that files created there can be downloaded from the internet.

Failed to renew certificate cleo4.ddns.net with error: Some challenges have failed.

My web server is (include version): Apache2 v 2.4.52

The operating system my web server runs on is (include version): Kubuntu 22.04

My hosting provider, if applicable, is: NoIp for dns, self hosted.

I can login to a root shell on my machine (yes or no, or I don't know): Yes.

I'm using a control panel to manage my site (no, or provide the name and version of the control panel): No.

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): Certbot 5.6.0

NOTES:

Port forwarding and firewall open for port 80. I think the issue might lie in my virtualhost configuration. Running curl on port 80 for my server address times out. Virtualhost config is redirecting all traffic to https. I'm trying to allow the acme challenge to be the exception, but I'm not getting it right. Forgive me as I'm fairly inexperienced when it comes to troubleshooting.

Here is my virtualhost config. You'll see I have a half cooked attempt to allow the acme challenge in the RewriteEngine section:

<VirtualHost *:80>
  ServerName cleo4.ddns.net
        Redirect permanent / https://cleo4.ddns.net

  ServerAdmin webmaster@localhost
  DocumentRoot /var/www/html


  ErrorLog ${APACHE_LOG_DIR}/error.log
  CustomLog ${APACHE_LOG_DIR}/access.log combined

RewriteEngine on
RewriteCond %{SERVER_NAME} =cleo4.ddns.net
#Exclude Acme Challenge from HTTPS redirect.
RewriteCond %{REQUEST_URI} !^/\.well\-known/acme\-challenge/
RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]

  #Setup for Acme Challenge for Renewals.

Alias /.well-known/acme-challenge/ /var/www/letsencrypt/.well-known/acme-challenge/
  <Directory "/var/www/letsencrypt/.well-known/acme-challenge/">
      Options None
      AllowOverride None
      ForceType text/plain
      RedirectMatch 404 "^(?!/\.well-known/acme-challenge/[\w-]{43}$)"
  </Directory>

</VirtualHost>

<VirtualHost *:443>
  <IfModule mod_headers.c>
  Header always set Strict-Transport-Security "max-age=15552000; includeSubDomains"
</VirtualHost>

vim: syntax=apache ts=4 sw=4 sts=4 sr noet

2

@Fredderson, welcome to the community! :slightly_smiling_face:

It looks like the issue is what the original error says:

Here is some further info:

I suggest checking, is the IP correct for the domain name?
Is the port 80 open on your router/firewall and the inbound connection is forwarded to the appropriate device?

3

Hi @bruncsak thanks!

IP is correct for domain server, as my OwnCloud server is still working with security exceptions, and using curl https://cleo4.ddns.net comes back with a certificate out of date error.

Ports are forwarded correctly, 80 is open on modem, router, and firewall. I even tried to DMZ the router and modem for a test but still no luck.

It's worth noting that this error came suddenly for this month, until now has been working solid for a few years. Could have been an update that buggered my configs. No distro upgrades, just using the extended LTS for Kubuntu 22.04.

My next step is virtualhost config but I'm hung up on it. My thinking is that port 80 is being redirected to 443 and I need to add an exception for letsencrypt.

Cheers and thanks again!

4

There's a firewall somewhere that's blocking it, perhaps at your ISP. This has nothing to do with your virtual host config.

5

No, if HTTP requests actually reached your Apache we would get the redirect as a reply. That is not happening.

Can you reach your Apache from outside your local network? Like using a mobile phone with wifi disabled?

Because all other HTTP tests to port 80 from the public internet are failing. Example: Check website performance and response : Check host - online website monitoring

Has your ISP started blocking port 80? Are you sure your firewall does not have a new setting?

6

Thank you guys. Huge help. I had the firewall disabled via GUI, but it didn't take. Checked in the terminal and it was active, and somewhere along the way it had blocked port 80!

Thank you very much for narrowing down for me. I was absolutely certain I had eliminated my firewall as a possibilty. Can't thank you enough.

7

Glad we could help. You should fix your VirtualHost though

Here's a thread with some examples to avoid redirecting the acme challenge. Your redirect permanent is best avoided. And, it's the wrong format anyway. You would need a trailing slash on the target when redirecting /

8

Awesome thanks. That virtualhost config was taken from the OwnCloud setup docs, plus I likely messed it up playing around to fix the problem. I'm keen to understand what I'm doing, rather than just copying and pasting wildly into the night.

Much appreciated. Cheers!