I’m not sure where to report that.
I was trying to obtain a certificate for calmexpress.com, which points to 51.210.109.224 and 2001:41d0:304:200::6461. HTTP redirects to HTTPS with an at-the-time invalid certificate.
I can access my site from a Vultr VPS in the US over IPv6, as tested with curl -vk https://calmexpress.com/
IPv4 is also accessible, as tested with curl -vk https://calmexpress.com/ --resolve calmexpress.com:443:51.210.109.224
Yet, certbot certonly ... repeatedly failed with:
51.210.109.224: Fetching https://calmexpress.com/.well-known/acme-challenge/67cnv5_bye63Ob9-uavx2crSeQVaXpp3b545g4aCimc: Timeout during connect (likely firewall problem)
The error message spits out the server’s IPv4, but my understanding of the log is that IPv4 hasn’t been tried over HTTPS:
2023-10-04 14:29:22,534:DEBUG:urllib3.connectionpool:https://acme-staging-v02.api.letsencrypt.org:443 "POST /acme/authz-v3/8672621384 HTTP/1.1" 200 1839
2023-10-04 14:29:22,535:DEBUG:acme.client:Received response:
HTTP 200
Server: nginx
Date: Wed, 04 Oct 2023 14:29:22 GMT
Content-Type: application/json
Content-Length: 1839
Connection: keep-alive
Boulder-Requester: 120583614
Cache-Control: public, max-age=0, no-cache
Link: <https://acme-staging-v02.api.letsencrypt.org/directory>;rel="index"
Replay-Nonce: 63n7bjQMihjT6ClP9PNrMZ5-terc1RrausTQ3h1raChWGPsauzc
X-Frame-Options: DENY
Strict-Transport-Security: max-age=604800
{
"identifier": {
"type": "dns",
"value": "calmexpress.com"
},
"status": "invalid",
"expires": "2023-10-11T14:28:58Z",
"challenges": [
{
"type": "http-01",
"status": "invalid",
"error": {
"type": "urn:ietf:params:acme:error:connection",
"detail": "51.210.109.224: Fetching https://calmexpress.com/.well-known/acme-challenge/67cnv5_bye63Ob9-uavx2crSeQVaXpp3b545g4aCimc: Timeout during connect (likely firewall problem)",
"status": 400
},
"url": "https://acme-staging-v02.api.letsencrypt.org/acme/chall-v3/8672621384/GC0hTw",
"token": "67cnv5_bye63Ob9-uavx2crSeQVaXpp3b545g4aCimc",
"validationRecord": [
{
"url": "http://calmexpress.com/.well-known/acme-challenge/67cnv5_bye63Ob9-uavx2crSeQVaXpp3b545g4aCimc",
"hostname": "calmexpress.com",
"port": "80",
"addressesResolved": [
"51.210.109.224",
"2001:41d0:304:200::6461"
],
"addressUsed": "2001:41d0:304:200::6461"
},
{
"url": "http://calmexpress.com/.well-known/acme-challenge/67cnv5_bye63Ob9-uavx2crSeQVaXpp3b545g4aCimc",
"hostname": "calmexpress.com",
"port": "80",
"addressesResolved": [
"51.210.109.224",
"2001:41d0:304:200::6461"
],
"addressUsed": "51.210.109.224"
},
{
"url": "https://calmexpress.com/.well-known/acme-challenge/67cnv5_bye63Ob9-uavx2crSeQVaXpp3b545g4aCimc",
"hostname": "calmexpress.com",
"port": "443",
"addressesResolved": [
"51.210.109.224",
"2001:41d0:304:200::6461"
],
"addressUsed": "2001:41d0:304:200::6461"
}
],
"validated": "2023-10-04T14:28:59Z"
}
]
}
OS: Debian 12.1
Certbot version: certbot 2.1.0
Web server: nginx/1.22.1
I ran this command:
certbot certonly \
--webroot \
--webroot-path "/srv/acme-challenge" \
--domain "calmexpress.com" \
--non-interactive \
--agree-tos \
--register-unsafely-without-email \
--no-eff-email \
--key-type "ecdsa" \
--preferred-chain "ISRG Root X1" \
--test-cert
Using the non-staging server (without --test-cert), it worked correctly:
2023-10-04 15:14:19,706:DEBUG:urllib3.connectionpool:https://acme-v02.api.letsencrypt.org:443 "POST /acme/authz-v3/270675300756 HTTP/1.1" 200 1177
2023-10-04 15:14:19,706:DEBUG:acme.client:Received response:
HTTP 200
Server: nginx
Date: Wed, 04 Oct 2023 15:14:19 GMT
Content-Type: application/json
Content-Length: 1177
Connection: keep-alive
Boulder-Requester: 1341444596
Cache-Control: public, max-age=0, no-cache
Link: <https://acme-v02.api.letsencrypt.org/directory>;rel="index"
Replay-Nonce: 3hclikJOquZJR-NbHTelw4YtYVWgd5hJE4pOX6nuNC_BqOuQz1A
X-Frame-Options: DENY
Strict-Transport-Security: max-age=604800
{
"identifier": {
"type": "dns",
"value": "calmexpress.com"
},
"status": "valid",
"expires": "2023-11-03T15:14:18Z",
"challenges": [
{
"type": "http-01",
"status": "valid",
"url": "https://acme-v02.api.letsencrypt.org/acme/chall-v3/270675300756/xJsCHA",
"token": "WOIZsJfv24EJytI5SgPNoVq7pU8E47BV_JobvtWv32A",
"validationRecord": [
{
"url": "http://calmexpress.com/.well-known/acme-challenge/WOIZsJfv24EJytI5SgPNoVq7pU8E47BV_JobvtWv32A",
"hostname": "calmexpress.com",
"port": "80",
"addressesResolved": [
"51.210.109.224",
"2001:41d0:304:200::6461"
],
"addressUsed": "2001:41d0:304:200::6461"
},
{
"url": "https://calmexpress.com/.well-known/acme-challenge/WOIZsJfv24EJytI5SgPNoVq7pU8E47BV_JobvtWv32A",
"hostname": "calmexpress.com",
"port": "443",
"addressesResolved": [
"51.210.109.224",
"2001:41d0:304:200::6461"
],
"addressUsed": "2001:41d0:304:200::6461"
}
],
"validated": "2023-10-04T15:14:15Z"
}
]
}
