All authorizations were not finalized by the CA

You're running smallstep/certificates and your CA server is not able to connect to your domain jellyfin.local.

Smallstep is not really great at producing useful error messages, so we can't read the exact cause from that certbot ACME log. You could consider having a look at your smallstep server log, but based on my experience that won't be much helpful either.

Note that .local is a reserved multicast DNS domain, and multicast DNS is often a very troublesome topic. It wouldn't surprise me if smallstep can't resolve the multicast DNS.

Note that your jellyfin server has to be listening on port 80 for this challenge to succeed, and jellyfin usually defaults to 8096, unless you've changed it.

You may have more success issuing a smallstep certificate not using ACME. You could use the CLI directly (this is even possible if your ACME server is remote) to issue a certificate without having to complete an ACME challenge (using the JWK provisioner).

For more information about smallstep we will likely refer you to their documentation.

7 Likes