I am unable to renew my certificate.
I read a lot of things about the access to the challenge and about certbot cannot access it, so it cannot renew.
But I really dont understand what I have to do to solve this problem. I think it is about an alias... But where and how... ?
My domain is: jeedom.kuchta.fr
I ran this command: sudo certbot run -a webroot -i apache -w /var/www/html -d jeedom.kuchta.fr --debug-challenges
It produced this output:
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Renewing an existing certificate for jeedom.kuchta.fr
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Challenges loaded. Press continue to submit to CA.
Pass "-v" for more info about challenges.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Press Enter to Continue
Certbot failed to authenticate some domains (authenticator: webroot). The Certificate Authority reported these problems:
Domain: jeedom.kuchta.fr
Type: connection
Detail: 90.89.196.72: Fetching http://jeedom.kuchta.fr/.well-known/acme-challenge/srXDq9SOh1D8CPDYPWKtbvL8Z3mJvvU2XsAeVV2TdRQ: Timeout during connect (likely firewall problem)
Hint: The Certificate Authority failed to download the temporary challenge files created by Certbot. Ensure that the listed domains serve their content from the provided --webroot-path/-w and that files created there can be downloaded from the internet.
Some challenges have failed.
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.
My web server is (include version):
Server version: Apache/2.4.38 (Debian)
Server built: 2021-12-21T16:50:43
The operating system my web server runs on is (include version):
You are using http validation but your firewall is blocking tcp port 80 (http) or Apache is not listening for http (port 80). Let's Encrypt can't check your domain if you block/disable TCP port 80.
I thank you for this answer.
I have to check this, you're right.
I did not change anything on the router since years, but something must have crash on it and blocking HTTP.
I'll see that as soon as possible.
Thank you again, I really did not even think of this... !!
But I have a doubt anyway in fact.
From the system I try to certbot, I can access it :
curl http://jeedom.kuchta.fr/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>302 Found</title>
</head><body>
<h1>Found</h1>
<p>The document has moved <a href="https://jeedom.kuchta.fr/">here</a>.</p>
</body></html>
Yes, Let's Encrypt are external to your organisation and can only see your public website. You can access this site because you are behind your own firewall. If you try the same from your phone using mobile data (not wifi) you will find that you also cannot connect.
If you do need to block port 80 at the firewall then you would have to change to use either DNS validation or tls-alpn-01, which is more complicated.
Yes, thanx ! I'll modify my router to accept external HTTP access (but I do not remember I changed it... I'll see this night, I'm not at home and cannot access the router from an external way)
Can you please explain how to do a DNS validation with certbot ? Or a webpage which explain it please ?
I really dont know. I changed the router (in fact, operator did it) but all the configuration have been recuperated. Obviously, they certainly changed something. I'll see it this night (not at home and cannot access router from an external way).
Thank you
There are a few issues with that community how-to:
The Certbot PPA has been DEPRECATED;
Using the acme-dns.io instance is discouraged, as you are effectively authorizing the acme-dns server to act on your behalf in providing the answer to the challenging CA, making the instance able to request (and get issued) a TLS certificate for the domain that has CNAME pointing to it. (Source: GitHub - joohoi/acme-dns: Limited DNS server with RESTful HTTP API to handle ACME DNS challenges easily and securely.) You're encouraged to run your own instance of acme-dns for safety reasons.
