I imagine the problem is port 443, but I do not know how to fix it, I’ve already disabled the firewall on my machine.
FailedChallenges: Failed authorization procedure. mercadocaseiro.com (tls-sni-01):
urn:acme:error:connection :: The server could not connect to the client to verify the domain :: Failed to
connect to 54.207.89.141:443 for tls-sni-01 challenge
IMPORTANT NOTES:
- The following errors were reported by the server:
Domain: mercadocaseiro.com
Type: connection
Detail: Failed to connect to 54.207.89.141:443 for tls-sni-01
challenge
To fix these errors, please make sure that your domain name was
entered correctly and the DNS A record(s) for that domain
contain(s) the right IP address. Additionally, please check that
your computer has a publicly routable IP address and that no
firewalls are preventing the server from communicating with the
client. If you're using the webroot plugin, you should also verify
that you are serving files from the webroot path you provided.
This is my httpd.conf:
<IfModule mod_ssl.c>
<VirtualHost *:443>
ServerName mercadocaseiro.com
ServerAlias mercadocaseiro.com *.mercadocaseiro.com
SSLEngine on
UseCanonicalName on
SSLStrictSNIVHostCheck on
LimitRequestBody 1048576
DocumentRoot /var/www/html
</VirtualHost>
</IfModule>
Are you currently running a web server on that machine that speaks HTTPS? It’s not possible to connect to https://mercadocaseiro.com/ at all.
The TLS-SNI-01 authentication method that the client is trying to use normally assumes that either (1) you already have a web server like Apache running that Certbot can configure to listen on port 443, or (2) you’re using --standalone to allow Certbot to create its own temporary web server listening on port 443.
It would seem that your Apache configuration would be appropriate here but I would then expect to be able to load https://mercadocaseiro.com/. The inability to do so does suggest a firewall problem to me, maybe still something to do with the AWS firewall.
For comparison, you could try to stop Apache and then run
echo hello | sudo nc -l 443
on your server and then
nc mercadocaseiro.com 443
on a different Internet-connected machine. If you don’t see hello, your computer is not in fact able to receive incoming connections on port 443 at all (because of a firewall or something similar).
Are these on two different computers? How could the "hello" have been transmitted if the nc command failed?
The rate limit in question will expire after one hour, so you shouldn't have to wait very long. You can also try with --staging to get a certificate from the testing server, which has much looser rate limits (but the certificates from what server are not accepted as valid by web browsers, and are just intended for testing purposes).
I just tested it on my computer because I do not have another one here and the result is what I sent.
I tried again now and I received this error for the first time a different error than I opened this topic:
IMPORTANT NOTES:
- The following errors were reported by the server:
Domain: mercadocaseiro.com
Type: unauthorized
Detail: Invalid response from
http://mercadocaseiro.com/.well-known/acme-challenge/_sxKsAcBKs79iEOCNCcuvUBJ SVl9NizY8yfiPSrD_rE:
"<!DOCTYPE html>
<html lang="pt-BR" class="no-js">
<head>
<meta charset="UTF-8">
<link rel="profile" href="http://gmpg.o"
To fix these errors, please make sure that your domain name was
entered correctly and the DNS A record(s) for that domain
contain(s) the right IP address.
But now I don’t know what to do with this orientation:
Edit your SSL config…
$ sudo nano /etc/httpd/conf.d/ssl.conf
Set SSLCertificateFile to your Certificate path (see #5 above).
Set SSLCertificateKeyFile to your Private Key path (see #5 above).
Set SSLCertificateChainFile to your Full Chain path (see #5 above).
This is running with a different authentication method, which probably means a slightly different Certbot command line. The first example that you gave had an error related to TLS-SNI-01 authentication (which uses port 443 and is often a result of using --apache for your authentication in Certbot), while the newer one has an error related to HTTP-01 authentication (which uses port 80 and is often a result of using --webroot).
If you want to use the HTTP-01 authentication method, you have to identify the correct webroot directory to specify with -w and then make sure that files that Certbot creates can be served from that location.
I had a conflict in the installation of mod_ssl, so I installed mod24_ssl that created the ssl.conf file and made the targeting of the certificate directories:
