# Can not create SSL Certificate on Ubuntu/NGINX

**URL:** <https://community.letsencrypt.org/t/can-not-create-ssl-certificate-on-ubuntu-nginx/173210>\
**Category:** Help\
**Created:** [March 4, 2022, 8:44pm UTC](https://community.letsencrypt.org/t/can-not-create-ssl-certificate-on-ubuntu-nginx/173210 "2022-03-04T20:44:13Z")\
**Posts on this page:** 14\
**Page:** 1

<div class="post-metadata">

**Author:** ![Cycs](https://avatars.discourse-cdn.com/v4/letter/c/ee7513/32.png) [@Cycs](https://community.letsencrypt.org/u/Cycs)\
**Post date:** [March 4, 2022, 8:44pm UTC](https://community.letsencrypt.org/t/can-not-create-ssl-certificate-on-ubuntu-nginx/173210/1 "2022-03-04T20:44:13Z")

</div>

Hi!

my problem is, that it's impossible to create a ssl certificate. That's strange because this is my second server (same brand, type, os and so on). On the first one all is okay. And now I have no clue what's going wrong. 😉

My domain is:

[node02.ironpvp.de](http://node02.ironpvp.de) (IP: 176.118.193.162)

I ran this command:

certbot --nginx --agree-tos --redirect --hsts --staple-ocsp --email [info@ironpvp.de](mailto:info@ironpvp.de) -d [node02.ironpvp.de](http://node02.ironpvp.de)

It produced this output:

Obtaining a new certificate  
Performing the following challenges:  
http-01 challenge for [node02.ironpvp.de](http://node02.ironpvp.de)  
Waiting for verification...  
Challenge failed for domain [node02.ironpvp.de](http://node02.ironpvp.de)  
http-01 challenge for [node02.ironpvp.de](http://node02.ironpvp.de)  
Cleaning up challenges  
Some challenges have failed.

IMPORTANT NOTES:

- The following errors were reported by the server:

My web server is (include version) / The operating system my web server runs on is (include version):

Ubuntu 20.04 LTS  
NGINX: 1.20.1

I can login to a root shell on my machine (yes or no, or I don't know): yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel): no

The version of my client is (e.g. output of ` ` or `certbot-auto --version` if you're using Certbot): 0.40.0

Can someone help me please? 😉

---

<div class="post-metadata">

**Author:** ![9peppe](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/9peppe/32/31596_2.png) [@9peppe](https://community.letsencrypt.org/u/9peppe)\
**Post date:** [March 4, 2022, 8:52pm UTC](https://community.letsencrypt.org/t/can-not-create-ssl-certificate-on-ubuntu-nginx/173210/2 "2022-03-04T20:52:55Z")

</div>

> [@Cycs](#):
>
> "var  
> x={o:'gNQabjb7uVN07mn7nKc41afgne8',t:'/iXcMe/.well-"

wtf is this?

> [@Cycs](#):
>
> 0.40.0

Did you follow [the instructions](https://certbot.eff.org/instructions?ws=nginx&os=ubuntufocal)?

---

<div class="post-metadata">

**Author:** ![\_az](https://avatars.discourse-cdn.com/v4/letter/_/22d042/32.png) [@\_az](https://community.letsencrypt.org/u/_az)\
**Post date:** [March 4, 2022, 8:55pm UTC](https://community.letsencrypt.org/t/can-not-create-ssl-certificate-on-ubuntu-nginx/173210/3 "2022-03-04T20:55:32Z")

</div>

> [@9peppe](#):
>
> wtf is this?

There are some nginx distributions out there which have "security" modules that create JavaScript interstitials, sort of like the Cloudflare captcha page. They look a lot like that snippet.

If that's the case here, @Cycs will need to figure out where it's coming from and turn it off, or exclude these requests.

---

<div class="post-metadata">

**Author:** ![9peppe](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/9peppe/32/31596_2.png) [@9peppe](https://community.letsencrypt.org/u/9peppe)\
**Post date:** [March 4, 2022, 9:03pm UTC](https://community.letsencrypt.org/t/can-not-create-ssl-certificate-on-ubuntu-nginx/173210/4 "2022-03-04T21:03:33Z")

</div>

It looks like it

```nohighlight
# curl -iL http://node02.ironpvp.de/
HTTP/1.1 200 OK
Connection: close
Pragma: no-cache
cache-control: no-cache
Content-Type: text/html
Content-Length: 206

<!DOCTYPE html><html><title></title><script>var y=window</script><script>var x={o:'/44OLOWV/',c:1},z=2;function rsu(h){return(x.o).substr(0,x.c)+(x.o).substr(x.c+h)}y.location.assign(rsu(z))</script></html>

```

```nohighlight
# curl -iL http://node02.ironpvp.de/.well-known/acme-challenge/sdFBYhiKxVlvdJbHgNQabjb7uVN07mn7nKc41afgne8
HTTP/1.1 200 OK
Connection: close
Pragma: no-cache
cache-control: no-cache
Content-Type: text/html
Content-Length: 247

<!DOCTYPE html><html><title></title><script>var y=window</script><script>var x={o:'gNQabjb7uVN07mn7nKc41afgne8',t:'/ZofKl/.well-known/acme-c',h:'hallenge/sdFBYhiKxVlvdJbH'};function rsu(){return x.t+x.h+x.o}y.location.assign(rsu())</script></html>

```

(It logs IP addresses, so I could not see it on my desktop because I had opened a page in Firefox)

@_az that webserver f\*king answers `200` on _every_ path. You only get a `404` _after_ the javascript redirect (and letsdebug doesn't catch this).

---

<div class="post-metadata">

**Author:** ![Cycs](https://avatars.discourse-cdn.com/v4/letter/c/ee7513/32.png) [@Cycs](https://community.letsencrypt.org/u/Cycs)\
**Post date:** [March 4, 2022, 9:10pm UTC](https://community.letsencrypt.org/t/can-not-create-ssl-certificate-on-ubuntu-nginx/173210/5 "2022-03-04T21:10:06Z")

</div>

Hi,

because of you question - I uninstalled the formerly install certbot instance and used snap. But this also doesn't work. I get this output:

root@node02:~# certbot --nginx  
Saving debug log to /var/log/letsencrypt/letsencrypt.log

Which names would you like to activate HTTPS for?

* * *

1: [node02.ironpvp.de](http://node02.ironpvp.de)

* * *

Select the appropriate numbers separated by commas and/or spaces, or leave input  
blank to select all options shown (Enter 'c' to cancel):  
Requesting a certificate for [node02.ironpvp.de](http://node02.ironpvp.de)

Certbot failed to authenticate some domains (authenticator: nginx). The Certificate Authority reported these problems:  
Domain: [node02.ironpvp.de](http://node02.ironpvp.de)  
Type: unauthorized  
Detail: Invalid response from [http://node02.ironpvp.de/.well-known/acme-challenge/UePRll-4JN2lcvi2hpKOpejuYvjg-7xF96WmpSQH6Qg](http://node02.ironpvp.de/.well-known/acme-challenge/UePRll-4JN2lcvi2hpKOpejuYvjg-7xF96WmpSQH6Qg) [176.118.193.162]: "var x={o:'/LLLLLWhSp/.well-known/acme-challenge/UePRll-"

Hint: The Certificate Authority failed to verify the temporary nginx configuration changes made by Certbot. Ensure the listed domains point to this nginx server and that it is accessible from the internet.

Some challenges have failed.  
Ask for help or search for solutions at [https://community.letsencrypt.org](https://community.letsencrypt.org). See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.

So ... it will not work.  
Btw. you asked for the strange text ... I only copied the output from the shell. 😉

Certbot version with snap is: 1.24.0

---

<div class="post-metadata">

**Author:** ![Cycs](https://avatars.discourse-cdn.com/v4/letter/c/ee7513/32.png) [@Cycs](https://community.letsencrypt.org/u/Cycs)\
**Post date:** [March 4, 2022, 9:13pm UTC](https://community.letsencrypt.org/t/can-not-create-ssl-certificate-on-ubuntu-nginx/173210/6 "2022-03-04T21:13:46Z")

</div>

> [@\_az](#):
>
> There are some nginx distributions out there which have "security" modules that create JavaScript interstitials, sort of like the Cloudflare captcha page. They look a lot like that snippet.

Uh ... sorry. I do not know.  
I only installed the server from scratch. That means, I clicked on "install server with Ubuntu 20.04 LTS" on my providers panel. After that I installed NGINX in this way:

> add-apt-repository ppa:ondrej/nginx  
> apt install nginx-core nginx-common nginx nginx-full

Is it wrong? I never had problems before with it. ☹

---

<div class="post-metadata">

**Author:** ![Cycs](https://avatars.discourse-cdn.com/v4/letter/c/ee7513/32.png) [@Cycs](https://community.letsencrypt.org/u/Cycs)\
**Post date:** [March 4, 2022, 9:22pm UTC](https://community.letsencrypt.org/t/can-not-create-ssl-certificate-on-ubuntu-nginx/173210/7 "2022-03-04T21:22:49Z")

</div>

> [@9peppe](#):
>
> ```nohighlight
> # curl -iL http://node02.ironpvp.de/
> HTTP/1.1 200 OK
> Connection: close
> Pragma: no-cache
> cache-control: no-cache
> Content-Type: text/html
> Content-Length: 206
> 
> <!DOCTYPE html><html><title></title><script>var y=window</script><script>var x={o:'/44OLOWV/',c:1},z=2;function rsu(h){return(x.o).substr(0,x.c)+(x.o).substr(x.c+h)}y.location.assign(rsu(z))</script></html>
> 
> ```

That's crazy. If I run this command I get the following:

```nohighlight
curl -iL http://node02.ironpvp.de/
HTTP/1.1 200 OK
Server: nginx/1.20.1
Date: Fri, 04 Mar 2022 21:20:25 GMT
Content-Type: text/html
Content-Length: 101
Last-Modified: Fri, 04 Mar 2022 19:27:48 GMT
Connection: keep-alive
ETag: "62226834-65"
Accept-Ranges: bytes

<html>
 <head>
  <title>Node02</title>
 </head>
 <body>
   <h1>This is Node02!</h1>
 </body>
</html>

```

---

<div class="post-metadata">

**Author:** ![9peppe](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/9peppe/32/31596_2.png) [@9peppe](https://community.letsencrypt.org/u/9peppe)\
**Post date:** [March 4, 2022, 9:24pm UTC](https://community.letsencrypt.org/t/can-not-create-ssl-certificate-on-ubuntu-nginx/173210/8 "2022-03-04T21:24:08Z")

</div>

So do I if I use an IP address that opened a page with an actual browser.

---

<div class="post-metadata">

**Author:** ![\_az](https://avatars.discourse-cdn.com/v4/letter/_/22d042/32.png) [@\_az](https://community.letsencrypt.org/u/_az)\
**Post date:** [March 4, 2022, 9:36pm UTC](https://community.letsencrypt.org/t/can-not-create-ssl-certificate-on-ubuntu-nginx/173210/9 "2022-03-04T21:36:04Z")

</div>

```
ls /etc/nginx/modules-enabled/
```

---

<div class="post-metadata">

**Author:** ![Cycs](https://avatars.discourse-cdn.com/v4/letter/c/ee7513/32.png) [@Cycs](https://community.letsencrypt.org/u/Cycs)\
**Post date:** [March 4, 2022, 9:37pm UTC](https://community.letsencrypt.org/t/can-not-create-ssl-certificate-on-ubuntu-nginx/173210/10 "2022-03-04T21:37:28Z")

</div>

ls /etc/nginx/modules-enabled/  
50-mod-brotli.conf 50-mod-http-echo.conf 50-mod-http-image-filter.conf 50-mod-http-xslt-filter.conf 50-mod-stream.conf  
50-mod-http-auth-pam.conf 50-mod-http-geoip2.conf 50-mod-http-subs-filter.conf 50-mod-mail.conf 70-mod-stream-geoip2.conf  
50-mod-http-dav-ext.conf 50-mod-http-geoip.conf 50-mod-http-upstream-fair.conf 50-mod-ssl-ct.conf 70-mod-stream-geoip.conf

---

<div class="post-metadata">

**Author:** ![\_az](https://avatars.discourse-cdn.com/v4/letter/_/22d042/32.png) [@\_az](https://community.letsencrypt.org/u/_az)\
**Post date:** [March 4, 2022, 9:39pm UTC](https://community.letsencrypt.org/t/can-not-create-ssl-certificate-on-ubuntu-nginx/173210/11 "2022-03-04T21:39:24Z")

</div>

Ah, it's not actually nginx doing this.

The clue is that @9peppe's curl response does not contain the `Server` header. This is usually a dead giveaway that there's some kind of proxy sitting in front.

I'd contact your host. I think it's some kind of HTTP firewall on their side.

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [March 4, 2022, 11:20pm UTC](https://community.letsencrypt.org/t/can-not-create-ssl-certificate-on-ubuntu-nginx/173210/12 "2022-03-04T23:20:04Z")

</div>

```nohighlight
curl -Ii http://node02.ironpvp.de/.well-known/acme-challenge/Test_File-1234
HTTP/1.1 302 Found
Location: /KVkVN/.well-known/acme-challenge/Test_File-1234

curl -Ii http://node02.ironpvp.de/KVkVN/.well-known/acme-challenge/Test_File-1234
HTTP/1.1 302 Found
Location: /pYaZV/KVkVN/.well-known/acme-challenge/Test_File-1234

curl -Ii http://node02.ironpvp.de/pYaZV/KVkVN/.well-known/acme-challenge/Test_File-1234
HTTP/1.1 302 Found
Location: /NnMRd/pYaZV/KVkVN/.well-known/acme-challenge/Test_File-1234

curl -Ii http://node02.ironpvp.de/NnMRd/pYaZV/KVkVN/.well-known/acme-challenge/Test_File-1234
HTTP/1.1 302 Found
Location: /ehkSV/NnMRd/pYaZV/KVkVN/.well-known/acme-challenge/Test_File-1234

```

There seems to be no end to it.

---

<div class="post-metadata">

**Author:** ![Cycs](https://avatars.discourse-cdn.com/v4/letter/c/ee7513/32.png) [@Cycs](https://community.letsencrypt.org/u/Cycs)\
**Post date:** [March 5, 2022, 6:31am UTC](https://community.letsencrypt.org/t/can-not-create-ssl-certificate-on-ubuntu-nginx/173210/13 "2022-03-05T06:31:32Z")

</div>

Huh? What's going on there? Never seen before. 😬  
I don't know why this happens.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\
**Post date:** [April 4, 2022, 6:32am UTC](https://community.letsencrypt.org/t/can-not-create-ssl-certificate-on-ubuntu-nginx/173210/14 "2022-04-04T06:32:04Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.