Can not install SSL authorization failed issue with A records

Server
1

I ran out of all option on this domain stti.ca, can’t install a certificate and getting the following error.
Deleted and issued new certificates but still can’t issue a certificate.

Usually this is what I use to install same certificate on multiple domains. But somehow I just can’t make this work.
./letsencrypt-auto --apache -d stti.ca -d www.stti.ca

Error:
IMPORTANT NOTES:

  • The following errors were reported by the server:

Domain: stti.ca

Type: unauthorized

Detail: Invalid response from

http://stti.ca/.well-known/acme-challenge/MJK6Gy7kkM5TsoOrK6NmIFhXcCWE5-s6Ws-MbsQHEdg:

"\n\n<!DOCTYPE html>\n<html lang=“en-CA” prefix="og:

[http://ogp.me/ns#](http://ogp.me/ns#\)">\n<head>\n\n<title>Home - Streamline Provider

of Transportation"

To fix these errors, please make sure that your domain name was

entered correctly and the DNS A/AAAA record(s) for that domain

contain(s) the right IP address.

2

Hi @makessl

there are some problems (checked via https://check-your-website.server-daten.de/?q=stti.ca ):

You have ipv4 and ipv6 addresses

Host T IP-Address is auth. ∑ Queries ∑ Timeout
stti.ca A 54.68.161.155 yes 1 0
AAAA 2001:4860:4802:32::15 yes
www.stti.ca A 54.68.161.155 yes 1 0
AAAA yes

But if you use http-01 validation, a file in /.well-known/acme-challenge is created and checked.

There:

Domainname Http-Status redirect Sec. G
• http://stti.ca/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de
2001:4860:4802:32::15 301 http://www.stti.ca 0.060 D
• http://www.stti.ca/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de
54.68.161.155 301 https://www.stti.ca/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de 0.357 A
• https://www.stti.ca/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de 301 https://stti.com/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de 3.014 A
• https://stti.ca/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de -4 0.087 W
SendFailure - The underlying connection was closed: An unexpected error occurred on a send. Authentication failed because the remote party has closed the transport stream.
• https://stti.com/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de 404 6.844 A
Not Found

Letsencrypt prefers ipv6. But your http + ipv6 + /.well-known + non-www is redirected to /, this is bad. Your ipv4 + www is redirected to https, but your https doesn't work, there is the connection closed.

So perhaps remove your ipv6 dns entry (your AAAA entry) and remove the redirect http -> https, then check the domain again.

A redirect http -> https is possible. But https must work (certificate may be wrong). And

http + /.well-known/acme-challenge/filename should redirect to https + /.well-known/acme-challenge/filename, not to https + /

3

Thank you and very much appreciated. I’ll let the IT update DNS and I’ll try to reinstall SSL.

2 Likes
4

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.