Please fill out the fields below so we can help you better. My domain is: net.timetracer.se (among other sub domains) I ran this command: certbot certonly --expand --standalone --preferred-challenges http-01 -m <redacted> --agree-tos --http-01-port 31337 It produced this output: IMPORTANT NOTE…

That’s giving the same issue as before ( by the look of the logs). i.e. the Let’s Encrypt server is obtaining a null response. What’s the device you are running certbot on in standalone ? Is it possible to place a really simple web server there and check that everything is going through the HApr…

You need to use port 80 for the http-01 challenge - not port 31337

I use HAProxy, which forwards the requests from port 80 to the standalone servers port 31337.

The error is essentially saying that when the external Let’s Encrypt server tries to verify your domain at net.timetracer.se/well-known/acme-challenge/QKvAHb …jnk2Gc-Y it doesn’t get a simple, correct, text reply. If I try to go to that URL I get a redirect to login pages. is there anything else …

Yes, the directory “/well-known/” should be “/.well-known/”, and since the standalone server only runs when I’m running the command, it’s only reporting a 503 (Service unavailable)-page. But when I check the log, it gets a 200 HTTP code when it tries to fetch the challenge. 2017-01-05 11:36:16,590…

Unless the old certs have been compromised ( hopefully not) you shouldn’t need to revoke them. Maybe if @cpu can see if there is any additional info on the Let’s Encrypt logs as to why it looks as if it was giving a correct 200 page but Let’s Encrypt was rejecting it.

[image] serverco: Unless the old certs have been compromised ( hopefully not) you shouldn't need to revoke them. Correct! Thanks @serverco . @NoLifeKing , please don't revoke certificates unless you suspect them compromised. It's unnecessary and doesn't accomplish much due to the inherent probl…

@cpu It works well, when I try and create/renew certs for another domain ( multiresurs.com ). But when I try and run the exact same command, but with either of my timetracer.se domains, it always fails. Is there some way I can attach the log, without it being compromised, I’m not sure what informati…

[image] NoLifeKing: @cpu It works well, when I try and create/renew certs for another domain ( multiresurs.com ). Right, but what about the domain that's failing? Can you verify you can access a file from the /.well-known/acme-challenge directory for that domain through HAProxy? [image] NoL…

Here’s the log for the combined command for all .timetracer.se domains. letsencrypt.txt (117.1 KB) Since I’m using standalone create my certificates, it’s quite bothersome to see if I can access the file through the HAProxy, since by the time I know what URL I’m supposed to go to, the server is al…

I’ll try with a small nginx tomorrow and post the results. Edit: Thank you for all your help, it’s really helpful with people who doesn’t just go “RTFM” :slight_smile:

Cannot create new certificate

Help

Topic		Replies	Views
Challenge times out on standalone mode reverse-proxied to different port Help	40	1609	January 12, 2023
Challenge failed for domain Help	4	701	April 29, 2023
Need Help, Please Help	16	2042	January 9, 2020
Recently encountered errors renewing on an HAProxy server using Standalone method with Certbot Help	16	1803	June 4, 2022
"Error getting validation data" Help	31	8471	August 13, 2019

Cannot create new certificate

Related topics