Cannot Request a new Certificate

Help
1

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is:
robertcloud.feste-ip.net

I ran this command:
certbot certonly --webroot -w /var/www/certbot/ -v

It produced this output:
Performing the following challenges:
http-01 challenge for robertcloud.feste-ip.net
Using the webroot path /var/www/certbot for all unmatched domains.
Waiting for verification...
Challenge failed for domain robertcloud.feste-ip.net
http-01 challenge for robertcloud.feste-ip.net
Certbot failed to authenticate some domains (authenticator: webroot). The Certificate Authority reported these problems:
Domain: robertcloud.feste-ip.net
Type: unauthorized
Detail: The key authorization file from the server did not match this challenge. Expected "7shbryYZ0Cic_RamcwQFlPXsmp78cY11yKR3935N6_o.GY0cug5atrBBWQn2zhifaJnhgrxXIWLFFWLuBtVevvY" (got "7shbryYZ0Cic_RamcwQFlPXsmp78cY11yKR3935N6_o.oBNd5smO5vYJ4JXg-7VH8ZPOOgURgOqPb-Ffq1bGeKA")

Hint: The Certificate Authority failed to download the temporary challenge files created by Certbot. Ensure that the listed domains serve their content from the provided --webroot-path/-w and that files created there can be downloaded from the internet.

Cleaning up challenges
Some challenges have failed.
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.

My web server is (include version):
nginx/1.27.2

The operating system my web server runs on is (include version):
Nginx is running in a docker Container on debian 12

My hosting provider, if applicable, is:

I can login to a root shell on my machine (yes or no, or I don't know):
yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel):
no

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot):
certbot 4.2.0

2

Welcome @r0bc94

I don't think HTTP requests are reaching your nginx server. Instead, a server identifying as "Feste-IP.net" replies.

Here is an example HTTP Challenge request which replies with a 200 OK but should get a 404 Not Found as you wouldn't know about this record. Note how similar the response is to the one that Let's Encrypt reports in the failure message

curl -i http://robertcloud.feste-ip.net/.well-known/acme-challenge/Test404
HTTP/1.1 200 OK
Server: Feste-IP.Net

Test404.oBNd5smO5vYJ4JXg-7VH8ZPOOgURgOqPb-Ffq1bGeKA

Check the routing config to ensure HTTP challenge requests reach your nginx container. Check the nginx access logs to confirm it sees them (or does not).

3

Hi @MikeMcQ ,

thank you for your reply. feste-ip.net is a mapping service since I only have a public ipv6 address and a natted ipv4. So requests coming from ipv4 only hosts are mapped to ipv6 by this servcie.

I supposed that they changed something because in the past, they where transparent to the acme challenge. I guess I need to ask the named service if they changed something in regards to acme challenges.