Can't get a SSL Certificate using NGINX and Lets Encrypt

Help
1

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: lapsmith.duckdns.org

I ran this command: Didn't run a command, tried using NGINX

It produced this output:

My web server is (include version): Not sure what this is, I am trying to get the certificate to use with Home Assistant (Tesla Integration)

The operating system my web server runs on is (include version): HAOS

My hosting provider, if applicable, is: DuckDNS

I can login to a root shell on my machine (yes or no, or I don't know): I don't know

I'm using a control panel to manage my site (no, or provide the name and version of the control panel): Using Home Assistant UI

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): I don't know

Unless it is obvious from the error message below, I'm not even sure if I am entering the correct information:

image
image557×857 26.6 KB

Here is the error message:
CommandError: Saving debug log to /tmp/letsencrypt-log/letsencrypt.log
Encountered exception during recovery: certbot.errors.PluginError: The TXT value for domain "lapsmith.duckdns.org" could not be deleted.
Request status code: 200
Request response text: KO
The TXT update "KO" for domain "jiUE_RDl679UCAhmIu7csySuZjgnhHYEdJW4LlmATq4" could not be set.
Request status code: lapsmith.duckdns.org
Request response text: 200

2

Based on a post by someone who had a similar problem, I ran my domain through dnssec-debugger and there may be a problem with DNSSEC signatures, whatever that means. Google says I may have to wait 48 hours after creating the domain for propogation. Could that be all it is?
The errors it found are:
No DS records found for duckdns.org in the org zone
No DNSKEY records found
and multiple instances of: No RRSIGs found

Thanks!

3

duckdns.org is unsigned and not having DS, DNSKEY or RRSIG records is expected. have you made sure that the credential file content is correct i.e. have you replaced your-duckdns-token with your duckdns API token?

5 Likes
4

Ah, makes sense! I had tried replacing all the text in that box with my API token, not realizing I had to replace just the "your-duckdns-token". Now it worked, thanks so much!!

6 Likes