Can't get certbot to renew my certificates

Help
1

I am new at this, and am not sure what I'm doing wrong. the initial setup handled challenges just fine, but renewing is not.

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: www.passagepredictor.com

I ran this command: (tried all of)

It produced this output: (from certbot renew)

Processing /etc/letsencrypt/renewal/www.passagepredictor.com.conf

Cert is due for renewal, auto-renewing...
Plugins selected: Authenticator nginx, Installer nginx
Starting new HTTPS connection (1): acme-v02.api.letsencrypt.org
Renewing an existing certificate
Performing the following challenges:
http-01 challenge for test.passagepredictor.com
http-01 challenge for www.passagepredictor.com
http-01 challenge for passagepredictor.com
Waiting for verification...
Cleaning up challenges
Attempting to renew cert (www.passagepredictor.com) from /etc/letsencrypt/renewal/www.passagepredictor.com.conf produced an unexpected error: Failed authorization procedure. passagepredictor.com (http-01): urn:ietf:params:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from https://www.passagepredictor.com/.well-known/acme-challenge/1QYOmwN8q4brEfyLddjSRFYsv1q5rW9nVo7J4XYQmuI [157.230.139.119]: "

Not Found

The requested URL /.well-known/acme-challenge/1QYOmwN8q4brEfyLddjSRFYsv1q5rW9nVo7J4XYQmuI was not found on ". Skipping.
All renewal attempts failed. The following certs could not be renewed:
/etc/letsencrypt/live/www.passagepredictor.com/fullchain.pem (failure)

All renewal attempts failed. The following certs could not be renewed:
/etc/letsencrypt/live/www.passagepredictor.com/fullchain.pem (failure)

1 renew failure(s), 0 parse failure(s)
IMPORTANT NOTES:

  • The following errors were reported by the server:

Domain: passagepredictor.com
Type: unauthorized
Detail: Invalid response from
https://www.passagepredictor.com/.well-known/acme-challenge/1QYOmwN8q4brEfyLddjSRFYsv1q5rW9nVo7J4XYQmuI
[157.230.139.119]: "

Not Found

The requested URL
/.well-known/acme-challenge/1QYOmwN8q4brEfyLddjSRFYsv1q5rW9nVo7J4XYQmuI
was not found on "

To fix these errors, please make sure that your domain name was
entered correctly and the DNS A/AAAA record(s) for that domain
contain(s) the right IP address.

My web server is (include version): nginx/1.10.3

The operating system my web server runs on is (include version):Ubuntu 16.04.5 LTS

My hosting provider, if applicable, is: DigitalOcean

I can login to a root shell on my machine (yes or no, or I don't know): yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel): no

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): certbot 0.28.0

I initially followed this guide (and thought I'ld deal with the renew --dry-run failing later, but now it's later . . .): How To Secure Nginx with Let's Encrypt on Ubuntu 18.04 | DigitalOcean

In case it matters, I'm using django and uwsgi on the backend of my nginx setup.

I can currently access my site by domain name just fine, my DNS provider (Google) sais I am using a type 'A' record for the server, and nslookup yields the expected IP

Name: www.passagepredictor.com
Address: 157.230.139.119

2

(Edit: Post rewritten.)

I don’t think this will help, but the current version of Certbot available in the PPA is 0.31.0. You should upgrade.

I think the issue is that http://passagepredictor.com/ is a Google forwarding service that redirects to https://www.passagepredictor.com/. So the validation request http://passagepredictor.com/.well-known/acme-challenge/1QYOmwN8q4brEfyLddjSRFYsv1q5rW9nVo7J4XYQmuI doesn’t wind up where Certbot expects, or has configured Nginx to answer.

If you’re not using passagepredictor.com on your server at all, I think it would make sense to drop it from your server’s certificate.

You could replace your certificate with “sudo certbot --cert-name www.passagepredictor.com -d test.passagepredictor.com -d www.passagepredictor.com” – or whatever other options you used.

(https://passagepredictor.com/ has a separate certificate for only that name. Did Google issue it automatically?)

A different option would be to stop using Google’s forwarding and configure your Nginx to handle that.

3

Thank you for the quick reply.

doing that sucessfully set up certificates correctly and the renew --dry-run indicates that auto renewal will work in the future.

On my next site I’ll consider the suggestion to use nginx to handle subdomain forwarding directly, but this is working for now so I think I’ll leave it.

Thanks again for the help.

4

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.