Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.
My domain is: bernd.dyndns.info
I ran this command: I click on apply in the nextcloudpi's letsencrpt section to renew the certificate (yes, it worked once to get one but the renew process doesn't work)
It produced this output:
[ letsencrypt ] (Sun Oct 31 20:00:17 CET 2021)
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator webroot, Installer None
Renewing an existing certificate
Performing the following challenges:
http-01 challenge for bernd.dyndns.info
Using the webroot path /var/www/nextcloud for all unmatched domains.
Waiting for verification...
Cleaning up challenges
Failed authorization procedure. bernd.dyndns.info (http-01): urn:ietf:params:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from http://bernd.dyndns.info/.well-known/acme-challenge/hvqYuWtLMGvVl-GaXeW-j6hm-mwm0rWejpriUg5sRaQ [79.250.140.197]: "\n\n404 Not Found\n\n
To fix these errors, please make sure that your domain name was
entered correctly and the DNS A/AAAA record(s) for that domain
contain(s) the right IP address.
My web server is (include version): raspberry pi nextcloud v21.0.4.1
The operating system my web server runs on is (include version): raspian
I can login to a root shell on my machine (yes or no, or I don't know): yes
I'm using a control panel to manage my site (no, or provide the name and version of the control panel): ncp
The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): certbot 0.31.0
It's using Apache, so we could troubleshoot that by starting with the output of: sudo apachectl -t -D DUMP_VHOSTS [ ^ please ^ post ^ that ^ output ^ ]
What we are going to look for first is to confirm this is correct and works as expected:
"Using the webroot path /var/www/nextcloud"
ok. And what is your recommendation? I mean, :::80 is not a real IP, isn't it? And you said that a virtual host listening to port 80 is missing, right? Is there a way to put it manually somehow in a config file?
That is a real IP binding. It's in IPv6 format, but Apache will show that when bound to both IPv4 and IPv6.
At this point, without being able to locate where the vhost config for HTTP is, I can only refer you back to nextcloud and their documentation OR maybe someone will come by with some experience with this particular situation and provide you with some guidance; As I won't be able to even directly confirm that is the correct webroot.
That said, we might be able to confirm it indirectly.
But I must presume it will fail as has the renewal request.
If so, we can only confirm its' failure and are still left without a way to fix it.
If you want to try confirming the webroot, do these steps: sudo mkdir -p /var/www/nextcloud/.well-known/acme-challenge echo test1234 > /var/www/nextcloud/.well-known/acme-challenge/Test_File-1234 echo test4321 > /var/www/nextcloud/Test_File-4321
Then try these from an Internet connected system: http://bernd.dyndns.info/Test_File-4321 http://bernd.dyndns.info/.well-known/acme-challenge/Test_File-1234
Once all testing is completed you can delete the test files with: rm /var/www/nextcloud/.well-known/acme-challenge/Test_File-1234 rm /var/www/nextcloud/Test_File-4321
Isnt it possible to add that manually if it's missing?
OK, I created the test files. Then:
from those calls I get a "The requested URL was not found on this server" error in the browser. I assume that this is something you want to see as a confirmation, right?
By the way: isn't it possible to add the missing virtual host anyhow into the nextcloud.conf file either by adding it manually, doiing it by script or even repair the nextcloud installation?
My certificate expired 2 days ago. Yesterday I was willing to try it a last time. The trial with bernd.dyndns.info failed. But I set a forward record (CNAME) from my own tl domain to bernd.dyndns.info. As soon as I entered this tl domain in nextcloudpi I got a new certificate. I don't know whether it's reproducable but let's hope the best. Saying this I am pretty sure I tried to aquire a certificate for that tl domain several days before but this didn't work. But yesterday it did.
Ah, btw, I entered a VHOST for port 80 into the 000-default.conf in the apache2/sites-enabled directory. Don't know if this did the trick.
