Can't renew all my domains

[Luluwebmaster]

Hello,

I have a problem when I try to renew all my domains :

My domain is: https://youtube-twitch-alerts.addons.luc-mergault.fr/

I ran this command: /opt/letsencrypt/letsencrypt-auto renew or /opt/letsencrypt/letsencrypt-auto --apache --renew-by-default -d youtube-twitch-alerts.addons.luc-mergault.fr

It produced this output: Failed authorization procedure. youtube-twitch-alerts.addons.luc-mergault.fr (tls-sni-01): urn:acme:error:connection :: The server could not connect to the client to verify the domain :: Timeout

My web server is (include version): Apache/2.4.10 (Debian)

The operating system my web server runs on is (include version): Debian GNU/Linux 8

I can login to a root shell on my machine (yes or no, or I don’t know): Yes

Thanks you !

[schoen]

Do you have any sort of firewall that could be limiting inbound connections from some parts of the Internet?

[rg305]

wget http://youtube-twitch-alerts.addons.luc-mergault.fr/
redirects permanently (301) to https.
and
wget https://youtube-twitch-alerts.addons.luc-mergault.fr/
returns: {“error”:true}
as also shown by all major browsers:

[Luluwebmaster]

@schoen :

I have Fail2ban, but when I watch the ban list, I don’t have IP address :-/

After, I have the default Firewall ( I believe IPtable ) ^^

@rg305 :

Yes it’s normal ^^

[rg305]

You could try putting a test.txt file at:
https://youtube-twitch-alerts.addons.luc-mergault.fr/.well-known/acme-challenge/test.txt

[Luluwebmaster]

Hmm, why do you want me to do this?

[rg305]

To test if it can be reached form the Internet correctly.

[Luluwebmaster]

I have this path if you want ^^

Présentation | Youtube & Twitch - Alerts

[schoen]

It would be good to use the exact path that @rg305 suggested because /.well-known/acme-challenge/ has a special meaning to the certificate authority.

[Luluwebmaster]

Ho, ok sorry, I have created this path :

https://youtube-twitch-alerts.addons.luc-mergault.fr/.well-known/acme-challenge/test.txt

Edit : Just for information, I have this problem in all my domains

[schoen]

@cpu, could you perhaps try this and see if there’s something strange about the routing or a netblock-specific firewall?

[rg305]

Have you made any special coding for /.well-known or /.well-known/acme-challenge requests?

[cpu]

@schoen

@cpu, could you perhaps try this and see if there’s something strange about the routing or a netblock-specific firewall?

I will ask our operations team to look into this. It's not something I can check myself unfortunately.

[Phil]

I have been able to access your website on ports 80/443 from different network vantage points. If you have programmatic access to install a DNS TXT record, could you try using the DNS-01 challenge?

If you use certbot standalone , what result do you get?

Out of curiosity, can you post your webserver vhost configuration please?

[Luluwebmaster]

@rg305 No, but I do not think that’s the problem ^^

For information, the problem was not the 3 ~ 4 months ago, it is only recently that it is there :-/

@devnullisahappyplace

1 - What is “DNS-01 challenge” ?
2 - Will not that break the configuration of my server ?
3 - The global server configuration or just for a specific domain ?

Here the log after trying to launch command ( I deleted some info that seemed to me private ) :

• https://pastebin.com/9Wbp7as2

[jared.m]

@Luluwebmaster

1 - What is “DNS-01 challenge” ?

The DNS-01 challenge type involves creating a TXT record on your domain with the challenge response as its value.

@Luluwebmaster

2 - Will not that break the configuration of my server ?

No, this will not break your domain.

@Luluwebmaster

3 - The global server configuration or just for a specific domain ?

Depends on what you're issuing certificates for. For example, if you issue for youtube-twitch-alerts.luc-mergault.fr, you would need to create a TXT record for _acme-challenge.youtube-twitch-alerts.luc-mergault.fr. If you wanted to generate a certificate for, say, www.youtube-twitch-alerts.luc-mergault.fr, you would need to create a TXT record for _acme-challenge.www.youtube-twitch-alerts.luc-mergault.fr.

[Luluwebmaster]

Oops, sorry for the delay …

1 - Um, ok, I’m not sure I understand ( I’m not an expert in the field ^^)
2 - Ok ok
3 - Ha okay, but why do we have to do this now that it worked properly before ? :-/

Edit : What should I enter in the entrance ?

Edit 2 : I was thinking, maybe the problem comes from an Apache module or a configuration, what do you think ?

I know that during the installation of the server, I had installed one / modules, but I do not remember which ( And I also changed some things about the operation of the server ) :-/

Here my list of Pache2 modules loaded :

[Luluwebmaster]

Ok, new update, I tried this command :

• /opt/letsencrypt/letsencrypt-auto renew --force-renewal

This domains successful renew :

  /etc/letsencrypt/live/mynar.luluwebmaster.fr/fullchain.pem (success)
  /etc/letsencrypt/live/mr.luluwebmaster.fr/fullchain.pem (success)
  /etc/letsencrypt/live/samacup.luluwebmaster.fr/fullchain.pem (success)
  /etc/letsencrypt/live/jtchat.luluwebmaster.fr/fullchain.pem (success)
  /etc/letsencrypt/live/bottleflip.luluwebmaster.fr/fullchain.pem (success)
  /etc/letsencrypt/live/luc-mergault.fr/fullchain.pem (success)
  /etc/letsencrypt/live/luluwebmaster.fr/fullchain.pem (success)
  /etc/letsencrypt/live/fm-motoculture.fr-0001/fullchain.pem (success)
  /etc/letsencrypt/live/i.luwe.fr/fullchain.pem (success)

And other random domain did not work :-/

Attempting to renew cert (amazon-wtf.luluwebmaster.fr) from /etc/letsencrypt/renewal/amazon-wtf.luluwebmaster.fr.conf produced an unexpected error: Failed authorization procedure. amazon-wtf.luluwebmaster.fr (tls-sni-01): urn:acme:error:connection :: The server could not connect to the client to verify the domain :: Timeout. Skipping.
The following certs could not be renewed:
  /etc/letsencrypt/live/luwe.fr/fullchain.pem (failure)
  /etc/letsencrypt/live/youtube-twitch-alerts.addons.luc-mergault.fr/fullchain.pem (failure)
  /etc/letsencrypt/live/u.luwe.fr/fullchain.pem (failure)
  /etc/letsencrypt/live/fm-motoculture.fr/fullchain.pem (failure)
  /etc/letsencrypt/live/frame.luluwebmaster.fr/fullchain.pem (failure)
  /etc/letsencrypt/live/amazon-wtf.luluwebmaster.fr/fullchain.pem (failure)

Other information, all domains listed changed from VPS 3 ~ 4 months ago

Here it is, if it helps ^^

[Luluwebmaster]

Hello,

Ok, so I really do not understand this problem …

I just reassured this morning, and there, all the certificates have been renewed !