Certbot error with nginx "Certbot failed to authenticate some domains)

Help
1

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: portal.blue-ridge-inc.com

I ran this command:sudo certbot --nginx

It produced this output:

blank to select all options shown (Enter 'c' to cancel): 1
Requesting a certificate for portal.blue-ridge-inc.com
Certbot failed to authenticate some domains (authenticator: nginx). The Certificate Authority reported these problems:
Domain: portal.blue-ridge-inc.com
Type: unauthorized
Detail: 3.33.251.168: Invalid response from http://portal.blue-ridge-inc.com/.well-known/acme-challenge/LCfmCb6wgu_aQeKwsF5ZY9iHmcFVFnL0soJydijbNmM: 403
Hint: The Certificate Authority failed to verify the temporary nginx configuration changes made by Certbot. Ensure the listed domains point to this nginx server and that it is accessible from the internet.
Some challenges have failed.
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.

My web server is (include version):nginx/1.18.0 (Ubuntu)

The operating system my web server runs on is (include version):Ubuntu 22.04.3 LTS

My hosting provider, if applicable, is: GoDaddy

I can login to a root shell on my machine (yes or no, or I don't know): Yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel): No

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): certbot 4.1.1

2

@BRA_WJG, welcome to the community! :slightly_smiling_face:

It looks like there is something in the nginx configuration that blocks access to the website. You may want to fix this, at least for the /.well-known/acme-challenge/ directory. The Letsdebug site gives warning about it: Let's Debug

1 Like
3

Your GoDaddy DNS has multiple A record addresses for IPv4. This usually means you have Domain Forwarding setup in your DNS. You need to disable that and have an A record just for your public IP of your nginx server. Your DNS is currently directing any visitor (like Let's Encrypt) to the GoDaddy service and not directly to your nginx server.

Here is one past thread that describes that process: I got This error - #6 by Geno11x11

3 Likes
5

I deleted my reply, because after some investigating I realized my reply was wrong. We have domain forwarding on the old domain, not the new one. Now that I look, I see I do have forwarding setup for the portal subdomain. I am going to try and follow your linked thread.

Thank you!

2 Likes
6

Worked like a charm. Thanks!

2 Likes