Certbot failed to authenticat standalone: invalid response

Help
1
  • My domain is:
    cimetrics.io
  • I ran this command:
    sudo certbot certonly --standalone -d cimetrics.io --staple-ocsp -m jonathanwoollettlight@gmail.com --agree-tos
  • It produced this output:
    Certbot failed to authenticate some domains (authenticator: standalone). The Certificate Authority reported these problems:
  Domain: cimetrics.io
  Type:   unauthorized
  Detail: 15.197.142.173: Invalid response from http://cimetrics.io/.well-known/acme-challenge/HAOi6Kom9At9ywZ8UAUykre5WqkAg8dfYvl6tEIA388: 404

Hint: The Certificate Authority failed to download the challenge files from the temporary standalone webserver started by Certbot on port 80. Ensure that the listed domains point to this machine and that it can accept inbound connections from the internet.
  • My web server is (include version):
    Custom.
  • The operating system my web server runs on is (include version):
    Ubuntu. See:
    ubuntu@ip-172-31-11-236:~$ uname --a
Linux ip-172-31-11-236 6.2.0-1017-aws #17~22.04.1-Ubuntu SMP Fri Nov 17 21:07:13 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux
  • My hosting provider, if applicable, is:
    aws ec2
  • I can login to a root shell on my machine (yes or no, or I don't know):
    Yes.
  • I'm using a control panel to manage my site (no, or provide the name and version of the control panel):
    No.
  • The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot):
    certbot 1.21.0

I am having trouble using cert-bot on my Ubuntu ec2 instance.

I have the domain cimetrics.io from godaddy and have forwarded it to point to my ec2 instance at 3.10.39.149.

Pinging the IP and domain demonstrates similar results

PS C:\Users\jonat> ping 3.10.39.149

Pinging 3.10.39.149 with 32 bytes of data:
Reply from 3.10.39.149: bytes=32 time=19ms TTL=49
Reply from 3.10.39.149: bytes=32 time=26ms TTL=49
Reply from 3.10.39.149: bytes=32 time=20ms TTL=49
Reply from 3.10.39.149: bytes=32 time=19ms TTL=49

Ping statistics for 3.10.39.149:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 19ms, Maximum = 26ms, Average = 21ms
PS C:\Users\jonat> ping cimetrics.io

Pinging cimetrics.io [3.33.152.147] with 32 bytes of data:
Reply from 3.33.152.147: bytes=32 time=34ms TTL=247
Reply from 3.33.152.147: bytes=32 time=32ms TTL=247
Reply from 3.33.152.147: bytes=32 time=30ms TTL=247
Reply from 3.33.152.147: bytes=32 time=36ms TTL=247

Ping statistics for 3.33.152.147:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 30ms, Maximum = 36ms, Average = 33ms
PS C:\Users\jonat>

I can also see the response from my http server on my ec2 instance using http://cimetrics.io/ and http://3.10.39.149/.

I also opened a stackoverflow question lets encrypt - Certbot failed to authenticat standalone: invalid response - Stack Overflow.

2

Hi @JonathanWoollett-Lig, and welcome to the LE community forum :slight_smile:

Using --standalone requires use of HTTP [TCP port 80].
But it seems that there is already something listening on that port:

Name:      cimetrics.io
Addresses: 15.197.142.173
           3.33.152.147

curl -Ii cimetrics.io
HTTP/1.1 405 Not Allowed
Server: awselb/2.0
Date: Sun, 31 Dec 2023 05:51:01 GMT
Content-Length: 0
Connection: keep-alive
WAFRule: 0

I do see that it tries to redirect - but it does so in a very unusual way AND to an IP address "3.10.39.149".
LE will NOT follow redirections to IP addresses :frowning:

4 Likes
3

I am able to start my custom server on this port using sudo and get a response, so this is confusing.

I can think of 2 possible problem areas:

  1. how godaddy sets up forwarding.
  2. how ec2 sets up permanent IP addresses.

but I do not see any actions I can take in either of these cases. Are there some you could suggest?

I would think this must be a common use case (godaddy domain to ec2 server), do you know of any similar issues that might offer some insight?

1 Like
4

It looks like you are using the URL redirect or URL forwarding service at godaddy. That won't work. You need to disable that and set the DNS to point directly to the IP of your server

4 Likes
5

How would I set the DNS to point directly to my server IP?

I would guess this involves editing the DNS records, apologies for my inexperience here.

These are the current DNS records:

; Domain: cimetrics.io
; Exported (y-m-d hh:mm:ss): 2023-12-30 23:39:48
;
; This file is intended for use for informational and archival
; purposes ONLY and MUST be edited before use on a production
; DNS server.
;
; In particular, you must update the SOA record with the correct
; authoritative name server and contact e-mail address information,
; and add the correct NS records for the name servers which will
; be authoritative for this domain.
;
; For further information, please consult the BIND documentation
; located on the following website:
;
; http://www.isc.org/
;
; And RFC 1035:
;
; http://www.ietf.org/rfc/rfc1035.txt
;
; Please note that we do NOT offer technical support for any use
; of this zone data, the BIND name server, or any other third-
; party DNS software.
;
; Use at your own risk.


$ORIGIN cimetrics.io.

; SOA Record
@	3600	 IN 	SOA	ns75.domaincontrol.com.	dns.jomax.net. (
					2023123000
					28800
					7200
					604800
					3600
					) 

; A Record
@	600	 IN 	A	15.197.142.173
@	600	 IN 	A	3.33.152.147

; NS Record
@	3600	 IN 	NS	ns75.domaincontrol.com.
@	3600	 IN 	NS	ns76.domaincontrol.com.

; CNAME Record
www	3600	 IN 	CNAME	@
_domainconnect	3600	 IN 	CNAME	_domainconnect.gd.domaincontrol.com.
6

So removing the forwarding done by godaddy and updating the DNS records to link the IP directly appears to have fixed the problem.

; Domain: cimetrics.io
; Exported (y-m-d hh:mm:ss): 2023-12-31 00:59:32
;
; This file is intended for use for informational and archival
; purposes ONLY and MUST be edited before use on a production
; DNS server.
;
; In particular, you must update the SOA record with the correct
; authoritative name server and contact e-mail address information,
; and add the correct NS records for the name servers which will
; be authoritative for this domain.
;
; For further information, please consult the BIND documentation
; located on the following website:
;
; http://www.isc.org/
;
; And RFC 1035:
;
; http://www.ietf.org/rfc/rfc1035.txt
;
; Please note that we do NOT offer technical support for any use
; of this zone data, the BIND name server, or any other third-
; party DNS software.
;
; Use at your own risk.


$ORIGIN cimetrics.io.

; SOA Record
@	3600	 IN 	SOA	ns75.domaincontrol.com.	dns.jomax.net. (
					2023123102
					28800
					7200
					604800
					3600
					) 

; A Record
@	600	 IN 	A	3.10.39.149

; NS Record
@	3600	 IN 	NS	ns75.domaincontrol.com.
@	3600	 IN 	NS	ns76.domaincontrol.com.

; CNAME Record
www	3600	 IN 	CNAME	@
_domainconnect	3600	 IN 	CNAME	_domainconnect.gd.domaincontrol.com.
2 Likes
7

I tested my setup, I can now get responses from HTTPS requests to my server on my ec2 instance via the domain.

Thankyou for the vital help to point me in the right direction here :+1:.

4 Likes
8

I'm hoping GoDaddy also has a web panel for modifying your DNS entries? While I'm not unfamiliar with these DNS zones myself, it's not very customer friendly..

1 Like
9

Excuse me, does anyone know what is the ssl problem of my site? https://www.azmoonica.ir/

10

@AZMOONIA Please start a new thread. We like every new problem to have their own.

Put it in the Help section and you will be asked to answer some questions. Please answer as best you can.

Please also describe the problem in more detail. I don't see anything obviously wrong with it.

5 Likes
11

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.