Certbot failed to authenticate a new domain

Help
1

My domain is:
c-plusplus.nl

I ran this command:
certbot --apache certonly
and selected option 1: 1: c-plusplus.nl

It produced this output:
Certbot failed to authenticate some domains (authenticator: apache). The Certificate Authority reported these problems:
Domain: c-plusplus.nl
Type: unauthorized
Detail: 2a01:1b0:7999:402::1150: Invalid response from http://c-plusplus.nl/.well-known/acme-challenge/aAwbg2mfCtrEg1hl0cboPCIz4AknRjYf1J9oDYALeZA: 404

My web server is include version):
apache2 (version 2.4.63)

The operating system my web server runs on is (include version):
debian linux (trixie)

My hosting provider, if applicable, is:
not applicable

I can login to a root shell on my machine:
yes

I'm using a control panel to manage my site:
no

The version of my client is:
certbot 2.11.0

Additional info:
Let's Debug (letsdebug.net) reports no errors when looking for c-plusplus.nl
There are two additional domains active on my computer: their let's encrypt certificates were correctly created and are correctly automatically renewed
The directory http://c-plusplus.nl/.well-known/acme-challenge/ exists and is accessible by webbrowsers.
Comparable help requests were filed (e.g. Sep. 2023), but did not provide information allowing me to fix the problem. Hence the request for help.

1 Like
2

Welcome to the Let's Encrypt Community! :slightly_smiling_face:

We often see issues here where IPv6 addresses (AAAA records) and IPv4 addresses (A records) do not point to the same content. Since Let's Encrypt uses an IPv6 address if available, I recommend starting by ensuring that http://c-plusplus.nl/.well-known/acme-challenge/test is reachable via your IPv6 address (2a01:1b0:7999:402::1150).

3 Likes
3

Hi Griffin,
Thanks for your reply and hint: IPv6 could very well be the cause of the problem. I'd prefer using just the IPv4 address. but the computer's IPv6 address is currently configured. I'll disable it and try to request the certificates again.

2 Likes
4

That sounds like an excellent plan (and is the plan we usually recommend). :slightly_smiling_face:

1 Like
5

Hm... apparently there's still a problem. I followed the advice on How to Disable IPv6 on Linux to disable IPv6 access, and 'ip a | grep inet6' indeed didn't show an IPv6 address anymore.
However 'certbot --apache certonly' did not succeed:
Domain: c-plusplus.nl
Type: unauthorized
Detail: 2a01:1b0:7999:402::1150: Invalid response from http://c-plusplus.nl/.well-known/acme-challenge/ZAXqRS2I9pAx6A-VfwzVI-hR3ZXmCGwhE4eaqVCqwPg: 404
Anything I maybe have missed?

1 Like
6

I'm still seeing an IPv6 address (AAAA record) and so is Let's Encrypt:

c-plusplus.nl. 3600 IN AAAA 2a01:1b0:7999:402::1150

2 Likes
7

Not funny :frowning: Since 'ip a | grep inet6' doesn't show IPv6 configuration details do you maybe have any hints about how to proceed?

1 Like
8

Maybe I found the origin of the IPv6 address. I'll try to have it undefined....

1 Like
9

When you are reviewing the AAAA record in your DNS you should also review your name server delegation. Looks like you may have a typo with ns20.mx10.nl in your authoritative server but you have ns20.mx10.eu (note .eu) in the delegation.

Both the .eu and .nl names point to the same IP so probably harmless now but it is better practice to use the names consistently (to prevent future trouble)

See, for example, the warning messages at: c-plusplus.nl | DNSViz

Or, the result of a trace using the dig DNS query tool (parts omitted)

dig +trace AAAA c-plusplus.nl

c-plusplus.nl.          3600    IN      NS      ns10.mx10.nl.
c-plusplus.nl.          3600    IN      NS      ns20.mx10.eu.

c-plusplus.nl.          3600    IN      AAAA    2a01:1b0:7999:402::1150

c-plusplus.nl.          3600    IN      NS      ns10.mx10.nl.
c-plusplus.nl.          3600    IN      NS      ns20.mx10.nl.
2 Likes
10

And it looks like it was a configuration at the domain provider. The IPv6 address was removed, and should have been gone in about 1/2 hour. I'll check it and try again later. Once again, thx for your help and input :slight_smile:

2 Likes
11

... and that solved the puzzle :slight_smile:

... Requesting a certificate for c-plusplus.nl and 
    www.c-plusplus.nl

    Successfully received certificate.

Thanks for your fast and useful support!

2 Likes