Certbot failed to authenticate some domains (authenticator: apache). Please Help

My domain is:gym-manager.com

I ran this command: sudo certbot --apache

It produced this output:
Certbot failed to authenticate some domains (authenticator: apache). The Certificate Authority reported these problems:
Domain: gym-manager.com
Type: connection
Detail: 15.197.148.33: Fetching http://gym-manager.com/.well-known/acme-challenge/wwKWJod7ArOslzv8bDxNzcnyAGWqs1vnNBRKRmLPGgE: Error getting validation data

Domain: www.gym-manager.com
Type: connection
Detail: 3.33.130.190: Fetching http://www.gym-manager.com/.well-known/acme-challenge/1t7jPc9AKeOaoL3fs4EAt4_n1eR3YYi_zzawWMl190A: Error getting validation data

Hint: The Certificate Authority failed to verify the temporary Apache configuration changes made by Certbot. Ensure that the listed domains point to this Apache server and that it is accessible from the internet.

Some challenges have failed.

My web server is (include version):Apache/2.4.52 (Ubuntu)

The operating system my web server runs on is (include version): Ubuntu 22.04 (LTS) x64
My hosting provider, if applicable, is:DigitalOcean

I can login to a root shell on my machine (yes or no, or I don't know):

I'm using a control panel to manage my site (no, or provide the name and version of the control panel):DigitalOcean

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot):certbot 1.21.0

keep in mind i manage my Dns Record 24hours ago and sometimes i can access to mywebsite via browser from other devices and sometimes not and when i want to get ssl certificare this error appear is that due Dns propagation?

there are 3 IP addresses configured, 3.33.130.190, 15.197.148.33 and 206.189.126.173. The first 2 are Amazon IP addreses and have an openresty webserver running. Only the latter IP address is from DigitalOcean and has an Apache webserver running.

You probably need to fix your DNS zone.

2 Likes

please can you help me how to fix this problem? because this is the first time i request a certificate

Login to your DNS zone editor/control panel, delete the erroneous IP addresses and try again.

You need to have a working website first before you try to get a certificate.

but in my Dns records i have only one ip and this ip point to domain name gym-manager.com i don't know from where i got erroneous IP address?

Where are you trying to edit your DNS zone?

DigitalOcean and GoDaddy

You can't edit your DNS zone at both.

Currently your DNS zone is managed by nameservers from the domaincontrol.com domain, which seems to be nameservers from GoDaddy. You need to have your DNS zone fixed at GoDaddy.

to be frankly i don't now how to do it please can you help me more

I'm sorry, but this is not the generic "how do I properly configure my DNS" support Community.

We might be able to help, but personally I'd need a lot more input from your end. You said you already tried to edit your DNS zone using GoDaddy (and implied it was OK). I can't help you with words (because I'm not familiar with GoDaddy), so I'd need you to be more forthcoming with information from your end by yourself. E.g., screenshots et c. Why do you think GoDaddy is already configured correctly?

ofc i think go daddy is configured correctly because i set up the dns records correctly after i follow tutorials and i can access to my website via http://gym-manager.com so i think my domain name point to ip address correctly.
but what i don't unserstand why i get the two ip addresses as you told me

But you also said:

So what is it: can you reach your website correctly or not? :wink: Fact is, there are 3 IP addresses listed for you domain:

gym-manager.com.	600	IN	A	3.33.130.190
gym-manager.com.	600	IN	A	15.197.148.33
gym-manager.com.	600	IN	A	206.189.126.173
gym-manager.com.	3600	IN	NS	ns72.domaincontrol.com.
gym-manager.com.	3600	IN	NS	ns71.domaincontrol.com.
;; Received 144 bytes from 97.74.105.46#53(ns71.domaincontrol.com) in 10 ms

You can test this for yourself at Dig (DNS lookup), https://digwebinterface.com/ or https://unboundtest.com/ (use the "A" query type).

hhhh that's what i can't understand why i have the other 2 ip addresses

.....because your DNS zone is not configured correctly.

I'm a little fed up going in circles here. I have yet to see any GoDaddy DNS zone editor screenshot.. I wish you all the best in your endeavours. Maybe someone else is willing to help you.

thank you i wish all the best

1 Like

You have GoDaddy Domain Forwarding or Parking still setup for that domain (probably parking)

See this for how to fix

2 Likes

@MikeMcQ But why is there also a DigitalOcean IP address among the other two? Wouldn't it be just GoDaddy IP addresses if it were domain forwarding or parking? :thinking:

We often see a mix of three IP addresses two of which point to either their forwarding or parking service and the third for the actual one. Something happens during the transition for a new setup. I don't know why it just does. And the thread I linked to is the best description I have seen from someone who actually walked through it.

2 Likes

Well, that's just plain weird. But I guess it could happen :man_shrugging:t2:

Yeah we used to see just the two wrong ones. But in the last couple / few months we have seen more cases where there are three as I described

2 Likes