Certbot failed to authenticate some domains (authenticator: nginx)

Help
1

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: temp-finense.fr , www.temp-finense.fr

I ran this command:sudo certbot --nginx -v

It produced this output:sudo certbot --nginx -v

Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator nginx, Installer nginx

Which names would you like to activate HTTPS for?

1: temp-finense.fr
2: www.temp-finense.fr

Select the appropriate numbers separated by commas and/or spaces, or leave input
blank to select all options shown (Enter 'c' to cancel):
Requesting a certificate for temp-finense.fr and www.temp-finense.fr
Performing the following challenges:
http-01 challenge for temp-finense.fr
http-01 challenge for www.temp-finense.fr
Waiting for verification...
Challenge failed for domain temp-finense.fr
Challenge failed for domain www.temp-finense.fr
http-01 challenge for temp-finense.fr
http-01 challenge for www.temp-finense.fr

Certbot failed to authenticate some domains (authenticator: nginx). The Certificate Authority reported these problems:
Domain: temp-finense.fr
Type: connection
Detail: 54.88.147.234: Fetching http://temp-finense.fr/.well-known/acme-challenge/wYXLNCTQsbNaQZJqC9T9_cakeg3V0nhVPVQqgM4jdyQ: Connection refused

Domain: www.temp-finense.fr
Type: connection
Detail: 54.88.147.234: Fetching http://www.temp-finense.fr/.well-known/acme-challenge/RxIuPzarbWeQQH4TI9Gnr7D7SJcHIlXezh0Y59Mc-94: Connection refused

Hint: The Certificate Authority failed to verify the temporary nginx configuration changes made by Certbot. Ensure the listed domains point to this nginx server and that it is accessible from the internet.

Cleaning up challenges
Some challenges have failed.
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.

My web server is (include version): nginx/1.18.0

The operating system my web server runs on is (include version): 22.04.1-Ubuntu

My hosting provider, if applicable, is: aws route 53

I can login to a root shell on my machine (yes or no, or I don't know): yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel):
aws
The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): certbot 1.21.0

2

The ACME challenge requests were refused.
Please ensure that you have a working HTTP site before you continue trying to secure it [using HTTP-01 authentication].

Also, testing is best done on the staging environment.
For that add to the certbot request: "--dry-run"

Also, here is a good online testing tool:
Let's Debug (letsdebug.net)

Also...

You might not have followed the recommended installation instructions.
Please review:
Certbot Instructions | Certbot (eff.org)

3 Likes
3

Hello @alis, welcome to the Let's Encrypt community. :slightly_smiling_face:

You most likely have a firewall issue.

Best Practice - Keep Port 80 Open

Port 80 is close and port 443 is filtered.

$ nmap -4 -Pn -p80,443 temp-finense.fr
Starting Nmap 7.80 ( https://nmap.org ) at 2024-02-01 18:11 UTC
Nmap scan report for temp-finense.fr (54.88.147.234)
Host is up (0.075s latency).
rDNS record for 54.88.147.234: ec2-54-88-147-234.compute-1.amazonaws.com

PORT    STATE    SERVICE
80/tcp  closed   http
443/tcp filtered https

Nmap done: 1 IP address (1 host up) scanned in 2.08 seconds

$ nmap -4 -Pn -p80,443 www.temp-finense.fr
Starting Nmap 7.80 ( https://nmap.org ) at 2024-02-01 18:12 UTC
Nmap scan report for www.temp-finense.fr (54.88.147.234)
Host is up (0.082s latency).
rDNS record for 54.88.147.234: ec2-54-88-147-234.compute-1.amazonaws.com

PORT    STATE    SERVICE
80/tcp  closed   http
443/tcp filtered https

Nmap done: 1 IP address (1 host up) scanned in 2.07 seconds
1 Like
4

hello, thank you for your reply, I am new here.
I made this check on my terminal ufw status
Status: active

To Action From

22/tcp ALLOW Anywhere
Nginx Full ALLOW Anywhere
80 ALLOW Anywhere
443 ALLOW Anywhere
22/tcp (v6) ALLOW Anywhere (v6)
Nginx Full (v6) ALLOW Anywhere (v6)
80 (v6) ALLOW Anywhere (v6)
443 (v6) ALLOW Anywhere (v6)

2 Likes
5

It would appear there are additional firewalls between your server and the Internet; all of them must let the data pass.

$ nmap -4 -Pn -p80,443 www.temp-finense.fr
Starting Nmap 7.80 ( https://nmap.org ) at 2024-02-01 18:23 UTC
Nmap scan report for www.temp-finense.fr (54.88.147.234)
Host is up (0.081s latency).
rDNS record for 54.88.147.234: ec2-54-88-147-234.compute-1.amazonaws.com

PORT    STATE    SERVICE
80/tcp  closed   http
443/tcp filtered https

Nmap done: 1 IP address (1 host up) scanned in 2.21 seconds
3 Likes
6

The AWS security settings also need to allow HTTP.

4 Likes
7

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.